Function at 0x40fd80
Capabilities:
Check if file exists
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ce12
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1cc8
call fcn.0042d3a0
mov eax, dword [0x46453c]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x17
xor ebx, ebx
push ebx
push str.HPInternetUtil.InetService
lea ecx, [ebp - 0x1cb0]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1cb0], ebx
call fcn.00402ec0
cmp eax, ebx
jge 0x40fddd
cmp eax, 0x80004002
je 0x40fddd
push eax
call fcn.0043b8c0
mov eax, dword [ebp - 0x1cb0]
cmp eax, ebx
mov dword [ebp - 4], ebx
jne 0x40fdfa
push 0x80004003
call fcn.0043b8c0
mov eax, dword [ebp - 0x1cb0]
mov ecx, dword [eax]
lea edx, [ebp - 0x1ca8]
push edx
push eax
mov esi, eax
mov dword [ebp - 0x1ca8], ebx
call dword [ecx + 0x34]
cmp eax, ebx
jge 0x40fe1f
push 0x44f8d0
push esi
push eax
call fcn.0043b8d0
cmp dword [ebp - 0x1ca8], ebx
jne 0x40fe45
mov eax, dword [ebp - 0x1cb0]
cmp eax, ebx
mov dword [ebp - 4], 0xffffffff
je 0x40fe3e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor al, al
jmp 0x4108bd
call fcn.0040afe0
push eax
lea ecx, [ebp - 0x1cc4]
call fcn.004018b0
mov eax, dword [ebp - 0x1cc4]
cmp eax, ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1cc8], esp
mov dword [ecx], eax
je 0x40fe75
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [ebp - 0x1cb0], ebx
mov byte [ebp - 4], 2
jne 0x40fe8b
push 0x80004003
call fcn.0043b8c0
mov ecx, dword [ebp - 0x1cb0]
lea edx, [ebp - 0x1ca0]
push edx
mov byte [ebp - 4], 1
call fcn.0040af50
mov esi, eax
cmp esi, 0x4655fc
je 0x40fed6
mov ecx, dword [0x4655fc]
cmp ecx, ebx
je 0x40fec0
call fcn.00401c60
mov dword [0x4655fc], ebx
mov esi, dword [esi]
cmp esi, ebx
mov dword [0x4655fc], esi
je 0x40fed6
add esi, 8
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [ebp - 0x1ca0]
cmp ecx, ebx
je 0x40fee5
call fcn.00401c60
push str.HPSUService.asmx
lea ecx, [ebp - 0x1ca8]
call fcn.00401820
lea eax, [ebp - 0x1ca8]
push eax
mov ecx, 0x4655fc
mov byte [ebp - 4], 3
call fcn.00402830
mov ecx, dword [ebp - 0x1ca8]
cmp ecx, ebx
mov byte [ebp - 4], 1
je 0x40ff1d
call fcn.00401c60
push ebx
lea ecx, [ebp - 0x1c9c]
call fcn.0040f9e0
mov eax, dword [0x4655fc]
cmp eax, ebx
mov byte [ebp - 4], 4
je 0x40ff4e
mov ecx, dword [eax + 4]
cmp ecx, ebx
lea esi, [eax + 4]
jne 0x40ff4a
mov ecx, dword [eax]
push ecx
call fcn.0043baa0
mov dword [esi], eax
mov esi, dword [esi]
jmp 0x40ff50
xor esi, esi
push esi
lea ecx, [ebp - 0x1c9c]
call fcn.0040a450
mov eax, dword [0x4655fc]
cmp eax, ebx
je 0x40ff7d
mov ecx, dword [eax + 4]
cmp ecx, ebx
lea esi, [eax + 4]
jne 0x40ff79
mov edx, dword [eax]
push edx
call fcn.0043baa0
mov dword [esi], eax
mov eax, dword [esi]
jmp 0x40ff7f
xor eax, eax
push 0x44fa38
push eax
push str.Metric_service_is_pointing_to
mov ecx, 0x465608
call fcn.004136f0
mov ecx, eax
call fcn.004136f0
mov ecx, eax
call fcn.004136f0
xor edi, edi
mov dword [ebp - 0x1cb4], edi
lea eax, [ebp - 0x1ca8]
push eax
push 0x2001f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 5
mov dword [ebp - 0x1ca8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x41001b
mov esi, dword [ebp - 0x1ca8]
mov edi, esi
push 0x4655e9
lea ecx, [ebp - 0x1c9c]
mov dword [ebp - 0x1cb4], edi
call fcn.00409c70
mov al, byte [0x4655e9]
test al, al
je 0x410008
push str.HP_Software_Update
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp esi, ebx
je 0x41001b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x1cb4], edi
call fcn.00422340
push eax
lea ecx, [ebp - 0x1ca8]
call fcn.004018b0
mov bl, 6
push str.TestMode.txt
lea ecx, [ebp - 0x1ca4]
mov byte [ebp - 4], bl
call fcn.004018b0
lea ecx, [ebp - 0x1ca4]
push ecx
lea ecx, [ebp - 0x1ca8]
mov byte [ebp - 4], 7
call fcn.00402830
mov ecx, dword [ebp - 0x1ca4]
test ecx, ecx
mov byte [ebp - 4], bl
je 0x410069
call fcn.00401c60
mov esi, dword [ebp - 0x1ca8]
test esi, esi
je 0x41008a
mov eax, dword [esi + 4]
test eax, eax
jne 0x410085
mov edx, dword [esi]
push edx
call fcn.0043baa0
mov dword [esi + 4], eax
mov esi, dword [esi + 4]
jmp 0x41008c
xor esi, esi
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41009e
mov byte [0x4655e8], 1
call fcn.00422450
push eax
lea ecx, [ebp - 0x1cc8]
call fcn.004018b0
push str.HPSU
mov ecx, 0x4655f8
mov byte [ebp - 4], 8
call fcn.00402780
lea eax, [ebp - 0x1ca4]
push eax
push 0x20019
push 0
push str.SoftwareHewlett_PackardHP_Software_Update
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1ca4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x410279
test edi, edi
je 0x4100fd
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov esi, dword [ebp - 0x1ca4]
mov dword [ebp - 0x1cb4], esi
jne 0x410279
mov ecx, 0xc
lea edi, [ebp - 0x70]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x1ca0]
push ecx
lea edx, [ebp - 0x70]
push edx
push str.version
lea ecx, [ebp - 0x1cb4]
mov dword [ebp - 0x1ca0], 0x32
stosw word es:[edi], ax
call fcn.004042f0
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x1ca0]
call fcn.00401820
mov bl, 9
push 0x45267c
lea ecx, [ebp - 0x1ca4]
mov byte [ebp - 4], bl
call fcn.004018b0
lea ecx, [ebp - 0x1ca4]
push ecx
mov ecx, 0x4655f8
mov byte [ebp - 4], 0xa
call fcn.00402830
mov ecx, dword [ebp - 0x1ca4]
test ecx, ecx
mov byte [ebp - 4], bl
je 0x41018d
call fcn.00401c60
lea edx, [ebp - 0x1ca0]
push edx
mov ecx, 0x4655f8
call fcn.00402830
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1ca4]
push eax
lea ecx, [ebp - 0x1cac]
push ecx
lea edx, [ebp - 0x1cc0]
push edx
xor ebx, ebx
push ebx
push str.Ndays
push esi
mov dword [ebp - 0x1cac], ebx
mov dword [ebp - 0x1cb8], ebx
mov dword [ebp - 0x1ca4], 4
call edi
lea eax, [ebp - 0x1ca4]
push eax
lea ecx, [ebp - 0x1cb8]
push ecx
lea edx, [ebp - 0x1cc0]
push edx
push ebx
push str.Notify
push esi
mov dword [ebp - 0x1ca4], 4
call edi
mov eax, dword [ebp - 0x1cb8]
mov ecx, dword [ebp - 0x1cac]
push eax
push ecx
lea edx, [ebp - 0xa4]
push str.__nDays_d__Notify_d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x1ca4]
call fcn.00401820
push eax
mov ecx, 0x4655f8
mov byte [ebp - 4], 0xb
call fcn.00402830
mov ecx, dword [ebp - 0x1ca4]
cmp ecx, ebx
je 0x410255
call fcn.00401c60
cmp esi, ebx
je 0x410266
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1cb4], ebx
mov ecx, dword [ebp - 0x1ca0]
cmp ecx, ebx
mov byte [ebp - 4], 8
je 0x410279
call fcn.00401c60
mov eax, dword [ebp - 0x1cb0]
test eax, eax
jne 0x410293
push 0x80004003
call fcn.0043b8c0
mov eax, dword [ebp - 0x1cb0]
mov ecx, dword [eax]
lea edx, [ebp - 0x1ca0]
push edx
push eax
mov esi, eax
mov dword [ebp - 0x1ca0], 0
call dword [ecx + 0x30]
test eax, eax
jge 0x4102bc
push 0x44f8d0
push esi
push eax
call fcn.0043b8d0
cmp dword [ebp - 0x1ca0], 0x1b58
lea ecx, [ebp - 0x1ca0]
jle 0x4102e5
push str._broadband
call fcn.004018b0
lea eax, [ebp - 0x1ca0]
mov byte [ebp - 4], 0xc
push eax
jmp 0x4102fa
push str._modem
call fcn.004018b0
lea ecx, [ebp - 0x1ca0]
mov byte [ebp - 4], 0xd
push ecx
mov ecx, 0x4655f8
call fcn.00402830
mov ecx, dword [ebp - 0x1ca0]
test ecx, ecx
mov byte [ebp - 4], 8
je 0x410317
call fcn.00401c60
mov al, byte [0x4655e8]
test al, al
je 0x410358
push str._testmode
lea ecx, [ebp - 0x1ca0]
call fcn.004018b0
lea edx, [ebp - 0x1ca0]
push edx
mov ecx, 0x4655f8
mov byte [ebp - 4], 0xe
call fcn.00402830
mov ecx, dword [ebp - 0x1ca0]
test ecx, ecx
mov byte [ebp - 4], 8
je 0x410358
call fcn.00401c60
mov eax, dword [0x4655f8]
test eax, eax
je 0x410379
mov ecx, dword [eax + 4]
test ecx, ecx
lea esi, [eax + 4]
jne 0x410375
mov eax, dword [eax]
push eax
call fcn.0043baa0
mov dword [esi], eax
mov esi, dword [esi]
jmp 0x41037b
xor esi, esi
push 0x452614
push esi
push str.Browserstring:
mov ecx, 0x465608
call fcn.004136f0
mov ecx, eax
call fcn.004136f0
mov ecx, eax
call fcn.004136f0
call fcn.00422340
push eax
lea ecx, [ebp - 0x1ca4]
call fcn.004018b0
push str.Session.dat
lea ecx, [ebp - 0x1ca0]
mov byte [ebp - 4], 0xf
call fcn.004018b0
lea ecx, [ebp - 0x1ca0]
push ecx
lea ecx, [ebp - 0x1ca4]
mov byte [ebp - 4], 0x10
call fcn.00402830
mov ecx, dword [ebp - 0x1ca0]
test ecx, ecx
mov byte [ebp - 4], 0xf
je 0x4103ec
call fcn.00401c60
mov esi, dword [ebp - 0x1ca4]
test esi, esi
je 0x41040d
mov eax, dword [esi + 4]
test eax, eax
jne 0x410408
mov edx, dword [esi]
push edx
call fcn.0043baa0
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
jmp 0x41040f
xor eax, eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4105a4
test esi, esi
je 0x410439
mov eax, dword [esi + 4]
test eax, eax
jne 0x410434
mov eax, dword [esi]
push eax
call fcn.0043baa0
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
jmp 0x41043b
xor eax, eax
push 0
push eax
lea ecx, [ebp - 0x1cd8]
call fcn.00442ad4
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
xor edx, edx
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x1cbc]
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x44], eax
call fcn.00441418
push 0x26
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x1cd8]
mov byte [ebp - 4], 0x13
call fcn.004423bc
mov al, byte [ebp - 0x3c]
mov bl, 0x7b
cmp al, bl
jne 0x41054a
push 0x26
lea edx, [ebp - 0x9c]
push edx
lea ecx, [ebp - 0x1cd8]
call fcn.004423bc
cmp byte [ebp - 0x9c], bl
jne 0x41054a
push 0x26
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x1cd8]
call fcn.004423bc
cmp byte [ebp - 0x68], bl
jne 0x41054a
lea ecx, [ebp - 0x68]
push ecx
mov ecx, 0x4655ec
call fcn.004026e0
lea edx, [ebp - 0x9c]
push edx
mov ecx, 0x4655f0
call fcn.004026e0
lea eax, [ebp - 0x3c]
push eax
mov ecx, 0x4655f4
call fcn.004026e0
push str.SessionId__obtained_from_file_:
mov ecx, 0x465608
call fcn.004136f0
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, eax
call fcn.004136f0
lea edx, [ebp - 0x9c]
push edx
mov ecx, eax
call fcn.004136f0
lea ecx, [ebp - 0x68]
push ecx
mov ecx, eax
call fcn.004136f0
push 0x44fa38
mov ecx, eax
call fcn.004136f0
mov dword [ebp - 4], 0x11
call fcn.0044142e
lea ecx, [ebp - 0x1cd8]
mov byte [ebp - 4], 0xf
call fcn.004426e8
push 0x44fac2
lea ecx, [ebp - 0x1ca0]
call fcn.00401820
push eax
mov ecx, 0x4655ec
call fcn.00401c00
mov ecx, dword [ebp - 0x1ca0]
test ecx, ecx
mov bl, al
je 0x4105d0
call fcn.00401c60
test bl, bl
je 0x410841
push 0x17
push 0
push str.HPeSupport.HPStamper2
lea ecx, [ebp - 0x1cb8]
mov dword [ebp - 0x1cb8], 0
call fcn.0040a530
test eax, eax
jge 0x410607
cmp eax, 0x80004002
je 0x410607
push eax
call fcn.0043b8c0
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x1cc0], esp
push str.HPSU
mov byte [ebp - 4], 0x15
call fcn.004018b0
mov eax, dword [ebp - 0x1cb8]
test eax, eax
mov byte [ebp - 4], 0x16
jne 0x410638
push 0x80004003
call fcn.0043b8c0
lea ecx, [ebp - 0x1cac]
push ecx
mov ecx, dword [ebp - 0x1cb8]
mov byte [ebp - 4], 0x15
call fcn.0040aec0
mov ecx, dword [ebp - 0x1cac]
test ecx, ecx
je 0x410710
lea edx, [ebp - 0x1ca0]
push edx
mov byte [ebp - 4], 0x18
call fcn.0040add0
push eax
mov ecx, 0x4655ec
call fcn.004026a0
mov ecx, dword [ebp - 0x1ca0]
test ecx, ecx
je 0x410686
call fcn.00401c60
mov eax, dword [ebp - 0x1cac]
test eax, eax
jne 0x41069a
push 0x80004003
call fcn.0043b8c0
mov ecx, dword [ebp - 0x1cac]
lea eax, [ebp - 0x1ca0]
push eax
call fcn.0040ae70
push eax
mov ecx, 0x4655f0
call fcn.004026a0
mov ecx, dword [ebp - 0x1ca0]
test ecx, ecx
je 0x4106c6
call fcn.00401c60
mov eax, dword [ebp - 0x1cac]
test eax, eax
jne 0x4106da
push 0x80004003
call fcn.0043b8c0
lea ecx, [ebp - 0x1ca0]
push ecx
mov ecx, dword [ebp - 0x1cac]
call fcn.0040ae20
push eax
mov ecx, 0x4655f4
call fcn.004026a0
mov ecx, dword [ebp - 0x1ca0]
test ecx, ecx
je 0x410710
call fcn.00401c60
mov dword [ebp - 0x1ca0], 0
mov eax, dword [0x4655ec]
test eax, eax
mov dword [ebp - 4], 0x17
je 0x41079e
mov ecx, dword [eax + 4]
test ecx, ecx
lea esi, [eax + 4]
jne 0x410734
mov edx, dword [eax]
push edx
call fcn.0043baa0
mov dword [esi], eax
mov ebx, dword [esi]
jmp 0x4107a0
xor ebx, ebx
mov eax, dword [0x4655f0]
test eax, eax
je 0x4107c1
mov ecx, dword [eax + 4]
test ecx, ecx
lea esi, [eax + 4]
jne 0x4107bd
mov eax, dword [eax]
push eax
call fcn.0043baa0
mov dword [esi], eax
mov edi, dword [esi]
jmp 0x4107c3
xor edi, edi
mov eax, dword [0x4655f4]
test eax, eax
je 0x4107e4
mov ecx, dword [eax + 4]
test ecx, ecx
lea esi, [eax + 4]
jne 0x4107e0
mov ecx, dword [eax]
push ecx
call fcn.0043baa0
mov dword [esi], eax
mov eax, dword [esi]
jmp 0x4107e6
xor eax, eax
push 0x44fa38
push ebx
push edi
push eax
push str.SessionId__obtained_from_stamper_:
mov ecx, 0x465608
call fcn.004136f0
mov ecx, eax
call fcn.004136f0
mov ecx, eax
call fcn.004136f0
mov ecx, eax
call fcn.004136f0
mov ecx, eax
call fcn.004136f0
mov eax, dword [ebp - 0x1cac]
test eax, eax
mov byte [ebp - 4], 0x15
je 0x41082d
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [ebp - 0x1cb8]
test eax, eax
mov byte [ebp - 4], 0xf
je 0x410841
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x1ca4]
test ecx, ecx
mov byte [0x4655ea], 1
je 0x410857
call fcn.00401c60
mov ecx, dword [ebp - 0x1cc8]
test ecx, ecx
je 0x410866
call fcn.00401c60
mov ecx, dword [ebp - 0x1ca8]
test ecx, ecx
je 0x410875
call fcn.00401c60
mov eax, dword [ebp - 0x1cb4]
test eax, eax
je 0x410886
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1c9c]
mov byte [ebp - 4], 1
call fcn.0040fc00
mov ecx, dword [ebp - 0x1cc4]
test ecx, ecx
je 0x4108a4
call fcn.00401c60
mov eax, dword [ebp - 0x1cb0]
test eax, eax
mov dword [ebp - 4], 0xffffffff
je 0x4108bb
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0042c9b6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret