Function at 0x140001c90
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push r12
sub rsp, 0x688
mov rax, qword [0x1400151a0]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov rbx, rcx
mov r12, rdx
lea rcx, [rsp + 0x262]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x260], 0
call fcn.14000a2c0
lea r8, str.SOFTWAREWOW6432NodeEPSONEPSON_Scan_s
lea rcx, [rsp + 0x260]
mov r9, rbx
mov edx, 0x208
call section..text
cmp dword [r12], 0
jne 0x140001d80
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x260]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
xor ebx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001d71
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.EventNum
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
cmove ebx, dword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov dword [r12], ebx
jne 0x140001d80
xor al, al
jmp 0x14000206c
mov qword [rsp + 0x6b0], rbp
mov qword [rsp + 0x6b8], rsi
lea rsi, [r12 + 4]
mov rcx, rsi
mov qword [rsp + 0x680], rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, 0x104
lea rbp, [0x1400122bc]
test eax, eax
jne 0x140001ecf
mov r8, rbp
xor edi, edi
mov rdx, rbx
sub r8, rsi
mov rcx, rsi
nop
nop
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140001df5
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140001df5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140001dd0
jmp 0x140001dfa
test rdx, rdx
jne 0x140001dfe
sub rcx, 2
lea rax, [rsp + 0x38]
mov word [rcx], di
lea rdx, [rsp + 0x260]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002087
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.EventAppName
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x470]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001ebc
lea r8, [rsp + 0x470]
mov rdx, rbx
mov rcx, rsi
sub r8, rsi
nop
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140001ea5
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140001ea5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140001e80
jmp 0x140001eaa
test rdx, rdx
jne 0x140001eae
sub rcx, 2
mov word [rcx], di
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x140002087
lea rcx, [r12 + 0x20c]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x140002052
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], ax
call fcn.14000a2c0
lea rax, [rsp + 0x50]
xor edi, edi
mov rdx, rbx
lea rcx, [rsp + 0x50]
sub rbp, rax
nop
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140001f34
movzx eax, word [rcx + rbp]
test ax, ax
je 0x140001f34
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140001f10
jmp 0x140001f39
test rdx, rdx
jne 0x140001f3d
sub rcx, 2
lea rax, [rsp + 0x38]
mov word [rcx], di
lea rdx, [rsp + 0x260]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002087
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.EventAppPath
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x470]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001ffd
lea rdx, [rsp + 0x470]
lea rax, [rsp + 0x50]
lea rcx, [rsp + 0x50]
sub rdx, rax
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x140001fe4
movzx eax, word [rdx + rcx]
test ax, ax
je 0x140001fe4
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x140001fc0
jmp 0x140001fe9
test rbx, rbx
jne 0x140001fed
sub rcx, 2
mov word [rcx], di
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x140002087
lea rdx, [r12 + 0x20c]
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.140002090
test al, al
je 0x140002087
lea rcx, [r12 + 0x414]
lea r9, [r12 + 0x20c]
lea r8, str._s__d
mov edx, 0x208
mov qword [rsp + 0x20], 0
call section..text
mov al, 1
mov rsi, qword [rsp + 0x6b8]
mov rbp, qword [rsp + 0x6b0]
mov rdi, qword [rsp + 0x680]
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.140002be0
add rsp, 0x688
pop r12
pop rbx
ret
xor al, al
jmp 0x140002054