Function at 0x408220
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x441dac]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push esi
push edi
xor ebx, ebx
push ebx
lea eax, [esp + 0x14]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SYSTEMCurrentControlSetServicesHWHandSet
push 0x80000002
mov dword [esp + 0x38], ebx
call ebp
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, eax
cmp edi, ebx
je 0x408297
push edi
lea ecx, [esp + 0x1c]
push str.INFO:_Open_Key_HWHandSet_error___d._n
push ecx
call fcn.00419ba9
lea edx, [esp + 0x24]
push edx
call fcn.00404820
add esp, 0x10
cmp edi, 5
jne 0x4082cd
mov eax, 0x4e2d
jmp 0x408453
mov eax, dword [esp + 0x10]
push str.QCDriverResident
push eax
call esi
mov ecx, dword [esp + 0x10]
push str.QCDriverPowerManagementEnabled
push ecx
call esi
mov edx, dword [esp + 0x10]
push str.QCDriverWaitWakeEnabled
push edx
call esi
mov ebx, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 5
je 0x408315
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServiceshn_usbdev
push 0x80000002
call ebp
mov edi, eax
test edi, edi
je 0x40831f
push edi
lea edx, [esp + 0x1c]
push str.INFO:_Open_Key_hn_usbdev_error___d._n
push edx
call fcn.00419ba9
lea eax, [esp + 0x24]
push eax
call fcn.00404820
add esp, 0x10
cmp edi, 5
jne 0x408360
mov eax, 0x4e2d
jmp 0x408453
mov ecx, dword [esp + 0x10]
push str.QCDriverResident
push ecx
call esi
mov edx, dword [esp + 0x10]
push str.QCDriverPowerManagementEnabled
push edx
call esi
mov eax, dword [esp + 0x10]
push str.QCDriverWaitWakeEnabled
push eax
call esi
mov ecx, dword [esp + 0x10]
push str.EnableCD
push ecx
call esi
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov ebx, eax
call edi
jmp 0x408366
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 5
je 0x40828d
mov eax, dword [0x43900c]
cmp eax, 2
je 0x4083d6
cmp eax, 3
je 0x4083d6
cmp eax, 4
je 0x4083d6
cmp eax, 5
je 0x4083d6
cmp eax, 7
je 0x408396
cmp eax, 6
jne 0x408447
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionDriverSearching
push 0x80000002
call ebp
mov esi, eax
test esi, esi
je 0x4083c4
push esi
push str.Open_Key_Searching_Windows_Update_error___d._n
jmp 0x408402
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.SearchOrderConfig
jmp 0x408435
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsDriverSearching
push 0x80000002
call ebp
mov esi, eax
test esi, esi
je 0x408425
push esi
push str.INFO:_Open_Key_Searching_Windows_Update_error___d._n
lea ecx, [esp + 0x20]
push ecx
call fcn.00419ba9
lea edx, [esp + 0x24]
push edx
call fcn.00404820
add esp, 0x10
cmp esi, 5
jne 0x408447
mov eax, 0x4e2d
jmp 0x408453
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.DontSearchWindowsUpdate
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call edi
push 0
call fcn.00405160
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041811d
add esp, 0x110
ret