Function at 0x40fd20
Capabilities:
Check if file exists
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d707
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1cc4
call fcn.0042dca0
mov eax, dword [0x4655d4]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x17
xor edi, edi
push edi
push str.HPInternetUtil.InetService
lea ecx, [ebp - 0x1cac]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1cac], edi
call fcn.00402eb0
cmp eax, edi
jge 0x40fd7d
cmp eax, 0x80004002
je 0x40fd7d
push eax
call fcn.0043c1c0
mov eax, dword [ebp - 0x1cac]
cmp eax, edi
mov dword [ebp - 4], edi
jne 0x40fd9a
push 0x80004003
call fcn.0043c1c0
mov eax, dword [ebp - 0x1cac]
mov ecx, dword [eax]
lea edx, [ebp - 0x1ca8]
push edx
push eax
mov esi, eax
mov dword [ebp - 0x1ca8], edi
call dword [ecx + 0x34]
cmp eax, edi
jge 0x40fdbf
push 0x4508b0
push esi
push eax
call fcn.0043c1d0
cmp dword [ebp - 0x1ca8], edi
jne 0x40fde5
mov eax, dword [ebp - 0x1cac]
cmp eax, edi
mov dword [ebp - 4], 0xffffffff
je 0x40fdde
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor al, al
jmp 0x410837
call fcn.0040af70
push eax
lea ecx, [ebp - 0x1cc4]
call fcn.004018a0
mov eax, dword [ebp - 0x1cc4]
cmp eax, edi
push ecx
mov ecx, esp
mov dword [ebp - 0x1ca8], esp
mov dword [ecx], eax
je 0x40fe15
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [ebp - 0x1cac], edi
mov byte [ebp - 4], 2
jne 0x40fe2b
push 0x80004003
call fcn.0043c1c0
mov ecx, dword [ebp - 0x1cac]
lea edx, [ebp - 0x1ca0]
push edx
mov byte [ebp - 4], 1
call fcn.0040aee0
mov esi, eax
cmp esi, 0x4666bc
je 0x40fe76
mov ecx, dword [0x4666bc]
cmp ecx, edi
je 0x40fe60
call fcn.00401c50
mov dword [0x4666bc], edi
mov esi, dword [esi]
cmp esi, edi
mov dword [0x4666bc], esi
je 0x40fe76
add esi, 8
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [ebp - 0x1ca0]
cmp ecx, edi
je 0x40fe85
call fcn.00401c50
push str.HPSUService.asmx
lea ecx, [ebp - 0x1ca8]
call fcn.00401810
lea eax, [ebp - 0x1ca8]
push eax
mov ecx, 0x4666bc
mov byte [ebp - 4], 3
call fcn.00402820
mov ecx, dword [ebp - 0x1ca8]
cmp ecx, edi
mov byte [ebp - 4], 1
je 0x40febd
call fcn.00401c50
push edi
lea ecx, [ebp - 0x1c9c]
call fcn.0040f970
mov eax, dword [0x4666bc]
cmp eax, edi
mov byte [ebp - 4], 4
je 0x40feee
mov ecx, dword [eax + 4]
cmp ecx, edi
lea esi, [eax + 4]
jne 0x40feea
mov ecx, dword [eax]
push ecx
call fcn.0043c3a0
mov dword [esi], eax
mov esi, dword [esi]
jmp 0x40fef0
xor esi, esi
push esi
lea ecx, [ebp - 0x1c9c]
call fcn.0040a3e0
mov eax, dword [0x4666bc]
cmp eax, edi
je 0x40ff1d
mov ecx, dword [eax + 4]
cmp ecx, edi
lea esi, [eax + 4]
jne 0x40ff19
mov edx, dword [eax]
push edx
call fcn.0043c3a0
mov dword [esi], eax
mov eax, dword [esi]
jmp 0x40ff1f
xor eax, eax
push 0x450a18
push eax
push str.Metric_service_is_pointing_to
mov ecx, 0x4666c8
call fcn.00413660
mov ecx, eax
call fcn.00413660
mov ecx, eax
call fcn.00413660
xor edi, edi
mov dword [ebp - 0x1cb4], edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x1ca8]
push eax
push 0x2001f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 5
mov dword [ebp - 0x1ca8], edi
call ebx
cmp eax, edi
jne 0x40ffbd
mov esi, dword [ebp - 0x1ca8]
mov edi, esi
push 0x4666a9
lea ecx, [ebp - 0x1c9c]
mov dword [ebp - 0x1cb4], edi
call fcn.00409c00
mov al, byte [0x4666a9]
test al, al
je 0x40ffaa
push str.HP_Software_Update
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test esi, esi
je 0x40ffbd
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x1cb4], edi
call fcn.004222d0
push eax
lea ecx, [ebp - 0x1ca8]
call fcn.004018a0
push str.TestMode.txt
lea ecx, [ebp - 0x1ca4]
mov byte [ebp - 4], 6
call fcn.004018a0
lea ecx, [ebp - 0x1ca4]
push ecx
lea ecx, [ebp - 0x1ca8]
mov byte [ebp - 4], 7
call fcn.00402820
mov ecx, dword [ebp - 0x1ca4]
test ecx, ecx
mov byte [ebp - 4], 6
je 0x41000b
call fcn.00401c50
mov esi, dword [ebp - 0x1ca8]
test esi, esi
je 0x41002c
mov eax, dword [esi + 4]
test eax, eax
jne 0x410027
mov edx, dword [esi]
push edx
call fcn.0043c3a0
mov dword [esi + 4], eax
mov esi, dword [esi + 4]
jmp 0x41002e
xor esi, esi
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x410040
mov byte [0x4666a8], 1
push str.HPSU
mov ecx, 0x4666b8
call fcn.00402770
lea eax, [ebp - 0x1ca4]
push eax
push 0x20019
push 0
push str.SoftwareHewlett_PackardHP_Software_Update
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1ca4], 0
call ebx
test eax, eax
jne 0x410202
test edi, edi
je 0x410086
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov esi, dword [ebp - 0x1ca4]
mov dword [ebp - 0x1cb4], esi
jne 0x410202
mov ecx, 0xc
lea edi, [ebp - 0x70]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x1ca0]
push ecx
lea edx, [ebp - 0x70]
push edx
push str.version
lea ecx, [ebp - 0x1cb4]
mov dword [ebp - 0x1ca0], 0x32
stosw word es:[edi], ax
call fcn.004042c0
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x1ca0]
call fcn.00401810
mov bl, 8
push 0x453654
lea ecx, [ebp - 0x1ca4]
mov byte [ebp - 4], bl
call fcn.004018a0
lea ecx, [ebp - 0x1ca4]
push ecx
mov ecx, 0x4666b8
mov byte [ebp - 4], 9
call fcn.00402820
mov ecx, dword [ebp - 0x1ca4]
test ecx, ecx
mov byte [ebp - 4], bl
je 0x410116
call fcn.00401c50
lea edx, [ebp - 0x1ca0]
push edx
mov ecx, 0x4666b8
call fcn.00402820
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1ca4]
push eax
lea ecx, [ebp - 0x1cb0]
push ecx
lea edx, [ebp - 0x1cc0]
push edx
xor ebx, ebx
push ebx
push str.Ndays
push esi
mov dword [ebp - 0x1cb0], ebx
mov dword [ebp - 0x1cb8], ebx
mov dword [ebp - 0x1ca4], 4
call edi
lea eax, [ebp - 0x1ca4]
push eax
lea ecx, [ebp - 0x1cb8]
push ecx
lea edx, [ebp - 0x1cc0]
push edx
push ebx
push str.Notify
push esi
mov dword [ebp - 0x1ca4], 4
call edi
mov eax, dword [ebp - 0x1cb8]
mov ecx, dword [ebp - 0x1cb0]
push eax
push ecx
lea edx, [ebp - 0xa4]
push str.__nDays_d__Notify_d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x1ca4]
call fcn.00401810
push eax
mov ecx, 0x4666b8
mov byte [ebp - 4], 0xa
call fcn.00402820
mov ecx, dword [ebp - 0x1ca4]
cmp ecx, ebx
je 0x4101de
call fcn.00401c50
cmp esi, ebx
je 0x4101ef
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1cb4], ebx
mov ecx, dword [ebp - 0x1ca0]
cmp ecx, ebx
mov byte [ebp - 4], 6
je 0x410202
call fcn.00401c50
mov eax, dword [ebp - 0x1cac]
test eax, eax
jne 0x41021c
push 0x80004003
call fcn.0043c1c0
mov eax, dword [ebp - 0x1cac]
mov ecx, dword [eax]
lea edx, [ebp - 0x1ca0]
push edx
push eax
mov esi, eax
mov dword [ebp - 0x1ca0], 0
call dword [ecx + 0x30]
test eax, eax
jge 0x410245
push 0x4508b0
push esi
push eax
call fcn.0043c1d0
cmp dword [ebp - 0x1ca0], 0x1b58
lea ecx, [ebp - 0x1ca0]
jle 0x41026e
push str._broadband
call fcn.004018a0
lea eax, [ebp - 0x1ca0]
mov byte [ebp - 4], 0xb
push eax
jmp 0x410283
push str._modem
call fcn.004018a0
lea ecx, [ebp - 0x1ca0]
mov byte [ebp - 4], 0xc
push ecx
mov ecx, 0x4666b8
call fcn.00402820
mov ecx, dword [ebp - 0x1ca0]
test ecx, ecx
mov byte [ebp - 4], 6
je 0x4102a0
call fcn.00401c50
mov al, byte [0x4666a8]
test al, al
je 0x4102e1
push str._testmode
lea ecx, [ebp - 0x1ca0]
call fcn.004018a0
lea edx, [ebp - 0x1ca0]
push edx
mov ecx, 0x4666b8
mov byte [ebp - 4], 0xd
call fcn.00402820
mov ecx, dword [ebp - 0x1ca0]
test ecx, ecx
mov byte [ebp - 4], 6
je 0x4102e1
call fcn.00401c50
mov eax, dword [0x4666b8]
test eax, eax
je 0x410302
mov ecx, dword [eax + 4]
test ecx, ecx
lea esi, [eax + 4]
jne 0x4102fe
mov eax, dword [eax]
push eax
call fcn.0043c3a0
mov dword [esi], eax
mov esi, dword [esi]
jmp 0x410304
xor esi, esi
push 0x4535ec
push esi
push str.Browserstring:
mov ecx, 0x4666c8
call fcn.00413660
mov ecx, eax
call fcn.00413660
mov ecx, eax
call fcn.00413660
call fcn.004222d0
push eax
lea ecx, [ebp - 0x1ca4]
call fcn.004018a0
push str.Session.dat
lea ecx, [ebp - 0x1ca0]
mov byte [ebp - 4], 0xe
call fcn.004018a0
lea ecx, [ebp - 0x1ca0]
push ecx
lea ecx, [ebp - 0x1ca4]
mov byte [ebp - 4], 0xf
call fcn.00402820
mov ecx, dword [ebp - 0x1ca0]
test ecx, ecx
mov byte [ebp - 4], 0xe
je 0x410375
call fcn.00401c50
mov esi, dword [ebp - 0x1ca4]
test esi, esi
je 0x410396
mov eax, dword [esi + 4]
test eax, eax
jne 0x410391
mov edx, dword [esi]
push edx
call fcn.0043c3a0
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
jmp 0x410398
xor eax, eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41052d
test esi, esi
je 0x4103c2
mov eax, dword [esi + 4]
test eax, eax
jne 0x4103bd
mov eax, dword [esi]
push eax
call fcn.0043c3a0
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
jmp 0x4103c4
xor eax, eax
push 0
push eax
lea ecx, [ebp - 0x1cd4]
call fcn.004433d4
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
xor edx, edx
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x1cbc]
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x44], eax
call fcn.00441d18
push 0x26
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x1cd4]
mov byte [ebp - 4], 0x12
call fcn.00442cbc
mov al, byte [ebp - 0x3c]
mov bl, 0x7b
cmp al, bl
jne 0x4104d3
push 0x26
lea edx, [ebp - 0x9c]
push edx
lea ecx, [ebp - 0x1cd4]
call fcn.00442cbc
cmp byte [ebp - 0x9c], bl
jne 0x4104d3
push 0x26
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x1cd4]
call fcn.00442cbc
cmp byte [ebp - 0x68], bl
jne 0x4104d3
lea ecx, [ebp - 0x68]
push ecx
mov ecx, 0x4666ac
call fcn.004026d0
lea edx, [ebp - 0x9c]
push edx
mov ecx, 0x4666b0
call fcn.004026d0
lea eax, [ebp - 0x3c]
push eax
mov ecx, 0x4666b4
call fcn.004026d0
push str.SessionId__obtained_from_file_:
mov ecx, 0x4666c8
call fcn.00413660
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, eax
call fcn.00413660
lea edx, [ebp - 0x9c]
push edx
mov ecx, eax
call fcn.00413660
lea ecx, [ebp - 0x68]
push ecx
mov ecx, eax
call fcn.00413660
push 0x450a18
mov ecx, eax
call fcn.00413660
mov dword [ebp - 4], 0x10
call fcn.00441d2e
lea ecx, [ebp - 0x1cd4]
mov byte [ebp - 4], 0xe
call fcn.00442fe8
push 0x450aa2
lea ecx, [ebp - 0x1ca0]
call fcn.00401810
push eax
mov ecx, 0x4666ac
call fcn.00401bf0
mov ecx, dword [ebp - 0x1ca0]
test ecx, ecx
mov bl, al
je 0x410559
call fcn.00401c50
test bl, bl
je 0x4107ca
push 0x17
push 0
push str.HPeSupport.HPStamper2
lea ecx, [ebp - 0x1cb8]
mov dword [ebp - 0x1cb8], 0
call fcn.0040a4c0
test eax, eax
jge 0x410590
cmp eax, 0x80004002
je 0x410590
push eax
call fcn.0043c1c0
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x1cc0], esp
push str.HPSU
mov byte [ebp - 4], 0x14
call fcn.004018a0
mov eax, dword [ebp - 0x1cb8]
test eax, eax
mov byte [ebp - 4], 0x15
jne 0x4105c1
push 0x80004003
call fcn.0043c1c0
lea ecx, [ebp - 0x1cb0]
push ecx
mov ecx, dword [ebp - 0x1cb8]
mov byte [ebp - 4], 0x14
call fcn.0040ae50
mov ecx, dword [ebp - 0x1cb0]
test ecx, ecx
je 0x410699
lea edx, [ebp - 0x1ca0]
push edx
mov byte [ebp - 4], 0x17
call fcn.0040ad60
push eax
mov ecx, 0x4666ac
call fcn.00402690
mov ecx, dword [ebp - 0x1ca0]
test ecx, ecx
je 0x41060f
call fcn.00401c50
mov eax, dword [ebp - 0x1cb0]
test eax, eax
jne 0x410623
push 0x80004003
call fcn.0043c1c0
mov ecx, dword [ebp - 0x1cb0]
lea eax, [ebp - 0x1ca0]
push eax
call fcn.0040ae00
push eax
mov ecx, 0x4666b0
call fcn.00402690
mov ecx, dword [ebp - 0x1ca0]
test ecx, ecx
je 0x41064f
call fcn.00401c50
mov eax, dword [ebp - 0x1cb0]
test eax, eax
jne 0x410663
push 0x80004003
call fcn.0043c1c0
lea ecx, [ebp - 0x1ca0]
push ecx
mov ecx, dword [ebp - 0x1cb0]
call fcn.0040adb0
push eax
mov ecx, 0x4666b4
call fcn.00402690
mov ecx, dword [ebp - 0x1ca0]
test ecx, ecx
je 0x410699
call fcn.00401c50
mov dword [ebp - 0x1ca0], 0
mov eax, dword [0x4666ac]
test eax, eax
mov dword [ebp - 4], 0x16
je 0x410727
mov ecx, dword [eax + 4]
test ecx, ecx
lea esi, [eax + 4]
jne 0x4106bd
mov edx, dword [eax]
push edx
call fcn.0043c3a0
mov dword [esi], eax
mov ebx, dword [esi]
jmp 0x410729
xor ebx, ebx
mov eax, dword [0x4666b0]
test eax, eax
je 0x41074a
mov ecx, dword [eax + 4]
test ecx, ecx
lea esi, [eax + 4]
jne 0x410746
mov eax, dword [eax]
push eax
call fcn.0043c3a0
mov dword [esi], eax
mov edi, dword [esi]
jmp 0x41074c
xor edi, edi
mov eax, dword [0x4666b4]
test eax, eax
je 0x41076d
mov ecx, dword [eax + 4]
test ecx, ecx
lea esi, [eax + 4]
jne 0x410769
mov ecx, dword [eax]
push ecx
call fcn.0043c3a0
mov dword [esi], eax
mov eax, dword [esi]
jmp 0x41076f
xor eax, eax
push 0x450a18
push ebx
push edi
push eax
push str.SessionId__obtained_from_stamper_:
mov ecx, 0x4666c8
call fcn.00413660
mov ecx, eax
call fcn.00413660
mov ecx, eax
call fcn.00413660
mov ecx, eax
call fcn.00413660
mov ecx, eax
call fcn.00413660
mov eax, dword [ebp - 0x1cb0]
test eax, eax
mov byte [ebp - 4], 0x14
je 0x4107b6
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [ebp - 0x1cb8]
test eax, eax
mov byte [ebp - 4], 0xe
je 0x4107ca
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x1ca4]
test ecx, ecx
mov byte [0x4666aa], 1
je 0x4107e0
call fcn.00401c50
mov ecx, dword [ebp - 0x1ca8]
test ecx, ecx
je 0x4107ef
call fcn.00401c50
mov eax, dword [ebp - 0x1cb4]
test eax, eax
je 0x410800
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1c9c]
mov byte [ebp - 4], 1
call fcn.0040fba0
mov ecx, dword [ebp - 0x1cc4]
test ecx, ecx
je 0x41081e
call fcn.00401c50
mov eax, dword [ebp - 0x1cac]
test eax, eax
mov dword [ebp - 4], 0xffffffff
je 0x410835
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0042d2b8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret