Function at 0x14004b564
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [r11 - 0x58], 0xfffffffffffffffe
movabs rax, 0xffffe7a3dd31c000
add rax, rcx
mov qword [rsp + 0x68], rax
xor ebx, ebx
mov r15d, ebx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [r11 - 0x80], rbx
mov dword [rsp + 0x60], ebx
lea r14, str.___t_
mov rcx, qword [str.___t_]
cmp rcx, r14
je 0x14004b5dd
test byte [rcx + 0x1c], 4
je 0x14004b5dd
cmp byte [rcx + 0x19], 5
jb 0x14004b5dd
mov edx, 0xa4
lea r8, [0x140083c00]
mov rcx, qword [rcx + 0x10]
call fcn.140001010
mov r9d, 0x20019
xor r8d, r8d
lea rdi, str.SoftwareMicrosoftFaxDevices_Cache
mov rdx, rdi
mov rcx, 0xffffffff80000002
call fcn.140065ce8
mov r13, rax
mov qword [rsp + 0xa0], rax
test rax, rax
jne 0x14004b651
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.___t_]
cmp rcx, r14
je 0x14004b64a
test byte [rcx + 0x1c], 4
je 0x14004b64a
cmp byte [rcx + 0x19], 3
jb 0x14004b64a
mov edx, 0xa5
mov qword [rsp + 0x20], rdi
mov r9d, eax
lea r8, [0x140083c00]
mov rcx, qword [rcx + 0x10]
call fcn.140001064
nop
mov eax, ebx
jmp 0x14004b917
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x110]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
mov dword [rsp + 0x128], eax
test eax, eax
je 0x14004b6ea
mov rcx, qword [str.___t_]
cmp rcx, r14
je 0x14004b8f1
test byte [rcx + 0x1c], 4
je 0x14004b8f1
cmp byte [rcx + 0x19], 2
jb 0x14004b8f1
mov edx, 0xa6
mov qword [rsp + 0x20], rdi
mov r9d, eax
lea r8, [0x140083c00]
mov rcx, qword [rcx + 0x10]
call fcn.140001064
jmp 0x14004b8f1
mov eax, dword [rsp + 0x110]
inc eax
mov dword [rsp + 0x110], eax
mov ecx, eax
add rcx, rcx
mov edx, 0xffffffff
mov eax, edx
cmp rcx, rdx
cmovbe eax, ecx
jbe 0x14004b718
mov esi, 0x216
jmp 0x14004b8f1
mov ecx, eax
call fcn.1400625b0
mov r15, rax
mov qword [rsp + 0xa8], rax
test rax, rax
jne 0x14004b766
mov rcx, qword [str.___t_]
cmp rcx, r14
je 0x14004b75c
test byte [rcx + 0x1c], 4
je 0x14004b75c
cmp byte [rcx + 0x19], 2
jb 0x14004b75c
mov edx, 0xa7
lea r8, [0x140083c00]
mov rcx, qword [rcx + 0x10]
call fcn.140001010
mov esi, 8
jmp 0x14004b8f1
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x120], eax
mov eax, ebx
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x78]
mov edx, eax
inc eax
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x120]
mov r8, r15
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004b992
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r15
mov rcx, r13
call fcn.140065ce8
mov qword [rsp + 0x98], rax
test rax, rax
jne 0x14004b81d
mov rcx, qword [str.___t_]
cmp rcx, r14
je 0x14004b97b
test byte [rcx + 0x1c], 4
je 0x14004b97b
cmp byte [rcx + 0x19], 3
jb 0x14004b97b
mov edx, 0xa8
mov r9, r15
lea r8, [0x140083c00]
mov rcx, qword [rcx + 0x10]
call fcn.1400011f0
jmp 0x14004b97b
lea r8, [rsp + 0x90]
lea rdx, str.LastDetected
mov rcx, rax
call fcn.1400660f0
mov r14, rax
mov qword [rsp + 0x90], rax
test rax, rax
je 0x14004b852
mov rax, qword [rsp + 0x68]
cmp qword [r14], rax
jae 0x14004b95e
lea r8, [rsp + 0x118]
lea rdx, [0x140083be0]
mov rcx, r15
call qword [sym.imp.msvcrt.dll_swscanf]
cmp eax, 1
jne 0x14004b92a
test rdi, rdi
je 0x14004b8b3
mov rcx, r12
sub rcx, rdi
sar rcx, 2
mov rax, qword [rsp + 0x88]
sub rax, rdi
sar rax, 2
cmp rcx, rax
jae 0x14004b8b3
lea rcx, [r12 + 4]
mov eax, dword [rsp + 0x118]
mov dword [r12], eax
mov r12, rcx
mov qword [rsp + 0x80], rcx
jmp 0x14004b8d5
lea r9, [rsp + 0x118]
mov rdx, r12
lea rcx, [rsp + 0x70]
call fcn.14004bd7c
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x78]
jmp 0x14004b95e
mov rdi, qword [rsp + 0x78]
mov rcx, r15
call fcn.14006264c
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test rdi, rdi
je 0x14004b915
mov rcx, rdi
call fcn.140078278
mov eax, esi
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x14004b95e
test byte [rcx + 0x1c], 4
je 0x14004b95e
cmp byte [rcx + 0x19], 3
jb 0x14004b95e
mov edx, 0xaa
lea r8, [0x140083c00]
mov rcx, qword [rcx + 0x10]
call fcn.140001010
mov rcx, r14
call fcn.14006264c
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r14, str.___t_
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x120], eax
mov eax, dword [rsp + 0x64]
jmp 0x14004b783
mov rax, r12
sub rax, rdi
mov qword [rsp + 0x68], rax
test rdi, rdi
je 0x14004b9dc
mov r14, rax
sar r14, 2
test r14, r14
je 0x14004b9dc
mov ecx, dword [rax + rdi - 4]
mov dword [rsp + 0x118], ecx
call fcn.140066bc0
sub r12, 4
mov qword [rsp + 0x80], r12
mov rcx, qword [rsp + 0x68]
lea rax, [rcx - 4]
test r14, r14
cmove rax, rcx
jmp 0x14004b998
jmp 0x14004b8f6