Function at 0x14000fec0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x128]
sub rsp, 0x200
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov rbx, rcx
xor r15d, r15d
mov dword [rsp + 0x58], r15d
mov sil, 1
mov qword [rbp - 0x40], 7
mov qword [rbp - 0x48], r15
mov word [rbp - 0x58], r15w
lea r8d, [r15 + 0x2a]
lea rdx, str.SoftwareHewlett_PackardHP_Print_Settings
lea rcx, [rbp - 0x58]
call fcn.14000d3f0
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], 2
mov byte [rsp + 0x70], r15b
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rdx, qword [rbp - 0x58]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x6c], eax
test eax, eax
jne 0x14000ff9c
cmp dword [rsp + 0x78], 1
jne 0x14000ffa1
mov byte [rsp + 0x70], sil
jmp 0x14000ffa1
mov qword [rsp + 0x60], r15
cmp qword [rbp - 0x40], 8
jb 0x14000ffde
mov rax, qword [rbp - 0x58]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000ffde
cmp qword [0x1400575e8], 0
jne 0x14000ffd1
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x14000ffde
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [0x1400575e8]
mov qword [rbp - 0x40], 7
mov qword [rbp - 0x48], r15
mov word [rbp - 0x58], r15w
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r15
mov word [rbp - 0x78], r15w
lea r14, [rbx + 0x20]
lea rbx, [0x140054fb0]
mov rdx, rbx
mov rcx, r14
call fcn.140013680
mov rcx, qword [r14]
mov edi, 1
or r12, 0xffffffffffffffff
cmp rax, rcx
je 0x1400100ae
lea r8, [rax + 0x20]
mov r10, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x14001003d
mov r8, qword [r8]
cmp qword [0x140054fc8], 8
cmovae rbx, qword [0x140054fb0]
mov r9, r10
mov r11, qword [0x140054fc0]
cmp r11, r10
cmovb r9, r11
test r9, r9
jmp 0x140010085
movzx edx, word [r8]
cmp word [rbx], dx
jne 0x140010079
add rbx, 2
add r8, 2
dec r9
jmp 0x140010085
mov r9d, edi
cmp word [rbx], dx
cmovb r9d, r12d
jmp 0x14001008a
jne 0x140010063
mov r9d, r15d
movsxd rdx, r9d
test r9d, r9d
jne 0x1400100a5
cmp r11, r10
jae 0x14001009c
mov edx, r12d
jmp 0x1400100a5
mov edx, r15d
cmp r11, r10
setne dl
test edx, edx
mov qword [rsp + 0x50], rax
jns 0x1400100b3
mov qword [rsp + 0x50], rcx
lea rax, [rsp + 0x50]
mov rax, qword [rax]
cmp rax, rcx
je 0x14001011c
lea rdx, [rax + 0x40]
lea rax, [rbp - 0x78]
cmp rax, rdx
je 0x1400100dc
mov r9, r12
xor r8d, r8d
lea rcx, [rbp - 0x78]
call fcn.14000c8e0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140010119
mov dword [rsp + 0x28], 0x12
lea rax, str.19728374
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, str.UPDMPA
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x6c], eax
test eax, eax
sete sil
jmp 0x14001011c
xor sil, sil
lea rbx, [0x140054f50]
mov rdx, rbx
mov rcx, r14
call fcn.140013680
mov rcx, qword [r14]
cmp rax, rcx
je 0x1400101bd
lea r8, [rax + 0x20]
mov r10, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x14001014c
mov r8, qword [r8]
cmp qword [0x140054f68], 8
cmovae rbx, qword [0x140054f50]
mov r9, r10
mov r11, qword [0x140054f60]
cmp r11, r10
cmovb r9, r11
test r9, r9
jmp 0x140010194
movzx edx, word [r8]
cmp word [rbx], dx
jne 0x140010188
add rbx, 2
add r8, 2
dec r9
jmp 0x140010194
mov r9d, edi
cmp word [rbx], dx
cmovb r9d, r12d
jmp 0x140010199
jne 0x140010172
mov r9d, r15d
movsxd rdx, r9d
test r9d, r9d
jne 0x1400101b4
cmp r11, r10
jae 0x1400101ab
mov edx, r12d
jmp 0x1400101b4
mov edx, r15d
cmp r11, r10
setne dl
test edx, edx
mov qword [rsp + 0x50], rax
jns 0x1400101c2
mov qword [rsp + 0x50], rcx
lea rax, [rsp + 0x50]
mov rax, qword [rax]
cmp rax, rcx
je 0x1400102d4
lea rdx, [rax + 0x40]
lea rax, [rbp - 0x78]
cmp rax, rdx
je 0x1400101ef
mov r9, r12
xor r8d, r8d
lea rcx, [rbp - 0x78]
call fcn.14000c8e0
cmp qword [rbp - 0x68], 0
je 0x1400102d4
mov qword [rbp - 0x20], 7
mov qword [rbp - 0x28], r15
mov word [rbp - 0x38], r15w
mov r8d, 6
lea rdx, str.Policy
lea rcx, [rbp - 0x38]
call fcn.14000d3f0
lea r8, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae r8, qword [rbp - 0x78]
lea rdx, [rbp - 0x38]
mov rax, qword [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdx, rax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140010298
mov rax, r12
nop dword [rax]
lea rax, [rax + 1]
cmp word [r8 + rax*2], 0
jne 0x140010250
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
mov r9d, edi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x6c], eax
test eax, eax
sete al
test al, al
je 0x140010294
test sil, sil
je 0x140010294
movzx esi, dil
mov rax, qword [rbp - 0x38]
jmp 0x14001029b
mov rax, qword [rbp - 0x38]
xor sil, sil
cmp qword [rbp - 0x20], 8
jb 0x1400102d4
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400102d4
cmp qword [0x1400575e8], 0
jne 0x1400102c7
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x1400102d4
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [0x1400575e8]
lea rbx, [0x140054f70]
mov rdx, rbx
mov rcx, r14
call fcn.140013680
mov rcx, qword [r14]
cmp rax, rcx
je 0x140010374
lea r8, [rax + 0x20]
mov r10, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x140010304
mov r8, qword [r8]
cmp qword [0x140054f88], 8
cmovae rbx, qword [0x140054f70]
mov r9, r10
mov r11, qword [0x140054f80]
cmp r11, r10
cmovb r9, r11
test r9, r9
jmp 0x14001034c
movzx edx, word [r8]
cmp word [rbx], dx
jne 0x140010346
add rbx, 2
add r8, 2
dec r9
jmp 0x14001034c
cmovb edi, r12d
jmp 0x140010351
jne 0x140010330
mov edi, r15d
movsxd rdx, edi
test edi, edi
jne 0x14001036b
cmp r11, r10
jae 0x140010362
mov edx, r12d
jmp 0x14001036b
mov edx, r15d
cmp r11, r10
setne dl
test edx, edx
mov qword [rsp + 0x50], rax
jns 0x140010379
mov qword [rsp + 0x50], rcx
lea rax, [rsp + 0x50]
mov rax, qword [rax]
cmp rax, rcx
je 0x1400103fe
lea rdx, [rax + 0x40]
lea rax, [rbp - 0x78]
cmp rax, rdx
je 0x1400103a2
mov r9, r12
xor r8d, r8d
lea rcx, [rbp - 0x78]
call fcn.14000c8e0
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x140010403
mov dword [rsp + 0x58], 0x100
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.UPDMPA
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400103ea
cmp eax, 0xea
jne 0x1400103fa
lea rdx, str.UPDMPA
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x6c], eax
mov rbx, qword [rsp + 0x60]
cmp qword [rbp - 0x60], 8
jb 0x140010445
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140010445
cmp qword [0x1400575e8], 0
jne 0x140010433
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x140010440
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [0x1400575e8]
mov rbx, qword [rsp + 0x60]
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r15
mov word [rbp - 0x78], r15w
test rbx, rbx
je 0x140010464
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, sil
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140023790
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret