Function at 0x4088b0
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push esi
push edi
xor ebp, ebp
push ebp
lea eax, [esp + 0x14]
push eax
push ebp
push 0x2001f
push ebp
push ebp
push ebp
push str.SYSTEMCurrentControlSetServicesHWHandSet
push 0x80000002
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], 1
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
cmp esi, ebp
je 0x408916
push esi
push str.INFO:_Open_Key_hwdatacard_or_HWHandSet_error___d._n
call fcn.00404950
add esp, 8
cmp esi, 5
jne 0x4089be
pop edi
pop esi
pop ebp
mov eax, 0x4e2d
pop ebx
add esp, 0xc
ret
cmp byte [0x4439d8], 1
jne 0x408936
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push 0
push str.QCDriverPowerNotify
push edx
call edi
cmp byte [0x4439d7], 1
jne 0x40896e
mov eax, dword [0x43700c]
cmp eax, 1
je 0x408953
cmp eax, 2
je 0x408953
cmp eax, 3
jne 0x40896e
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.QCDriverWinxpPMEnabled
mov dword [esp + 0x28], ebp
push ecx
jmp 0x40898b
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.QCDriverWinxpPMEnabled
mov dword [esp + 0x28], 1
push eax
call edi
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push 0
push str.QCDriverResident
push edx
mov dword [esp + 0x2c], 1
call edi
mov ebp, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, 5
je 0x4089f7
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServiceshw_usbdev
push 0x80000002
call ebx
mov esi, eax
test esi, esi
je 0x408a04
push esi
push str.INFO:_Open_Key_hw_usbdev_error___d._n
call fcn.00404950
add esp, 8
cmp esi, 5
jne 0x408a66
pop edi
pop esi
pop ebp
mov eax, 0x4e2d
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.QCDriverResident
push eax
call edi
mov eax, dword [0x4439e0]
test eax, eax
je 0x408a49
push 4
xor ecx, ecx
cmp eax, 1
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 4
setne cl
push 0
push str.EnableCD
push eax
mov dword [esp + 0x30], ecx
call edi
jmp 0x408a59
mov ecx, dword [esp + 0x10]
push str.EnableCD
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
push edx
mov ebp, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, 5
je 0x408909
mov eax, dword [0x43700c]
cmp eax, 2
je 0x408aea
cmp eax, 3
je 0x408aea
cmp eax, 4
je 0x408aea
cmp eax, 5
je 0x408aea
cmp eax, 7
je 0x408a96
cmp eax, 6
jne 0x408b5a
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionDriverSearching
push 0x80000002
call ebx
mov esi, eax
test esi, esi
je 0x408ac4
push esi
push str.Open_Key_Searching_Windows_Update_error___d._n
jmp 0x408b16
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push 0
push str.SearchOrderConfig
push edx
mov dword [esp + 0x2c], 2
call edi
mov eax, dword [esp + 0x10]
push eax
jmp 0x408b54
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsDriverSearching
push 0x80000002
call ebx
mov esi, eax
test esi, esi
je 0x408b30
push esi
push str.INFO:_Open_Key_Searching_Windows_Update_error___d._n
call fcn.00404950
add esp, 8
cmp esi, 5
jne 0x408b5a
pop edi
pop esi
pop ebp
mov eax, 0x4e2d
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.DontSearchWindowsUpdate
push eax
mov dword [esp + 0x2c], 1
call edi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
call fcn.00405060
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret