Function at 0x140005e80
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r13, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140005f2e
lea rdx, str._gdssnp
call fcn.140024230
test rax, rax
je 0x140005f2e
lea r8, [rbp - 0x49]
lea rdx, str.SOFTWAREHewlett_PackardHP_SSNP
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140005f2e
mov dword [rbp - 0x61], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x61]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.SSNPDisableAll
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 1], 7
xor r12d, r12d
mov qword [rbp - 9], r12
mov word [rbp - 0x19], r12w
lea r8d, [r12 + 9]
lea rdx, str._gcomname
lea rcx, [rbp - 0x19]
call fcn.14000d3f0
nop
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
mov rcx, qword [r13 + 0x20]
call fcn.140024230
or r15, 0xffffffffffffffff
test rax, rax
je 0x1400060ab
mov rcx, qword [rbp - 9]
lea rdx, [rax + rcx*2]
cmp word [rdx], 0x22
jne 0x1400060ab
add rdx, 2
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r12
mov word [rbp - 0x39], r12w
cmp word [rdx], r12w
jne 0x140005fae
mov r8d, r12d
jmp 0x140005fbc
mov r8, r15
inc r8
cmp word [rdx + r8*2], 0
jne 0x140005fb1
lea rcx, [rbp - 0x39]
call fcn.14000d3f0
nop
mov edx, 0x22
lea rcx, [rbp - 0x39]
call fcn.14000cb30
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x140006007
cmp qword [rbp - 0x29], rax
jae 0x140005ff0
lea rcx, str.invalid_string_position
call fcn.1400235ec
int3
mov qword [rbp - 0x29], rax
lea rax, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rax, qword [rbp - 0x39]
mov word [rax + rcx*2], r12w
cmp qword [rbp - 0x29], 0
je 0x14000606e
lea rcx, [rbp + 7]
call fcn.14001a9d0
nop
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.14001ac10
nop
lea rax, vtable.SNMPGlobalCommunityName.0
mov qword [rbp + 7], rax
cmp qword [rbp + 0x27], 8
jb 0x14000606e
mov rax, qword [rbp + 0xf]
mov qword [rbp - 0x59], rax
test rax, rax
je 0x14000606e
mov r8, qword [0x1400575e8]
test r8, r8
jne 0x140006065
call fcn.140021810
mov r8, rax
mov qword [0x1400575e8], rax
test rax, rax
je 0x140006075
xor edx, edx
lea rcx, [rbp - 0x59]
call r8
mov r8, qword [0x1400575e8]
cmp qword [rbp - 0x21], 8
jb 0x1400060b2
mov rax, qword [rbp - 0x39]
mov qword [rbp - 0x59], rax
test rax, rax
je 0x1400060b2
test r8, r8
jne 0x1400060a2
call fcn.140021810
mov r8, rax
mov qword [0x1400575e8], rax
test rax, rax
je 0x1400060b2
xor edx, edx
lea rcx, [rbp - 0x59]
call r8
mov r8, qword [0x1400575e8]
mov qword [rbp - 0x69], r12
cmp qword [r13 + 0x20], 0
je 0x1400069cb
lea r8, [rbp - 0x69]
lea rdx, str.SoftwareHewlett_PackardHP_Print_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1400069c4
or ebx, 0xffffffff
lea rdx, str._snptm
mov rcx, qword [r13 + 0x20]
call fcn.140024230
test rax, rax
je 0x140006104
lea rcx, [rax + 0xe]
call fcn.140023d28
mov ebx, eax
mov dword [rbp - 0x49], ebx
cmp ebx, 0xffffffff
je 0x140006137
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x140045628]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str._policy
mov rcx, qword [r13 + 0x20]
call fcn.140024230
test rax, rax
je 0x140006267
lea rdx, str._policy
mov rcx, qword [r13 + 0x20]
call fcn.140024230
cmp word [rax + 0xe], 0x22
jne 0x140006267
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r12
mov word [rbp - 0x39], r12w
cmp word [rax + 0x10], 0
jne 0x140006188
mov r8, r12
jmp 0x14000619c
mov r8, r15
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2 + 0x10], 0
jne 0x140006190
lea rdx, [rax + 0x10]
lea rcx, [rbp - 0x39]
call fcn.14000d3f0
nop
mov edx, 0x22
lea rcx, [rbp - 0x39]
call fcn.14000cb30
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x1400061eb
cmp qword [rbp - 0x29], rax
jae 0x1400061d4
lea rcx, str.invalid_string_position
call fcn.1400235ec
int3
mov qword [rbp - 0x29], rax
lea rax, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rax, qword [rbp - 0x39]
mov word [rax + rcx*2], r12w
cmp qword [rbp - 0x29], 0
je 0x14000622e
lea rcx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rcx, qword [rbp - 0x39]
mov eax, dword [rbp - 0x29]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Policy
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
cmp qword [rbp - 0x21], 8
jb 0x140006267
mov rax, qword [rbp - 0x39]
mov qword [rbp - 0x59], rax
test rax, rax
je 0x140006267
mov rax, qword [0x1400575e8]
test rax, rax
jne 0x14000625f
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x140006267
xor edx, edx
lea rcx, [rbp - 0x59]
call rax
lea rdx, str._aml
mov rcx, qword [r13 + 0x20]
call fcn.140024230
test rax, rax
je 0x14000665e
lea r8, [rbp - 0x59]
lea rdx, [0x140045a78]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000665e
mov rsi, qword [r13 + 0x20]
lea rdx, str._aml
mov rcx, rsi
call fcn.140024230
mov rsi, rax
test rax, rax
je 0x140006654
add rsi, 8
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r12
mov word [rbp - 0x39], r12w
cmp word [rsi], 0
jne 0x1400062dc
mov r8, r12
jmp 0x1400062eb
mov r8, r15
nop
inc r8
cmp word [rsi + r8*2], 0
jne 0x1400062e0
mov rdx, rsi
lea rcx, [rbp - 0x39]
call fcn.14000d3f0
nop
mov rdi, qword [rbp - 0x29]
test rdi, rdi
je 0x1400065f0
lea rax, [rbp - 0x39]
mov rdx, qword [rbp - 0x39]
mov r8, qword [rbp - 0x21]
cmp r8, 8
cmovae rax, rdx
cmp word [rax], 0x22
jne 0x140006376
cmp rdi, 1
ja 0x14000633b
mov qword [rbp - 0x29], r12
lea rax, [rbp - 0x39]
cmp r8, 8
cmovae rax, rdx
mov word [rax], r12w
jmp 0x140006372
lea rcx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rcx, qword [rbp - 0x39]
dec rdi
je 0x14000635b
lea r8, [rdi + rdi]
lea rdx, [rcx + 2]
call fcn.1400237c0
mov qword [rbp - 0x29], rdi
lea rax, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rax, qword [rbp - 0x39]
mov word [rax + rdi*2], r12w
mov rdi, qword [rbp - 0x29]
mov edx, 0x2c
lea rcx, [rbp - 0x39]
call fcn.14000cb30
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000641c
lea rcx, [rbp - 0x39]
mov rdx, qword [rbp - 0x39]
mov r8, qword [rbp - 0x21]
cmp r8, 8
cmovae rcx, rdx
cmp word [rcx + rax*2 - 2], 0x22
jne 0x14000641c
dec rbx
cmp rdi, rbx
jb 0x14000663a
mov rax, rdi
sub rax, rbx
cmp rax, 1
lea rax, [rbp - 0x39]
ja 0x1400063e0
mov qword [rbp - 0x29], rbx
cmp r8, 8
cmovae rax, rdx
mov word [rax + rbx*2], r12w
jmp 0x14000641c
cmp qword [rbp - 0x21], 8
cmovae rax, qword [rbp - 0x39]
lea rcx, [rax + rbx*2]
dec rdi
mov r8, rdi
sub r8, rbx
je 0x140006405
add r8, r8
lea rdx, [rcx + 2]
call fcn.1400237c0
mov qword [rbp - 0x29], rdi
lea rax, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rax, qword [rbp - 0x39]
mov word [rax + rdi*2], r12w
cmp rbx, 0xffffffffffffffff
je 0x1400065f0
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.14000cc20
nop
lea r8, [rbx + 1]
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000ca80
lea rax, [rbp - 0x39]
mov rbx, qword [rbp - 0x39]
mov rdi, qword [rbp - 0x21]
cmp rdi, 8
cmovae rax, rbx
cmp word [rax], 0x20
jne 0x1400064c6
mov r14, qword [rbp - 0x29]
cmp r14, 1
ja 0x140006483
mov qword [rbp - 0x29], r12
lea rax, [rbp - 0x39]
cmp rdi, 8
cmovae rax, rbx
mov word [rax], r12w
jmp 0x1400064be
lea rcx, [rbp - 0x39]
cmp rdi, 8
cmovae rcx, rbx
dec r14
je 0x1400064a9
lea r8, [r14 + r14]
lea rdx, [rcx + 2]
call fcn.1400237c0
mov rdi, qword [rbp - 0x21]
mov rbx, qword [rbp - 0x39]
mov qword [rbp - 0x29], r14
lea rax, [rbp - 0x39]
cmp rdi, 8
cmovae rax, rbx
mov word [rax + r14*2], r12w
mov rbx, qword [rbp - 0x39]
mov rdi, qword [rbp - 0x21]
lea rax, [rbp - 0x39]
cmp rdi, 8
cmovae rax, rbx
cmp word [rax], 0x22
jne 0x14000653b
mov r14, qword [rbp - 0x29]
cmp r14, 1
ja 0x1400064f8
mov qword [rbp - 0x29], r12
lea rax, [rbp - 0x39]
cmp rdi, 8
cmovae rax, rbx
mov word [rax], r12w
jmp 0x140006533
lea rcx, [rbp - 0x39]
cmp rdi, 8
cmovae rcx, rbx
dec r14
je 0x14000651e
lea r8, [r14 + r14]
lea rdx, [rcx + 2]
call fcn.1400237c0
mov rdi, qword [rbp - 0x21]
mov rbx, qword [rbp - 0x39]
mov qword [rbp - 0x29], r14
lea rax, [rbp - 0x39]
cmp rdi, 8
cmovae rax, rbx
mov word [rax + r14*2], r12w
mov rbx, qword [rbp - 0x39]
mov rdi, qword [rbp - 0x21]
mov edx, 0x22
lea rcx, [rbp - 0x39]
call fcn.14000cb30
cmp rax, 0xffffffffffffffff
je 0x140006576
cmp qword [rbp - 0x29], rax
jb 0x140006647
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x39]
cmp rdi, 8
cmovae rcx, rbx
mov word [rcx + rax*2], r12w
mov rdi, qword [rbp - 0x21]
mov rbx, qword [rbp - 0x39]
lea rcx, [rbp - 0x39]
cmp rdi, 8
cmovae rcx, rbx
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rdx, qword [rbp + 7]
mov eax, dword [rbp - 0x29]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
cmp qword [rbp + 0x1f], 8
jb 0x1400065f0
mov rax, qword [rbp + 7]
mov qword [rbp - 0x51], rax
test rax, rax
je 0x1400065f0
mov rax, qword [0x1400575e8]
test rax, rax
jne 0x1400065e8
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x1400065f7
xor edx, edx
lea rcx, [rbp - 0x51]
call rax
mov rax, qword [0x1400575e8]
cmp qword [rbp - 0x21], 8
jb 0x1400062a1
mov rdx, qword [rbp - 0x39]
mov qword [rbp - 0x51], rdx
test rdx, rdx
je 0x1400062a1
test rax, rax
jne 0x14000662d
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x1400062a1
xor edx, edx
lea rcx, [rbp - 0x51]
call rax
jmp 0x1400062a1
lea rcx, str.invalid_string_position
call fcn.1400235ec
nop
lea rcx, str.invalid_string_position
call fcn.1400235ec
nop
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str._rml
mov rcx, qword [r13 + 0x20]
call fcn.140024230
test rax, rax
je 0x1400067f7
lea rdx, str._rmlALL
mov rcx, qword [r13 + 0x20]
call fcn.140024230
lea rdx, [0x140045a78]
mov rcx, qword [rbp - 0x69]
test rax, rax
je 0x1400066a2
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1400067f7
lea r8, [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400067f7
mov rbx, qword [r13 + 0x20]
nop dword [rax + rax]
lea rdx, str._rml_
mov rcx, rbx
call fcn.140024230
mov rbx, rax
test rax, rax
je 0x1400067ed
add rbx, 0xa
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r12
mov word [rbp - 0x39], r12w
cmp word [rbx], 0
jne 0x1400066fb
mov r8, r12
jmp 0x14000670b
mov r8, r15
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x140006700
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.14000d3f0
nop
mov edx, 0x22
lea rcx, [rbp - 0x39]
call fcn.14000cb30
cmp rax, 0xffffffffffffffff
je 0x140006757
lea rbx, [rbx + rax*2]
lea rcx, [rax + rax]
cmp qword [rbp - 0x29], rax
jb 0x1400067e0
mov qword [rbp - 0x29], rax
lea rax, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rax, qword [rbp - 0x39]
mov word [rcx + rax], r12w
jmp 0x14000676d
mov qword [rbp - 0x29], r12
lea rax, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rax, qword [rbp - 0x39]
mov word [rax], r12w
cmp qword [rbp - 0x29], 0
je 0x14000678c
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rdx, qword [rbp - 0x39]
mov rcx, qword [rbp - 0x59]
call fcn.14001b5e0
nop
cmp qword [rbp - 0x21], 8
jb 0x1400067c5
mov rax, qword [rbp - 0x39]
mov qword [rbp - 0x51], rax
test rax, rax
je 0x1400067c5
mov rax, qword [0x1400575e8]
test rax, rax
jne 0x1400067bd
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x1400067c5
xor edx, edx
lea rcx, [rbp - 0x51]
call rax
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r12
mov word [rbp - 0x39], r12w
test rbx, rbx
je 0x1400067ed
jmp 0x1400066c0
lea rcx, str.invalid_string_position
call fcn.1400235ec
nop
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x69]
mov rcx, r13
call fcn.140005da0
mov dword [rbp - 0x61], 1
lea rdx, [0x140045088]
mov rcx, qword [r13 + 0x20]
call fcn.140024230
test rax, rax
je 0x14000684a
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x61]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Restricted
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp - 0x61], r12d
lea rdx, [0x140045090]
mov rcx, qword [r13 + 0x20]
call fcn.140024230
test rax, rax
je 0x14000688e
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x61]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.EnableProfiles
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str._mppqs
mov rcx, qword [r13 + 0x20]
call fcn.140024230
test rax, rax
je 0x1400069ba
lea rdx, str._mppqs
mov rcx, qword [r13 + 0x20]
call fcn.140024230
cmp word [rax + 0xc], 0x22
jne 0x1400069ba
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r12
mov word [rbp - 0x39], r12w
cmp word [rax + 0xe], 0
jne 0x1400068e0
mov r15, r12
jmp 0x1400068ec
inc r15
cmp word [rax + r15*2 + 0xe], 0
jne 0x1400068e0
mov r8, r15
lea rdx, [rax + 0xe]
lea rcx, [rbp - 0x39]
call fcn.14000d3f0
nop
mov edx, 0x22
lea rcx, [rbp - 0x39]
call fcn.14000cb30
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x14000693e
cmp qword [rbp - 0x29], rax
jae 0x140006927
lea rcx, str.invalid_string_position
call fcn.1400235ec
int3
mov qword [rbp - 0x29], rax
lea rax, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rax, qword [rbp - 0x39]
mov word [rax + rcx*2], r12w
cmp qword [rbp - 0x29], 0
je 0x140006981
lea rcx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rcx, qword [rbp - 0x39]
mov eax, dword [rbp - 0x29]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.MPPQueryString
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
cmp qword [rbp - 0x21], 8
jb 0x1400069ba
mov rax, qword [rbp - 0x39]
mov qword [rbp - 0x51], rax
test rax, rax
je 0x1400069ba
mov rax, qword [0x1400575e8]
test rax, rax
jne 0x1400069b2
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x1400069ba
xor edx, edx
lea rcx, [rbp - 0x51]
call rax
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, qword [0x1400575e8]
cmp qword [rbp - 1], 8
jb 0x140006a01
mov rax, qword [rbp - 0x19]
mov qword [rbp - 0x51], rax
test rax, rax
je 0x140006a01
test r8, r8
jne 0x1400069f8
call fcn.140021810
mov r8, rax
mov qword [0x1400575e8], rax
test rax, rax
je 0x140006a01
xor edx, edx
lea rcx, [rbp - 0x51]
call r8
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140023790
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret