Function at 0x40dcf2
Capabilities:
Check if file exists
Delete registry value
Persist via run registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1c88]
mov eax, 0x1c88
call fcn.00439720
push 0xffffffffffffffff
push 0x45247c
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x46f0c0]
xor eax, ebp
mov dword [ebp + 0x1c84], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x17
xor edi, edi
push edi
push str.HPInternetUtil.InetService
lea ecx, [ebp - 0x2c]
call fcn.0040919c
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.004017cf
mov ecx, eax
call fcn.0040175a
test eax, eax
jne 0x40dd72
mov eax, dword [ebp - 0x2c]
or dword [ebp - 4], 0xffffffff
cmp eax, edi
je 0x40dd6b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor al, al
jmp 0x40e5c0
call fcn.00408f02
push eax
lea ecx, [ebp - 0x34]
call fcn.00401953
push ecx
lea eax, [ebp - 0x34]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call fcn.00401bf0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.004017cf
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00408e9d
mov esi, 0x470678
push eax
mov ecx, esi
call fcn.0040243e
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
je 0x40ddc3
call fcn.00401c0f
push str.HPSUService.asmx
lea ecx, [ebp - 0x30]
call fcn.00401906
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0040253f
mov ecx, dword [ebp - 0x30]
cmp ecx, edi
mov byte [ebp - 4], 1
je 0x40ddef
call fcn.00401c0f
push edi
lea ecx, [ebp]
call fcn.0040d986
mov ecx, dword [0x470678]
cmp ecx, edi
mov byte [ebp - 4], 4
je 0x40de0d
call fcn.0040141a
jmp 0x40de0f
xor eax, eax
push eax
lea ecx, [ebp]
call fcn.00408d0c
mov ecx, dword [0x470678]
cmp ecx, edi
je 0x40de29
call fcn.0040141a
jmp 0x40de2b
xor eax, eax
push 0x456b48
push eax
push str.Metric_service_is_pointing_to
mov ecx, 0x470688
call fcn.0040fe88
mov ecx, eax
call fcn.0040fe88
mov ecx, eax
call fcn.0040fe88
mov dword [ebp - 0x20], edi
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
call fcn.00403924
test eax, eax
jne 0x40de9d
push 0x470665
lea ecx, [ebp]
call fcn.00407aea
cmp byte [0x470665], 0
je 0x40de95
push str.HP_Software_Update
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [ebp - 0x20]
call fcn.0040390d
call fcn.004198e8
push eax
lea ecx, [ebp - 0x30]
call fcn.00401953
push str.TestMode.txt
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 6
call fcn.00401953
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 7
call fcn.0040253f
mov ecx, dword [ebp - 0x1c]
cmp ecx, edi
mov byte [ebp - 4], 6
je 0x40dedc
call fcn.00401c0f
mov ecx, dword [ebp - 0x30]
cmp ecx, edi
je 0x40deea
call fcn.0040141a
jmp 0x40deec
xor eax, eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40defe
mov byte [0x470664], 1
mov esi, 0x470674
push str.HPSU
mov ecx, esi
call fcn.004024d6
push 0x20019
push str.SoftwareHewlett_PackardHP_Software_Update
push ebx
lea ecx, [ebp - 0x20]
call fcn.00403924
test eax, eax
jne 0x40e025
push 0x32
pop eax
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c50]
push edi
push eax
call fcn.00439d20
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x1c50]
push eax
push str.version
lea ecx, [ebp - 0x20]
call fcn.00403959
lea eax, [ebp + 0x1c50]
push eax
lea ecx, [ebp - 0x14]
call fcn.00401906
push 0x459918
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
call fcn.00401953
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov byte [ebp - 4], 9
call fcn.0040253f
mov ecx, dword [ebp - 0x1c]
cmp ecx, edi
mov byte [ebp - 4], 8
je 0x40df98
call fcn.00401c0f
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0040253f
lea eax, [ebp - 0x28]
push eax
push str.Ndays
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call fcn.00405ef5
lea eax, [ebp - 0x24]
push eax
push str.Notify
lea ecx, [ebp - 0x20]
call fcn.00405ef5
push dword [ebp - 0x24]
lea eax, [ebp + 0x1c1c]
push dword [ebp - 0x28]
push str.__nDays_d__Notify_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp + 0x1c1c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401906
push eax
mov ecx, esi
mov byte [ebp - 4], 0xa
call fcn.0040253f
mov ecx, dword [ebp - 0x1c]
cmp ecx, edi
je 0x40e00d
call fcn.00401c0f
lea ecx, [ebp - 0x20]
call fcn.0040390d
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
mov byte [ebp - 4], 6
je 0x40e025
call fcn.00401c0f
lea ecx, [ebp - 0x2c]
call fcn.004017cf
mov ecx, eax
call fcn.004060b6
cmp eax, 0x1b58
lea ecx, [ebp - 0x14]
jle 0x40e04e
push str._broadband
call fcn.00401953
mov byte [ebp - 4], 0xb
jmp 0x40e05c
push str._modem
call fcn.00401953
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0040253f
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
mov byte [ebp - 4], 6
je 0x40e077
call fcn.00401c0f
cmp byte [0x470664], 0
lea ecx, [ebp - 0x14]
je 0x40e093
push 0x4598b4
call fcn.00401953
mov byte [ebp - 4], 0xd
jmp 0x40e0a1
push 0x4598b0
call fcn.00401953
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0040253f
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
mov byte [ebp - 4], 6
je 0x40e0bc
call fcn.00401c0f
push str._BitsVer
lea ecx, [ebp - 0x14]
call fcn.00401953
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
mov byte [ebp - 4], 0xf
call fcn.0040253f
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
mov byte [ebp - 4], 6
je 0x40e0e8
call fcn.00401c0f
lea ecx, [ebp - 0x2c]
call fcn.004017cf
mov ecx, eax
call fcn.004060e1
mov word [ebp - 0x44], 3
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x10
call fcn.004086b0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x11
call fcn.0040253f
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
je 0x40e12b
call fcn.00401c0f
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 6
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push str._DotNetVer
lea ecx, [ebp - 0x14]
call fcn.00401906
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x12
call fcn.0040253f
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
mov byte [ebp - 4], 6
je 0x40e165
call fcn.00401c0f
call fcn.00408feb
push eax
lea ecx, [ebp - 0x14]
call fcn.00401953
push eax
mov ecx, esi
mov byte [ebp - 4], 0x13
call fcn.0040253f
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
mov byte [ebp - 4], 6
je 0x40e18f
call fcn.00401c0f
mov ecx, dword [0x470674]
cmp ecx, edi
je 0x40e1a0
call fcn.0040141a
jmp 0x40e1a2
xor eax, eax
push 0x45988c
push eax
mov esi, 0x470688
push str.Browserstring:
mov ecx, esi
call fcn.0040fe88
mov ecx, eax
call fcn.0040fe88
mov ecx, eax
call fcn.0040fe88
call fcn.004198e8
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401953
push str.Session.dat
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x14
call fcn.00401953
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x15
call fcn.0040253f
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
mov byte [ebp - 4], 0x14
je 0x40e206
call fcn.00401c0f
mov ebx, dword [ebp - 0x1c]
cmp ebx, edi
je 0x40e216
mov ecx, ebx
call fcn.0040141a
jmp 0x40e218
xor eax, eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40e361
cmp ebx, edi
je 0x40e234
mov ecx, ebx
call fcn.0040141a
jmp 0x40e236
xor eax, eax
push edi
push eax
lea ecx, [ebp - 0x44]
call fcn.004262fd
push 0x28
lea eax, [ebp + 0x1bf4]
push edi
push eax
mov byte [ebp - 4], 0x16
call fcn.00439d20
push 0x28
lea eax, [ebp + 0x1c24]
push edi
push eax
call fcn.00439d20
push 0x28
lea eax, [ebp + 0x1c58]
push edi
push eax
call fcn.00439d20
add esp, 0x24
lea ecx, [ebp - 0x18]
call fcn.00421944
push 0x26
lea eax, [ebp + 0x1bf4]
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x18
call fcn.00425aab
cmp byte [ebp + 0x1bf4], 0x7b
jne 0x40e301
push 0x26
lea eax, [ebp + 0x1c24]
push eax
lea ecx, [ebp - 0x44]
call fcn.00425aab
cmp byte [ebp + 0x1c24], 0x7b
jne 0x40e301
push 0x26
lea eax, [ebp + 0x1c58]
push eax
lea ecx, [ebp - 0x44]
call fcn.00425aab
cmp byte [ebp + 0x1c58], 0x7b
jne 0x40e301
lea eax, [ebp + 0x1c58]
push eax
mov ecx, 0x470668
call fcn.00402468
lea eax, [ebp + 0x1c24]
push eax
mov ecx, 0x47066c
call fcn.00402468
lea eax, [ebp + 0x1bf4]
push eax
mov ecx, 0x470670
call fcn.00402468
push str.SessionId__obtained_from_file_:
mov ecx, esi
call fcn.0040fe88
lea ecx, [ebp + 0x1bf4]
push ecx
mov ecx, eax
call fcn.0040fe88
lea ecx, [ebp + 0x1c24]
push ecx
mov ecx, eax
call fcn.0040fe88
lea ecx, [ebp + 0x1c58]
push ecx
mov ecx, eax
call fcn.0040fe88
push 0x456b48
mov ecx, eax
call fcn.0040fe88
mov dword [ebp - 4], 0x17
mov byte [ebp - 4], 0x16
call fcn.0042195a
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x14
call fcn.00425e71
xor edi, edi
push 0x456bd2
lea ecx, [ebp - 0x14]
call fcn.00401906
mov esi, 0x470668
push eax
mov ecx, esi
call fcn.00401a07
mov ecx, dword [ebp - 0x14]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
cmp ecx, edi
je 0x40e38f
call fcn.00401c0f
test bl, bl
je 0x40e56e
push 0x17
push edi
push str.HPeSupport.HPStamper2
lea ecx, [ebp - 0x28]
call fcn.004091ca
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.HPSU
mov byte [ebp - 4], 0x1a
call fcn.00401953
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1b
call fcn.004017cf
mov ecx, eax
mov byte [ebp - 4], 0x1a
call fcn.00408e3b
cmp dword [ebp - 0x24], edi
mov byte [ebp - 4], 0x1c
je 0x40e46f
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x1d
call fcn.004017cf
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.00408d81
push eax
mov ecx, esi
call fcn.0040243e
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x40e410
call fcn.00401c0f
lea ecx, [ebp - 0x24]
call fcn.004017cf
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.00408dfd
push eax
mov ecx, 0x47066c
call fcn.0040243e
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x40e43a
call fcn.00401c0f
lea ecx, [ebp - 0x24]
call fcn.004017cf
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.00408dbf
push eax
mov ecx, 0x470670
call fcn.0040243e
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x40e468
call fcn.00401c0f
and dword [ebp - 0x14], 0
mov dword [ebp - 4], 0x1c
mov ecx, dword [0x470668]
test ecx, ecx
je 0x40e4ef
call fcn.0040141a
mov edi, eax
jmp 0x40e4f1
xor edi, edi
mov ecx, dword [0x47066c]
test ecx, ecx
je 0x40e504
call fcn.0040141a
mov esi, eax
jmp 0x40e506
xor esi, esi
mov ecx, dword [0x470670]
test ecx, ecx
je 0x40e517
call fcn.0040141a
jmp 0x40e519
xor eax, eax
push 0x456b48
push edi
push esi
push eax
push str.SessionId__obtained_from_stamper_:
mov ecx, 0x470688
call fcn.0040fe88
mov ecx, eax
call fcn.0040fe88
mov ecx, eax
call fcn.0040fe88
mov ecx, eax
call fcn.0040fe88
mov ecx, eax
call fcn.0040fe88
mov eax, dword [ebp - 0x24]
test eax, eax
mov byte [ebp - 4], 0x1a
je 0x40e55d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x28]
test eax, eax
mov byte [ebp - 4], 0x14
je 0x40e56e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
mov byte [0x470666], 1
je 0x40e581
call fcn.00401c0f
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x40e58d
call fcn.00401c0f
lea ecx, [ebp - 0x20]
call fcn.0040390d
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.0040da97
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x40e5ad
call fcn.00401c0f
mov eax, dword [ebp - 0x2c]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x40e5be
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1c84]
xor ecx, ebp
call fcn.00438e3d
add ebp, 0x1c88
leave
ret