Function at 0x14004b170
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [r11 - 0x58], 0xfffffffffffffffe
movabs rax, 0xffffe7a3dd31c000
add rax, rcx
mov qword [rsp + 0xa0], rax
xor ebx, ebx
mov r13d, ebx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [r11 - 0x88], rbx
mov dword [rsp + 0x60], ebx
lea rsi, str.___t_
mov rcx, qword [str.___t_]
cmp rcx, rsi
je 0x14004b1ef
test byte [rcx + 0x1c], 4
je 0x14004b1ef
cmp byte [rcx + 0x19], 5
jb 0x14004b1ef
mov edx, 0xa4
lea r8, [0x140082bf0]
mov rcx, qword [rcx + 0x10]
call fcn.140001010
mov r9d, 0x20019
xor r8d, r8d
lea rdi, str.SoftwareMicrosoftFaxDevices_Cache
mov rdx, rdi
mov rcx, 0xffffffff80000002
call fcn.140065ea8
mov r12, rax
mov qword [rsp + 0xa8], rax
test rax, rax
jne 0x14004b263
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.___t_]
cmp rcx, rsi
je 0x14004b25c
test byte [rcx + 0x1c], 4
je 0x14004b25c
cmp byte [rcx + 0x19], 3
jb 0x14004b25c
mov edx, 0xa5
mov qword [rsp + 0x20], rdi
mov r9d, eax
lea r8, [0x140082bf0]
mov rcx, qword [rcx + 0x10]
call fcn.140001064
nop
mov eax, ebx
jmp 0x14004b5c1
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x110]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r15d, eax
mov dword [rsp + 0x128], eax
test eax, eax
je 0x14004b2fd
mov rcx, qword [str.___t_]
cmp rcx, rsi
je 0x14004b595
test byte [rcx + 0x1c], 4
je 0x14004b595
cmp byte [rcx + 0x19], 2
jb 0x14004b595
mov edx, 0xa6
mov qword [rsp + 0x20], rdi
mov r9d, eax
lea r8, [0x140082bf0]
mov rcx, qword [rcx + 0x10]
call fcn.140001064
jmp 0x14004b595
mov eax, dword [rsp + 0x110]
inc eax
mov dword [rsp + 0x110], eax
mov ecx, eax
add rcx, rcx
mov eax, 0xffffffff
cmp rcx, rax
jbe 0x14004b327
mov r15d, 0x216
jmp 0x14004b595
mov ecx, ecx
call fcn.1400625b8
mov r13, rax
mov qword [rsp + 0x98], rax
test rax, rax
jne 0x14004b376
mov rcx, qword [str.___t_]
cmp rcx, rsi
je 0x14004b36b
test byte [rcx + 0x1c], 4
je 0x14004b36b
cmp byte [rcx + 0x19], 2
jb 0x14004b36b
mov edx, 0xa7
lea r8, [0x140082bf0]
mov rcx, qword [rcx + 0x10]
call fcn.140001010
mov r15d, 8
jmp 0x14004b595
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x120], eax
mov eax, ebx
mov r14, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov edx, eax
inc eax
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x120]
mov r8, r13
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004b548
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r13
mov rcx, r12
call fcn.140065ea8
mov qword [rsp + 0x90], rax
test rax, rax
jne 0x14004b42a
mov rcx, qword [str.___t_]
cmp rcx, rsi
je 0x14004b531
test byte [rcx + 0x1c], 4
je 0x14004b531
cmp byte [rcx + 0x19], 3
jb 0x14004b531
mov edx, 0xa8
mov r9, r13
lea r8, [0x140082bf0]
mov rcx, qword [rcx + 0x10]
call fcn.1400011f0
jmp 0x14004b531
lea r8, [rsp + 0x88]
lea rdx, str.LastDetected
mov rcx, rax
call fcn.1400662b0
mov rsi, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x14004b462
mov rax, qword [rsp + 0xa0]
cmp qword [rsi], rax
jae 0x14004b514
lea r8, [rsp + 0x118]
lea rdx, [0x140082bd0]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_swscanf]
cmp eax, 1
jne 0x14004b4e0
test rdi, rdi
je 0x14004b4ba
mov rcx, r14
sub rcx, rdi
sar rcx, 2
mov rax, qword [rsp + 0x80]
sub rax, rdi
sar rax, 2
cmp rcx, rax
jae 0x14004b4ba
lea rcx, [r14 + 4]
mov eax, dword [rsp + 0x118]
mov dword [r14], eax
mov r14, rcx
mov qword [rsp + 0x78], rcx
jmp 0x14004b4d9
lea r9, [rsp + 0x118]
mov rdx, r14
lea rcx, [rsp + 0x68]
call fcn.14004b96c
mov r14, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
jmp 0x14004b514
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x14004b514
test byte [rcx + 0x1c], 4
je 0x14004b514
cmp byte [rcx + 0x19], 3
jb 0x14004b514
mov edx, 0xaa
lea r8, [0x140082bf0]
mov rcx, qword [rcx + 0x10]
call fcn.140001010
mov rcx, rsi
call fcn.140062654
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rsi, str.___t_
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x120], eax
mov eax, dword [rsp + 0x64]
jmp 0x14004b390
mov rsi, r14
sub rsi, rdi
test rdi, rdi
je 0x14004b583
mov r12, rsi
sar r12, 2
test r12, r12
je 0x14004b583
mov ecx, dword [rdi + rsi - 4]
mov dword [rsp + 0x118], ecx
call fcn.140066d80
test r12, r12
je 0x14004b54e
sub r14, 4
mov qword [rsp + 0x78], r14
sub rsi, 4
jmp 0x14004b54e
jmp 0x14004b59a
mov rdi, qword [rsp + 0x70]
mov rcx, r13
call fcn.140062654
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test rdi, rdi
je 0x14004b5be
mov rcx, rdi
call fcn.140077490
mov eax, r15d
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret