Function at 0x140004460
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x78]
sub rsp, 0x150
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400410e0]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov r15, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140004514
lea rdx, str._gdssnp
call fcn.14001acc0
test rax, rax
je 0x140004514
lea r8, [rsp + 0x50]
lea rdx, str.SOFTWAREHewlett_PackardHP_SSNP
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140004514
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.SSNPDisableAll
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x20], 7
xor r14d, r14d
mov qword [rbp - 0x28], r14
mov word [rbp - 0x38], r14w
lea r8d, [r14 + 9]
lea rdx, str._gcomname
lea rcx, [rbp - 0x38]
call fcn.14000b2e0
nop
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdx, qword [rbp - 0x38]
mov rcx, qword [r15 + 0x20]
call fcn.14001acc0
test rax, rax
je 0x14000469e
mov rcx, qword [rbp - 0x28]
lea rdx, [rax + rcx*2]
cmp word [rdx], 0x22
jne 0x14000469e
add rdx, 2
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], r14
mov word [rbp - 0x60], r14w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp - 0x60]
call fcn.14000b2e0
nop
lea edx, [r14 + 0x22]
lea rcx, [rbp - 0x60]
call fcn.14000ad20
cmp rax, 0xffffffffffffffff
je 0x1400045c4
or r8, 0xffffffffffffffff
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.14000ac80
cmp qword [rbp - 0x50], 0
je 0x140004646
lea rcx, [rbp + 0x18]
call fcn.140016280
nop
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x18]
call fcn.1400164a0
nop
lea rax, vtable.SNMPGlobalCommunityName.0
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x38], 8
jb 0x14000462c
mov rax, qword [rbp + 0x20]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14000462c
mov rdi, qword [0x140044d10]
test rdi, rdi
jne 0x140004623
call fcn.140018630
mov rdi, rax
mov qword [0x140044d10], rax
test rax, rax
je 0x140004633
xor edx, edx
lea rcx, [rsp + 0x68]
call rdi
mov rdi, qword [0x140044d10]
mov qword [rbp + 0x38], 7
mov qword [rbp + 0x30], r14
mov word [rbp + 0x20], r14w
jmp 0x14000464d
mov rdi, qword [0x140044d10]
cmp qword [rbp - 0x48], 8
jb 0x14000468b
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000468b
test rdi, rdi
jne 0x14000467b
call fcn.140018630
mov rdi, rax
mov qword [0x140044d10], rax
test rax, rax
je 0x14000468b
xor edx, edx
lea rcx, [rsp + 0x60]
call rdi
mov rdi, qword [0x140044d10]
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], r14
mov word [rbp - 0x60], r14w
jmp 0x1400046a5
mov rdi, qword [0x140044d10]
mov qword [rsp + 0x30], r14
cmp qword [r15 + 0x20], 0
je 0x140004f93
lea r8, [rsp + 0x30]
lea rdx, [0x1400360f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140004f8c
or edi, 0xffffffff
lea rdx, str._snptm
mov rcx, qword [r15 + 0x20]
call fcn.14001acc0
test rax, rax
je 0x1400046f9
lea rcx, [rax + 0xe]
call fcn.14001aa04
mov edi, eax
mov dword [rsp + 0x50], edi
cmp edi, 0xffffffff
je 0x14000472f
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.SNPTriggerMarketing
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str._policy
mov rcx, qword [r15 + 0x20]
call fcn.14001acc0
test rax, rax
je 0x14000483f
lea rdx, str._policy
mov rcx, qword [r15 + 0x20]
call fcn.14001acc0
mov rdx, rax
cmp word [rax + 0xe], 0x22
jne 0x14000483f
add rdx, 0x10
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r14
mov word [rsp + 0x78], r14w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x78]
call fcn.14000b2e0
nop
mov edx, 0x22
lea rcx, [rsp + 0x78]
call fcn.14000ad20
cmp rax, 0xffffffffffffffff
je 0x1400047c0
or r8, 0xffffffffffffffff
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14000ac80
cmp qword [rbp - 0x78], 0
je 0x140004803
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
mov eax, dword [rbp - 0x78]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Policy
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
cmp qword [rbp - 0x70], 8
jb 0x14000483f
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000483f
mov rax, qword [0x140044d10]
test rax, rax
jne 0x140004836
call fcn.140018630
mov qword [0x140044d10], rax
test rax, rax
je 0x14000483f
xor edx, edx
lea rcx, [rsp + 0x48]
call rax
lea rdx, str._aml
mov rcx, qword [r15 + 0x20]
call fcn.14001acc0
test rax, rax
je 0x140004c70
lea r8, [rsp + 0x48]
lea rdx, [0x1400363f8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140004c70
mov r13, qword [r15 + 0x20]
nop dword [rax + rax]
lea rdx, str._aml
mov rcx, r13
call fcn.14001acc0
mov r13, rax
test rax, rax
je 0x140004c65
add r13, 8
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r14
mov word [rsp + 0x78], r14w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r13
lea rcx, [rsp + 0x78]
call fcn.14000b2e0
nop
mov rbx, qword [rbp - 0x78]
mov rsi, qword [rsp + 0x78]
mov r12, qword [rbp - 0x70]
test rbx, rbx
je 0x140004c18
lea rax, [rsp + 0x78]
cmp r12, 8
cmovae rax, rsi
cmp word [rax], 0x22
jne 0x140004960
mov edi, 1
cmp rbx, rdi
jae 0x14000490d
mov rdi, rbx
test rbx, rbx
je 0x140004960
lea rax, [rsp + 0x78]
cmp r12, 8
cmovae rax, rsi
lea rcx, [rsp + 0x78]
cmovae rcx, rsi
sub rbx, rdi
lea r8, [rbx + rbx]
lea rdx, [rax + rdi*2]
call fcn.14001a6d0
mov rdx, qword [rbp - 0x78]
sub rdx, rdi
mov qword [rbp - 0x78], rdx
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rax, qword [rsp + 0x78]
mov word [rax + rdx*2], r14w
mov r12, qword [rbp - 0x70]
mov rbx, qword [rbp - 0x78]
mov rsi, qword [rsp + 0x78]
mov edx, 0x2c
lea rcx, [rsp + 0x78]
call fcn.14000ad20
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140004c18
test rax, rax
je 0x140004a25
lea rcx, [rsp + 0x78]
cmp r12, 8
cmovae rcx, rsi
cmp word [rcx + rax*2 - 2], 0x22
jne 0x140004a25
dec rdi
mov r14d, 1
cmp rbx, rdi
jb 0x140004c58
mov rax, rbx
sub rax, rdi
cmp rax, r14
jae 0x1400049c3
mov r14, rax
test rax, rax
je 0x140004a22
lea rdx, [rsp + 0x78]
cmp r12, 8
cmovae rdx, rsi
lea rcx, [rsp + 0x78]
cmovae rcx, rsi
sub rbx, r14
sub rbx, rdi
lea r8, [rbx + rbx]
lea rax, [r14 + rdi]
lea rdx, [rdx + rax*2]
lea rcx, [rcx + rdi*2]
call fcn.14001a6d0
mov rdx, qword [rbp - 0x78]
sub rdx, r14
mov qword [rbp - 0x78], rdx
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rax, qword [rsp + 0x78]
xor r14d, r14d
mov word [rax + rdx*2], r14w
mov r12, qword [rbp - 0x70]
mov rsi, qword [rsp + 0x78]
jmp 0x140004a25
xor r14d, r14d
cmp rdi, 0xffffffffffffffff
je 0x140004c18
mov r9, rdi
xor r8d, r8d
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x78]
call fcn.14000ae10
nop
lea r8, [rdi + 1]
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.14000ac80
lea rdx, [rsp + 0x78]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rbp - 0x70]
cmp rbx, 8
cmovae rdx, rdi
mov r8, qword [rbp - 0x78]
cmp word [rdx], 0x20
jne 0x140004ad8
mov esi, 1
cmp r8, rsi
jae 0x140004a86
mov rsi, r8
test r8, r8
je 0x140004ad8
lea rax, [rsp + 0x78]
cmp rbx, 8
cmovae rax, rdi
lea rcx, [rsp + 0x78]
cmovae rcx, rdi
sub r8, rsi
add r8, r8
lea rdx, [rax + rsi*2]
call fcn.14001a6d0
mov rdx, qword [rbp - 0x78]
sub rdx, rsi
mov qword [rbp - 0x78], rdx
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rax, qword [rsp + 0x78]
mov word [rax + rdx*2], r14w
mov rbx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x78]
mov rdi, qword [rsp + 0x78]
lea rax, [rsp + 0x78]
cmp rbx, 8
cmovae rax, rdi
cmp word [rax], 0x22
jne 0x140004b4b
mov esi, 1
cmp r8, rsi
jae 0x140004afd
mov rsi, r8
test r8, r8
je 0x140004b4b
lea rax, [rsp + 0x78]
cmp rbx, 8
cmovae rax, rdi
lea rcx, [rsp + 0x78]
cmovae rcx, rdi
sub r8, rsi
add r8, r8
lea rdx, [rax + rsi*2]
call fcn.14001a6d0
mov rdx, qword [rbp - 0x78]
sub rdx, rsi
mov qword [rbp - 0x78], rdx
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rax, qword [rsp + 0x78]
mov word [rax + rdx*2], r14w
mov rbx, qword [rbp - 0x70]
mov rdi, qword [rsp + 0x78]
mov edx, 0x22
lea rcx, [rsp + 0x78]
call fcn.14000ad20
cmp rax, 0xffffffffffffffff
je 0x140004b7a
or r8, 0xffffffffffffffff
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14000ac80
mov rbx, qword [rbp - 0x70]
mov rdi, qword [rsp + 0x78]
lea rcx, [rsp + 0x78]
cmp rbx, 8
cmovae rcx, rdi
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
mov eax, dword [rbp - 0x78]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
cmp qword [rbp + 8], 8
jb 0x140004bf5
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140004bf5
mov rax, qword [0x140044d10]
test rax, rax
jne 0x140004bec
call fcn.140018630
mov qword [0x140044d10], rax
test rax, rax
je 0x140004bfc
xor edx, edx
lea rcx, [rsp + 0x58]
call rax
mov rax, qword [0x140044d10]
mov qword [rbp + 8], 7
mov qword [rbp], r14
mov word [rbp - 0x10], r14w
mov r12, qword [rbp - 0x70]
mov rsi, qword [rsp + 0x78]
jmp 0x140004c1f
mov rax, qword [0x140044d10]
cmp r12, 8
jb 0x140004c4e
mov qword [rsp + 0x40], rsi
test rsi, rsi
je 0x140004c4e
test rax, rax
jne 0x140004c45
call fcn.140018630
mov qword [0x140044d10], rax
test rax, rax
je 0x140004c4e
xor edx, edx
lea rcx, [rsp + 0x40]
call rax
test r13, r13
je 0x140004c65
jmp 0x140004880
lea rcx, str.invalid_string_position
call fcn.14001a148
nop
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str._rml
mov rcx, qword [r15 + 0x20]
call fcn.14001acc0
test rax, rax
je 0x140004dd3
lea rdx, str._rmlALL
mov rcx, qword [r15 + 0x20]
call fcn.14001acc0
lea rdx, [0x1400363f8]
mov rcx, qword [rsp + 0x30]
test rax, rax
je 0x140004cb5
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140004dd3
lea r8, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140004dd3
mov rbx, qword [r15 + 0x20]
nop dword [rax]
lea rdx, str._rml_
mov rcx, rbx
call fcn.14001acc0
mov rbx, rax
test rax, rax
je 0x140004dc8
add rbx, 0xa
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r14
mov word [rsp + 0x78], r14w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.14000b2e0
nop
mov edx, 0x22
lea rcx, [rsp + 0x78]
call fcn.14000ad20
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x78]
cmp rax, r8
je 0x140004d48
lea rbx, [rbx + rax*2]
mov rdx, rax
jmp 0x140004d4a
xor edx, edx
call fcn.14000ac80
cmp qword [rbp - 0x78], 0
je 0x140004d71
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call fcn.1400161e0
nop
cmp qword [rbp - 0x70], 8
jb 0x140004dad
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140004dad
mov rax, qword [0x140044d10]
test rax, rax
jne 0x140004da4
call fcn.140018630
mov qword [0x140044d10], rax
test rax, rax
je 0x140004dad
xor edx, edx
lea rcx, [rsp + 0x40]
call rax
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r14
mov word [rsp + 0x78], r14w
test rbx, rbx
jne 0x140004cd0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x30]
mov rcx, r15
call fcn.1400042e0
mov dword [rsp + 0x38], 1
lea rdx, [0x140036ff8]
mov rcx, qword [r15 + 0x20]
call fcn.14001acc0
test rax, rax
je 0x140004e2a
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Restricted
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x38], r14d
lea rdx, [0x140037000]
mov rcx, qword [r15 + 0x20]
call fcn.14001acc0
test rax, rax
je 0x140004e71
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.EnableProfiles
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str._mppqs
mov rcx, qword [r15 + 0x20]
call fcn.14001acc0
test rax, rax
je 0x140004f81
lea rdx, str._mppqs
mov rcx, qword [r15 + 0x20]
call fcn.14001acc0
mov rdx, rax
cmp word [rax + 0xc], 0x22
jne 0x140004f81
add rdx, 0xe
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r14
mov word [rsp + 0x78], r14w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x78]
call fcn.14000b2e0
nop
mov edx, 0x22
lea rcx, [rsp + 0x78]
call fcn.14000ad20
cmp rax, 0xffffffffffffffff
je 0x140004f02
or r8, 0xffffffffffffffff
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14000ac80
cmp qword [rbp - 0x78], 0
je 0x140004f45
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
mov eax, dword [rbp - 0x78]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.MPPQueryString
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
cmp qword [rbp - 0x70], 8
jb 0x140004f81
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140004f81
mov rax, qword [0x140044d10]
test rax, rax
jne 0x140004f78
call fcn.140018630
mov qword [0x140044d10], rax
test rax, rax
je 0x140004f81
xor edx, edx
lea rcx, [rsp + 0x40]
call rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [0x140044d10]
cmp qword [rbp - 0x20], 8
jb 0x140004fca
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140004fca
test rdi, rdi
jne 0x140004fc1
call fcn.140018630
mov rdi, rax
mov qword [0x140044d10], rax
test rax, rax
je 0x140004fca
xor edx, edx
lea rcx, [rsp + 0x40]
call rdi
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.14001a510
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret