Function at 0x409760
Capabilities:
Create directory
Delete file
Get common file path
Persist via run registry key
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd54
mov eax, dword [0x4431cc]
push ebx
xor eax, ebp
push esi
push edi
mov ebx, ecx
mov dword [esp + 0xd5c], eax
xor eax, eax
mov ecx, 0x41
mov edi, 0x44760c
push 0x208
mov dword [esp + 0x1c], 0x100
rep stosd dword es:[edi], eax
call fcn.0042403f
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409ecd
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push 0x44a4c4
push eax
push eax
push str.ProgramFilesDir
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x44a4c4
call fcn.004144df
add esp, 4
cmp word [eax*2 + 0x44a4c2], 0x5c
je 0x40980e
push 0x4330e4
push 0x44a4c4
call fcn.004145d0
add esp, 8
push 0x44a4c4
push 0x4471fc
call fcn.004145fa
push str.Avago_HP
push 0x4471fc
call fcn.004145d0
add esp, 0x10
push 0
push 0x4471fc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x4471fc
push 0x447404
call fcn.004145fa
push 0x4330e4
push 0x447404
call fcn.004145d0
push str.Uninstall.log
push 0x447404
call fcn.004145d0
add esp, 0x18
push 0x447404
mov ecx, 0x44d2d0
call fcn.004026e0
xor eax, eax
mov ecx, 0x82
lea edi, [esp + 0xb50]
rep stosd dword es:[edi], eax
movzx ecx, word [0x4442c8]
push 0xa
lea eax, [esp + 0xb54]
push eax
push ecx
call fcn.00414ddb
add esp, 0xc
push str._r_nSystem_Language_ID_:
mov ecx, 0x44d2d0
call fcn.00402680
lea edx, [esp + 0xb50]
push edx
mov ecx, 0x44d2d0
call fcn.00402680
push str._r_nLanguage_Directory_:
mov ecx, 0x44d2d0
call fcn.00402680
push 0x4442d4
mov ecx, 0x44d2d0
call fcn.00402680
lea eax, [esp + 0x420]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x420]
push ecx
call fcn.004144df
add esp, 4
cmp word [esp + eax*2 + 0x41e], 0x5c
je 0x409927
lea edx, [esp + 0x420]
push 0x4330e4
push edx
call fcn.004145d0
add esp, 8
xor eax, eax
mov ecx, 0x82
lea edi, [esp + 0x218]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x420]
push eax
lea ecx, [esp + 0x21c]
push ecx
call fcn.004145fa
lea edx, [esp + 0x220]
push 0x4442d4
push edx
call fcn.004145d0
lea eax, [esp + 0x228]
push str._strings.dll
push eax
call fcn.004145d0
add esp, 0x18
push 2
push 0
lea ecx, [esp + 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [0x4444dc], eax
jne 0x4099e0
push str._r_nError:_Unable_to_open_Strings.dll
mov ecx, 0x44d2d0
call fcn.00402680
lea edx, [esp + 0x218]
push edx
mov ecx, 0x44d2d0
call fcn.00402680
push 0xa
lea eax, [esp + 0x62c]
push eax
push 0x13f2
call fcn.00414ddb
add esp, 0xc
push 0x43c88c
lea edx, [esp + 0x14]
lea ecx, [esp + 0x62c]
push edx
mov dword [esp + 0x18], ecx
call fcn.00414e9e
lea edi, [ebx + 0xa0]
push str.Marvell
push edi
call fcn.004145fa
add esp, 8
push esi
push edi
mov ecx, ebx
call fcn.00409280
test esi, esi
jne 0x409a4c
push str._r_nError:_Unable_to_open_Setup.ini
mov ecx, 0x44d2d0
call fcn.00402680
push esi
mov ecx, 0x44d2d0
call fcn.00402680
push 0xa
lea eax, [esp + 0x62c]
push eax
push 0x1423
call fcn.00414ddb
add esp, 0xc
push 0x43c88c
lea edx, [esp + 0x14]
lea ecx, [esp + 0x62c]
push edx
mov dword [esp + 0x18], ecx
call fcn.00414e9e
mov edi, 1
push 0x208
mov dword [0x444d64], 0
mov dword [esp + 0x14], edi
call fcn.0042403f
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 4
push esi
push 0x104
push eax
push str.Failed
push str.PrinterName
push str.PRINTER_NAME
mov dword [0x4446e8], eax
call ebx
mov ecx, dword [0x4446e8]
push esi
push 0x104
lea eax, [esp + 0x28]
push eax
push str.Failed
push ecx
push str.PRINTER_TYPE
call ebx
lea edx, [esp + 0x20]
push str.HORNET_BASE
push edx
call fcn.004150fa
add esp, 8
test eax, eax
jne 0x409acf
mov dword [0x444d34], 0x14
jmp 0x409b33
lea eax, [esp + 0x20]
push str.HORNET_PLUS
push eax
call fcn.004150fa
add esp, 8
test eax, eax
jne 0x409af1
mov dword [0x444d34], 0x15
jmp 0x409b33
lea ecx, [esp + 0x20]
push str.WASP_BASE
push ecx
call fcn.004150fa
add esp, 8
test eax, eax
jne 0x409b13
mov dword [0x444d34], 0x16
jmp 0x409b33
lea edx, [esp + 0x20]
push str.WASP_NETWORK
push edx
call fcn.004150fa
add esp, 8
test eax, eax
jne 0x409b33
mov dword [0x444d34], 0x17
inc dword [0x444d64]
mov dword [esp + 0x1c], edi
lea ecx, [ecx]
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x948]
rep stosd dword es:[edi], eax
mov ecx, 0x19
lea edi, [esp + 0xe8]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1c]
push 0xa
lea eax, [esp + 0x1b4]
push eax
push ecx
call fcn.00414ddb
lea edx, [esp + 0xf4]
push str.PrinterName
push edx
call fcn.004145fa
lea eax, [esp + 0x1c4]
push eax
lea ecx, [esp + 0x100]
push ecx
call fcn.004145d0
add esp, 0x1c
push esi
push 0x104
lea edx, [esp + 0x950]
push edx
push str.Failed
lea eax, [esp + 0xf8]
push eax
push str.PRINTER_NAME
call ebx
lea ecx, [esp + 0x948]
push str.Failed
push ecx
call fcn.004150fa
add esp, 8
test eax, eax
jne 0x409be4
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
jmp 0x409cc0
push 0x208
call fcn.0042403f
mov edi, dword [esp + 0x20]
lea edx, [esp + 0x94c]
push edx
push eax
mov dword [edi*4 + 0x4446e8], eax
call fcn.004145fa
mov edx, dword [0x444d64]
add esp, 0xc
push esi
push 0x104
lea eax, [esp + 0x28]
push eax
inc edx
mov dword [0x444d64], edx
mov ecx, dword [edi*4 + 0x4446e8]
push str.Failed
push ecx
push str.PRINTER_TYPE
call ebx
lea edx, [esp + 0x20]
push str.HORNET_BASE
push edx
call fcn.004150fa
add esp, 8
test eax, eax
jne 0x409c59
mov dword [edi*4 + 0x444d34], 0x14
jmp 0x409cc0
lea eax, [esp + 0x20]
push str.HORNET_PLUS
push eax
call fcn.004150fa
add esp, 8
test eax, eax
jne 0x409c7c
mov dword [edi*4 + 0x444d34], 0x15
jmp 0x409cc0
lea ecx, [esp + 0x20]
push str.WASP_BASE
push ecx
call fcn.004150fa
add esp, 8
test eax, eax
jne 0x409c9f
mov dword [edi*4 + 0x444d34], 0x16
jmp 0x409cc0
lea edx, [esp + 0x20]
push str.WASP_NETWORK
push edx
call fcn.004150fa
add esp, 8
test eax, eax
jne 0x409cc0
mov dword [edi*4 + 0x444d34], 0x17
mov eax, dword [esp + 0x10]
inc edi
cmp eax, 1
mov dword [esp + 0x1c], edi
je 0x409b40
xor eax, eax
push esi
mov dword [0x44d2b8], eax
mov dword [0x44d2c0], eax
mov dword [0x44d2bc], eax
call fcn.00408f50
mov dword [0x44d2b8], eax
xor eax, eax
push 0x44a4c4
mov ecx, 0x41
mov edi, 0x4463c4
push 0x4461bc
rep stosd dword es:[edi], eax
call fcn.004145fa
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409d7b
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push 0x4465cc
push eax
push eax
push str.Common_Programs
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x4465cc
call fcn.004144df
add esp, 4
cmp word [eax*2 + 0x4465ca], 0x5c
je 0x409d97
push 0x4330e4
push 0x4465cc
call fcn.004145d0
add esp, 8
jmp 0x409d97
push esi
push 0x104
push 0x4465cc
push str.Failed
push str.ProgramGroupPath
push str.SETUP_SETTINGS
call ebx
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
lea ecx, [esp + 0x14]
push ecx
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocStringLen
mov dword [esp + 0x2c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409e11
lea edx, [esp + 0x18]
push edx
push 0x4467d4
push eax
push eax
mov eax, dword [esp + 0x24]
push str.Programs
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x4467d4
call fcn.004144df
add esp, 4
cmp word [eax*2 + 0x4467d2], 0x5c
je 0x409e49
push 0x4330e4
push 0x4467d4
call fcn.004145d0
add esp, 8
jmp 0x409e49
push esi
push 0x104
push 0x4467d4
push str.Failed
push str.ProgramGroupPath
push str.HPLJP1000_SERIES_SETUP_SETTINGS
call ebx
push esi
push 0x104
push 0x4467d4
push str.Failed
push str.ProgramGroupPath
push str.SETUP_SETTINGS
call ebx
mov ecx, dword [esp + 0x14]
push ecx
call edi
push esi
push 0x104
push 0x444b28
push str.Failed
push str.PrintInf
push str.SETUP_FILES
call ebx
push esi
push 0x104
push 0x444718
push str.Failed
push str.StandardPrintInf
push str.SETUP_FILES
call ebx
push esi
push 0x104
push 0x444920
push str.Failed
push str.DerivativePrintInf
push str.SETUP_FILES
call ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call fcn.00424044
mov ecx, dword [esp + 0xd60]
add esp, 4
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414a22
mov esp, ebp
pop ebp
ret
push 0xa
lea edx, [esp + 0x62c]
push edx
push 0x13f1
call fcn.00414ddb
add esp, 0xc
push 0x43c88c
lea ecx, [esp + 0x14]
lea eax, [esp + 0x62c]
push ecx
mov dword [esp + 0x18], eax
call fcn.00414e9e
int3