Function at 0x140005460
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x78]
sub rsp, 0x150
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400420e0]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov r15, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140005514
lea rdx, str._gdssnp
call fcn.14001bcc0
test rax, rax
je 0x140005514
lea r8, [rsp + 0x50]
lea rdx, str.SOFTWAREHewlett_PackardHP_SSNP
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140005514
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.SSNPDisableAll
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x20], 7
xor r14d, r14d
mov qword [rbp - 0x28], r14
mov word [rbp - 0x38], r14w
lea r8d, [r14 + 9]
lea rdx, str._gcomname
lea rcx, [rbp - 0x38]
call fcn.14000c2e0
nop
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdx, qword [rbp - 0x38]
mov rcx, qword [r15 + 0x20]
call fcn.14001bcc0
test rax, rax
je 0x14000569e
mov rcx, qword [rbp - 0x28]
lea rdx, [rax + rcx*2]
cmp word [rdx], 0x22
jne 0x14000569e
add rdx, 2
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], r14
mov word [rbp - 0x60], r14w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp - 0x60]
call fcn.14000c2e0
nop
lea edx, [r14 + 0x22]
lea rcx, [rbp - 0x60]
call fcn.14000bd20
cmp rax, 0xffffffffffffffff
je 0x1400055c4
or r8, 0xffffffffffffffff
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.14000bc80
cmp qword [rbp - 0x50], 0
je 0x140005646
lea rcx, [rbp + 0x18]
call fcn.140017280
nop
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x18]
call fcn.1400174a0
nop
lea rax, vtable.SNMPGlobalCommunityName.0
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x38], 8
jb 0x14000562c
mov rax, qword [rbp + 0x20]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14000562c
mov rdi, qword [0x140045d10]
test rdi, rdi
jne 0x140005623
call fcn.140019630
mov rdi, rax
mov qword [0x140045d10], rax
test rax, rax
je 0x140005633
xor edx, edx
lea rcx, [rsp + 0x68]
call rdi
mov rdi, qword [0x140045d10]
mov qword [rbp + 0x38], 7
mov qword [rbp + 0x30], r14
mov word [rbp + 0x20], r14w
jmp 0x14000564d
mov rdi, qword [0x140045d10]
cmp qword [rbp - 0x48], 8
jb 0x14000568b
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000568b
test rdi, rdi
jne 0x14000567b
call fcn.140019630
mov rdi, rax
mov qword [0x140045d10], rax
test rax, rax
je 0x14000568b
xor edx, edx
lea rcx, [rsp + 0x60]
call rdi
mov rdi, qword [0x140045d10]
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], r14
mov word [rbp - 0x60], r14w
jmp 0x1400056a5
mov rdi, qword [0x140045d10]
mov qword [rsp + 0x30], r14
cmp qword [r15 + 0x20], 0
je 0x140005f93
lea r8, [rsp + 0x30]
lea rdx, [0x1400370f0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140005f8c
or edi, 0xffffffff
lea rdx, str._snptm
mov rcx, qword [r15 + 0x20]
call fcn.14001bcc0
test rax, rax
je 0x1400056f9
lea rcx, [rax + 0xe]
call fcn.14001ba04
mov edi, eax
mov dword [rsp + 0x50], edi
cmp edi, 0xffffffff
je 0x14000572f
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.SNPTriggerMarketing
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str._policy
mov rcx, qword [r15 + 0x20]
call fcn.14001bcc0
test rax, rax
je 0x14000583f
lea rdx, str._policy
mov rcx, qword [r15 + 0x20]
call fcn.14001bcc0
mov rdx, rax
cmp word [rax + 0xe], 0x22
jne 0x14000583f
add rdx, 0x10
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r14
mov word [rsp + 0x78], r14w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x78]
call fcn.14000c2e0
nop
mov edx, 0x22
lea rcx, [rsp + 0x78]
call fcn.14000bd20
cmp rax, 0xffffffffffffffff
je 0x1400057c0
or r8, 0xffffffffffffffff
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14000bc80
cmp qword [rbp - 0x78], 0
je 0x140005803
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
mov eax, dword [rbp - 0x78]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Policy
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
cmp qword [rbp - 0x70], 8
jb 0x14000583f
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000583f
mov rax, qword [0x140045d10]
test rax, rax
jne 0x140005836
call fcn.140019630
mov qword [0x140045d10], rax
test rax, rax
je 0x14000583f
xor edx, edx
lea rcx, [rsp + 0x48]
call rax
lea rdx, str._aml
mov rcx, qword [r15 + 0x20]
call fcn.14001bcc0
test rax, rax
je 0x140005c70
lea r8, [rsp + 0x48]
lea rdx, [0x1400373f8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140005c70
mov r13, qword [r15 + 0x20]
nop dword [rax + rax]
lea rdx, str._aml
mov rcx, r13
call fcn.14001bcc0
mov r13, rax
test rax, rax
je 0x140005c65
add r13, 8
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r14
mov word [rsp + 0x78], r14w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r13
lea rcx, [rsp + 0x78]
call fcn.14000c2e0
nop
mov rbx, qword [rbp - 0x78]
mov rsi, qword [rsp + 0x78]
mov r12, qword [rbp - 0x70]
test rbx, rbx
je 0x140005c18
lea rax, [rsp + 0x78]
cmp r12, 8
cmovae rax, rsi
cmp word [rax], 0x22
jne 0x140005960
mov edi, 1
cmp rbx, rdi
jae 0x14000590d
mov rdi, rbx
test rbx, rbx
je 0x140005960
lea rax, [rsp + 0x78]
cmp r12, 8
cmovae rax, rsi
lea rcx, [rsp + 0x78]
cmovae rcx, rsi
sub rbx, rdi
lea r8, [rbx + rbx]
lea rdx, [rax + rdi*2]
call fcn.14001b6d0
mov rdx, qword [rbp - 0x78]
sub rdx, rdi
mov qword [rbp - 0x78], rdx
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rax, qword [rsp + 0x78]
mov word [rax + rdx*2], r14w
mov r12, qword [rbp - 0x70]
mov rbx, qword [rbp - 0x78]
mov rsi, qword [rsp + 0x78]
mov edx, 0x2c
lea rcx, [rsp + 0x78]
call fcn.14000bd20
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005c18
test rax, rax
je 0x140005a25
lea rcx, [rsp + 0x78]
cmp r12, 8
cmovae rcx, rsi
cmp word [rcx + rax*2 - 2], 0x22
jne 0x140005a25
dec rdi
mov r14d, 1
cmp rbx, rdi
jb 0x140005c58
mov rax, rbx
sub rax, rdi
cmp rax, r14
jae 0x1400059c3
mov r14, rax
test rax, rax
je 0x140005a22
lea rdx, [rsp + 0x78]
cmp r12, 8
cmovae rdx, rsi
lea rcx, [rsp + 0x78]
cmovae rcx, rsi
sub rbx, r14
sub rbx, rdi
lea r8, [rbx + rbx]
lea rax, [r14 + rdi]
lea rdx, [rdx + rax*2]
lea rcx, [rcx + rdi*2]
call fcn.14001b6d0
mov rdx, qword [rbp - 0x78]
sub rdx, r14
mov qword [rbp - 0x78], rdx
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rax, qword [rsp + 0x78]
xor r14d, r14d
mov word [rax + rdx*2], r14w
mov r12, qword [rbp - 0x70]
mov rsi, qword [rsp + 0x78]
jmp 0x140005a25
xor r14d, r14d
cmp rdi, 0xffffffffffffffff
je 0x140005c18
mov r9, rdi
xor r8d, r8d
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x78]
call fcn.14000be10
nop
lea r8, [rdi + 1]
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.14000bc80
lea rdx, [rsp + 0x78]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rbp - 0x70]
cmp rbx, 8
cmovae rdx, rdi
mov r8, qword [rbp - 0x78]
cmp word [rdx], 0x20
jne 0x140005ad8
mov esi, 1
cmp r8, rsi
jae 0x140005a86
mov rsi, r8
test r8, r8
je 0x140005ad8
lea rax, [rsp + 0x78]
cmp rbx, 8
cmovae rax, rdi
lea rcx, [rsp + 0x78]
cmovae rcx, rdi
sub r8, rsi
add r8, r8
lea rdx, [rax + rsi*2]
call fcn.14001b6d0
mov rdx, qword [rbp - 0x78]
sub rdx, rsi
mov qword [rbp - 0x78], rdx
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rax, qword [rsp + 0x78]
mov word [rax + rdx*2], r14w
mov rbx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x78]
mov rdi, qword [rsp + 0x78]
lea rax, [rsp + 0x78]
cmp rbx, 8
cmovae rax, rdi
cmp word [rax], 0x22
jne 0x140005b4b
mov esi, 1
cmp r8, rsi
jae 0x140005afd
mov rsi, r8
test r8, r8
je 0x140005b4b
lea rax, [rsp + 0x78]
cmp rbx, 8
cmovae rax, rdi
lea rcx, [rsp + 0x78]
cmovae rcx, rdi
sub r8, rsi
add r8, r8
lea rdx, [rax + rsi*2]
call fcn.14001b6d0
mov rdx, qword [rbp - 0x78]
sub rdx, rsi
mov qword [rbp - 0x78], rdx
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rax, qword [rsp + 0x78]
mov word [rax + rdx*2], r14w
mov rbx, qword [rbp - 0x70]
mov rdi, qword [rsp + 0x78]
mov edx, 0x22
lea rcx, [rsp + 0x78]
call fcn.14000bd20
cmp rax, 0xffffffffffffffff
je 0x140005b7a
or r8, 0xffffffffffffffff
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14000bc80
mov rbx, qword [rbp - 0x70]
mov rdi, qword [rsp + 0x78]
lea rcx, [rsp + 0x78]
cmp rbx, 8
cmovae rcx, rdi
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
mov eax, dword [rbp - 0x78]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
cmp qword [rbp + 8], 8
jb 0x140005bf5
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140005bf5
mov rax, qword [0x140045d10]
test rax, rax
jne 0x140005bec
call fcn.140019630
mov qword [0x140045d10], rax
test rax, rax
je 0x140005bfc
xor edx, edx
lea rcx, [rsp + 0x58]
call rax
mov rax, qword [0x140045d10]
mov qword [rbp + 8], 7
mov qword [rbp], r14
mov word [rbp - 0x10], r14w
mov r12, qword [rbp - 0x70]
mov rsi, qword [rsp + 0x78]
jmp 0x140005c1f
mov rax, qword [0x140045d10]
cmp r12, 8
jb 0x140005c4e
mov qword [rsp + 0x40], rsi
test rsi, rsi
je 0x140005c4e
test rax, rax
jne 0x140005c45
call fcn.140019630
mov qword [0x140045d10], rax
test rax, rax
je 0x140005c4e
xor edx, edx
lea rcx, [rsp + 0x40]
call rax
test r13, r13
je 0x140005c65
jmp 0x140005880
lea rcx, str.invalid_string_position
call fcn.14001b148
nop
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str._rml
mov rcx, qword [r15 + 0x20]
call fcn.14001bcc0
test rax, rax
je 0x140005dd3
lea rdx, str._rmlALL
mov rcx, qword [r15 + 0x20]
call fcn.14001bcc0
lea rdx, [0x1400373f8]
mov rcx, qword [rsp + 0x30]
test rax, rax
je 0x140005cb5
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x140005dd3
lea r8, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005dd3
mov rbx, qword [r15 + 0x20]
nop dword [rax]
lea rdx, str._rml_
mov rcx, rbx
call fcn.14001bcc0
mov rbx, rax
test rax, rax
je 0x140005dc8
add rbx, 0xa
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r14
mov word [rsp + 0x78], r14w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.14000c2e0
nop
mov edx, 0x22
lea rcx, [rsp + 0x78]
call fcn.14000bd20
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x78]
cmp rax, r8
je 0x140005d48
lea rbx, [rbx + rax*2]
mov rdx, rax
jmp 0x140005d4a
xor edx, edx
call fcn.14000bc80
cmp qword [rbp - 0x78], 0
je 0x140005d71
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call fcn.1400171e0
nop
cmp qword [rbp - 0x70], 8
jb 0x140005dad
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140005dad
mov rax, qword [0x140045d10]
test rax, rax
jne 0x140005da4
call fcn.140019630
mov qword [0x140045d10], rax
test rax, rax
je 0x140005dad
xor edx, edx
lea rcx, [rsp + 0x40]
call rax
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r14
mov word [rsp + 0x78], r14w
test rbx, rbx
jne 0x140005cd0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x30]
mov rcx, r15
call fcn.1400052e0
mov dword [rsp + 0x38], 1
lea rdx, [0x140037ff8]
mov rcx, qword [r15 + 0x20]
call fcn.14001bcc0
test rax, rax
je 0x140005e2a
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Restricted
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x38], r14d
lea rdx, [0x140038000]
mov rcx, qword [r15 + 0x20]
call fcn.14001bcc0
test rax, rax
je 0x140005e71
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.EnableProfiles
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str._mppqs
mov rcx, qword [r15 + 0x20]
call fcn.14001bcc0
test rax, rax
je 0x140005f81
lea rdx, str._mppqs
mov rcx, qword [r15 + 0x20]
call fcn.14001bcc0
mov rdx, rax
cmp word [rax + 0xc], 0x22
jne 0x140005f81
add rdx, 0xe
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r14
mov word [rsp + 0x78], r14w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x78]
call fcn.14000c2e0
nop
mov edx, 0x22
lea rcx, [rsp + 0x78]
call fcn.14000bd20
cmp rax, 0xffffffffffffffff
je 0x140005f02
or r8, 0xffffffffffffffff
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14000bc80
cmp qword [rbp - 0x78], 0
je 0x140005f45
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
mov eax, dword [rbp - 0x78]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.MPPQueryString
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
cmp qword [rbp - 0x70], 8
jb 0x140005f81
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140005f81
mov rax, qword [0x140045d10]
test rax, rax
jne 0x140005f78
call fcn.140019630
mov qword [0x140045d10], rax
test rax, rax
je 0x140005f81
xor edx, edx
lea rcx, [rsp + 0x40]
call rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [0x140045d10]
cmp qword [rbp - 0x20], 8
jb 0x140005fca
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140005fca
test rdi, rdi
jne 0x140005fc1
call fcn.140019630
mov rdi, rax
mov qword [0x140045d10], rax
test rax, rax
je 0x140005fca
xor edx, edx
lea rcx, [rsp + 0x40]
call rdi
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.14001b510
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret