Function at 0x140051918
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
movabs rax, 0xffffe7a3dd31c000
add rax, rcx
mov qword [rsp + 0x98], rax
xor ebx, ebx
mov r14d, ebx
xorps xmm0, xmm0
movdqu xmmword [r11 - 0x78], xmm0
mov qword [r11 - 0x68], rbx
mov dword [rsp + 0x60], ebx
lea r12, str._0_n_
mov rcx, qword [str._0_n_]
mov dil, 4
cmp rcx, r12
je 0x14005198f
test byte [rcx + 0x1c], dil
je 0x14005198f
cmp byte [rcx + 0x19], 5
jb 0x14005198f
mov edx, 0xa4
lea r8, [0x140094500]
mov rcx, qword [rcx + 0x10]
call fcn.14000459c
mov r9d, 0x20019
xor r8d, r8d
lea r13, str.SoftwareMicrosoftFaxDevices_Cache
mov rdx, r13
mov rcx, 0xffffffff80000002
call fcn.14006f790
mov r15, rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x140051a06
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [str._0_n_]
cmp rcx, r12
je 0x1400519ff
test byte [rcx + 0x1c], dil
je 0x1400519ff
cmp byte [rcx + 0x19], 3
jb 0x1400519ff
mov edx, 0xa5
mov qword [rsp + 0x20], r13
mov r9d, eax
lea r8, [0x140094500]
mov rcx, qword [rcx + 0x10]
call fcn.140051e38
nop
mov eax, ebx
jmp 0x140051d14
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov esi, eax
mov dword [rsp + 0x118], eax
test eax, eax
je 0x140051aa5
mov rcx, qword [str._0_n_]
cmp rcx, r12
je 0x140051ce8
test byte [rcx + 0x1c], dil
je 0x140051ce8
cmp byte [rcx + 0x19], 2
jb 0x140051ce8
mov edx, 0xa6
mov qword [rsp + 0x20], r13
mov r9d, eax
lea r8, [0x140094500]
mov rcx, qword [rcx + 0x10]
call fcn.140051e38
jmp 0x140051ce8
mov eax, dword [rsp + 0x100]
inc eax
mov dword [rsp + 0x100], eax
mov ecx, eax
add rcx, rcx
mov eax, 0xffffffff
cmp rcx, rax
ja 0x140051ce3
mov ecx, ecx
call fcn.14006a264
mov r14, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x140051b13
mov rcx, qword [str._0_n_]
cmp rcx, r12
je 0x140051b09
test byte [rcx + 0x1c], dil
je 0x140051b09
cmp byte [rcx + 0x19], 2
jb 0x140051b09
mov edx, 0xa7
lea r8, [0x140094500]
mov rcx, qword [rcx + 0x10]
call fcn.14000459c
mov esi, 8
jmp 0x140051ce8
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x108], eax
mov eax, ebx
mov edx, eax
inc eax
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x108]
mov r8, r14
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140051cb3
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, r15
call fcn.14006f790
mov r13, rax
mov qword [rsp + 0xa0], rax
test rax, rax
jne 0x140051bc6
mov rcx, qword [str._0_n_]
cmp rcx, r12
je 0x140051c9c
test byte [rcx + 0x1c], dil
je 0x140051c9c
cmp byte [rcx + 0x19], 3
jb 0x140051c9c
mov edx, 0xa8
mov r9, r14
lea r8, [0x140094500]
mov rcx, qword [rcx + 0x10]
call fcn.140004764
jmp 0x140051c9c
lea r8, [rsp + 0x68]
lea rdx, str.LastDetected
mov rcx, r13
call fcn.14006f400
mov r12, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140051bf9
mov rax, qword [rsp + 0x98]
cmp qword [r12], rax
jae 0x140051c7e
lea r8, [rsp + 0x110]
lea rdx, [0x1400944e0]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_swscanf]
nop dword [rax + rax]
cmp eax, 1
jne 0x140051c4a
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x80]
call fcn.1400517f0
nop
jmp 0x140051c7e
mov rcx, qword [str._0_n_]
lea rax, str._0_n_
cmp rcx, rax
je 0x140051c7e
test byte [rcx + 0x1c], dil
je 0x140051c7e
cmp byte [rcx + 0x19], 3
jb 0x140051c7e
mov edx, 0xaa
lea r8, [0x140094500]
mov rcx, qword [rcx + 0x10]
call fcn.14000459c
mov rcx, r12
call fcn.14006a328
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea r12, str._0_n_
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x108], eax
mov eax, dword [rsp + 0x64]
jmp 0x140051b23
mov rdi, qword [rsp + 0x88]
cmp qword [rsp + 0x80], rdi
je 0x140051ce1
add rdi, 0xfffffffffffffffc
mov ecx, dword [rdi]
mov dword [rsp + 0x110], ecx
call fcn.14006e91c
mov qword [rsp + 0x88], rdi
jmp 0x140051cbb
jmp 0x140051ce8
mov esi, 0x216
mov rcx, r14
call fcn.14006a328
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140051d12
call fcn.140001390
mov eax, esi
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret