Function at 0x140051330
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
movabs rax, 0xffffe7a3dd31c000
add rax, rcx
mov qword [rsp + 0x98], rax
xor ebx, ebx
mov r14d, ebx
xorps xmm0, xmm0
movdqu xmmword [r11 - 0x78], xmm0
mov qword [r11 - 0x68], rbx
mov dword [rsp + 0x60], ebx
lea r12, [0x14009b020]
mov rcx, qword [0x14009b020]
mov dil, 4
cmp rcx, r12
je 0x1400513a7
test byte [rcx + 0x1c], dil
je 0x1400513a7
cmp byte [rcx + 0x19], 5
jb 0x1400513a7
mov edx, 0xa4
lea r8, [0x14008d2c0]
mov rcx, qword [rcx + 0x10]
call fcn.1400042fc
mov r9d, 0x20019
xor r8d, r8d
lea r13, str.SoftwareMicrosoftFaxDevices_Cache
mov rdx, r13
mov rcx, 0xffffffff80000002
call fcn.14006ec14
mov r15, rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x14005141e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x14009b020]
cmp rcx, r12
je 0x140051417
test byte [rcx + 0x1c], dil
je 0x140051417
cmp byte [rcx + 0x19], 3
jb 0x140051417
mov edx, 0xa5
mov qword [rsp + 0x20], r13
mov r9d, eax
lea r8, [0x14008d2c0]
mov rcx, qword [rcx + 0x10]
call fcn.140051850
nop
mov eax, ebx
jmp 0x14005172c
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov esi, eax
mov dword [rsp + 0x118], eax
test eax, eax
je 0x1400514bd
mov rcx, qword [0x14009b020]
cmp rcx, r12
je 0x140051700
test byte [rcx + 0x1c], dil
je 0x140051700
cmp byte [rcx + 0x19], 2
jb 0x140051700
mov edx, 0xa6
mov qword [rsp + 0x20], r13
mov r9d, eax
lea r8, [0x14008d2c0]
mov rcx, qword [rcx + 0x10]
call fcn.140051850
jmp 0x140051700
mov eax, dword [rsp + 0x100]
inc eax
mov dword [rsp + 0x100], eax
mov ecx, eax
add rcx, rcx
mov eax, 0xffffffff
cmp rcx, rax
ja 0x1400516fb
mov ecx, ecx
call fcn.140069c6c
mov r14, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x14005152b
mov rcx, qword [0x14009b020]
cmp rcx, r12
je 0x140051521
test byte [rcx + 0x1c], dil
je 0x140051521
cmp byte [rcx + 0x19], 2
jb 0x140051521
mov edx, 0xa7
lea r8, [0x14008d2c0]
mov rcx, qword [rcx + 0x10]
call fcn.1400042fc
mov esi, 8
jmp 0x140051700
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x108], eax
mov eax, ebx
mov edx, eax
inc eax
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x108]
mov r8, r14
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400516cb
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, r15
call fcn.14006ec14
mov r13, rax
mov qword [rsp + 0xa0], rax
test rax, rax
jne 0x1400515de
mov rcx, qword [0x14009b020]
cmp rcx, r12
je 0x1400516b4
test byte [rcx + 0x1c], dil
je 0x1400516b4
cmp byte [rcx + 0x19], 3
jb 0x1400516b4
mov edx, 0xa8
mov r9, r14
lea r8, [0x14008d2c0]
mov rcx, qword [rcx + 0x10]
call fcn.1400044cc
jmp 0x1400516b4
lea r8, [rsp + 0x68]
lea rdx, str.LastDetected
mov rcx, r13
call fcn.14006e884
mov r12, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140051611
mov rax, qword [rsp + 0x98]
cmp qword [r12], rax
jae 0x140051696
lea r8, [rsp + 0x110]
lea rdx, [0x14008d2a0]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_swscanf]
nop dword [rax + rax]
cmp eax, 1
jne 0x140051662
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x80]
call fcn.1400511f4
nop
jmp 0x140051696
mov rcx, qword [0x14009b020]
lea rax, [0x14009b020]
cmp rcx, rax
je 0x140051696
test byte [rcx + 0x1c], dil
je 0x140051696
cmp byte [rcx + 0x19], 3
jb 0x140051696
mov edx, 0xaa
lea r8, [0x14008d2c0]
mov rcx, qword [rcx + 0x10]
call fcn.1400042fc
mov rcx, r12
call fcn.140069d30
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea r12, [0x14009b020]
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x108], eax
mov eax, dword [rsp + 0x64]
jmp 0x14005153b
mov rdi, qword [rsp + 0x88]
cmp qword [rsp + 0x80], rdi
je 0x1400516f9
add rdi, 0xfffffffffffffffc
mov ecx, dword [rdi]
mov dword [rsp + 0x110], ecx
call fcn.14006dda0
mov qword [rsp + 0x88], rdi
jmp 0x1400516d3
jmp 0x140051700
mov esi, 0x216
mov rcx, r14
call fcn.140069d30
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14005172a
call fcn.140001180
mov eax, esi
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret