Function at 0x14004f318
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [r11 - 0x58], 0xfffffffffffffffe
movabs rax, 0xffffe7a3dd31c000
add rax, rcx
mov qword [rsp + 0xa8], rax
xor ebx, ebx
mov r12d, ebx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [r11 - 0x88], rbx
mov dword [rsp + 0x60], ebx
lea rsi, [0x14009b028]
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14004f397
test byte [rcx + 0x1c], 4
je 0x14004f397
cmp byte [rcx + 0x19], 5
jb 0x14004f397
mov edx, 0xa4
lea r8, [0x140089db0]
mov rcx, qword [rcx + 0x10]
call fcn.140001024
mov r9d, 0x20019
xor r8d, r8d
lea rdi, str.SoftwareMicrosoftFaxDevices_Cache
mov rdx, rdi
mov rcx, 0xffffffff80000002
call fcn.14006abdc
mov r13, rax
mov qword [rsp + 0x98], rax
test rax, rax
jne 0x14004f411
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14004f40a
test byte [rcx + 0x1c], 4
je 0x14004f40a
cmp byte [rcx + 0x19], 3
jb 0x14004f40a
mov edx, 0xa5
mov qword [rsp + 0x20], rdi
mov r9d, eax
lea r8, [0x140089db0]
mov rcx, qword [rcx + 0x10]
call fcn.140001094
nop
mov eax, ebx
jmp 0x14004f78a
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x110]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov r14d, eax
mov dword [rsp + 0x128], eax
test eax, eax
je 0x14004f4b1
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14004f75d
test byte [rcx + 0x1c], 4
je 0x14004f75d
cmp byte [rcx + 0x19], 2
jb 0x14004f75d
mov edx, 0xa6
mov qword [rsp + 0x20], rdi
mov r9d, eax
lea r8, [0x140089db0]
mov rcx, qword [rcx + 0x10]
call fcn.140001094
jmp 0x14004f75d
mov eax, dword [rsp + 0x110]
inc eax
mov dword [rsp + 0x110], eax
mov ecx, eax
add rcx, rcx
mov eax, 0xffffffff
cmp rcx, rax
ja 0x14004f757
mov ecx, ecx
call fcn.140067008
mov r12, rax
mov qword [rsp + 0xa0], rax
test rax, rax
jne 0x14004f523
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14004f518
test byte [rcx + 0x1c], 4
je 0x14004f518
cmp byte [rcx + 0x19], 2
jb 0x14004f518
mov edx, 0xa7
lea r8, [0x140089db0]
mov rcx, qword [rcx + 0x10]
call fcn.140001024
mov r14d, 8
jmp 0x14004f75d
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x120], eax
mov eax, ebx
mov r15, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov edx, eax
inc eax
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x120]
mov r8, r12
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14004f71f
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r12
mov rcx, r13
call fcn.14006abdc
mov qword [rsp + 0x90], rax
test rax, rax
jne 0x14004f5dd
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14004f708
test byte [rcx + 0x1c], 4
je 0x14004f708
cmp byte [rcx + 0x19], 3
jb 0x14004f708
mov edx, 0xa8
mov r9, r12
lea r8, [0x140089db0]
mov rcx, qword [rcx + 0x10]
call fcn.1400011fc
jmp 0x14004f708
lea r8, [rsp + 0x88]
lea rdx, str.LastDetected
mov rcx, rax
call fcn.14006b050
mov rsi, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x14004f615
mov rax, qword [rsp + 0xa8]
cmp qword [rsi], rax
jae 0x14004f6e5
lea r8, [rsp + 0x118]
lea rdx, [0x140089d90]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_swscanf]
nop dword [rax + rax]
cmp eax, 1
jne 0x14004f6b1
test rdi, rdi
je 0x14004f673
mov rcx, r15
sub rcx, rdi
sar rcx, 2
mov rax, qword [rsp + 0x80]
sub rax, rdi
sar rax, 2
cmp rcx, rax
jae 0x14004f673
lea rcx, [r15 + 4]
mov eax, dword [rsp + 0x118]
mov dword [r15], eax
mov r15, rcx
mov qword [rsp + 0x78], rcx
jmp 0x14004f692
lea r9, [rsp + 0x118]
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.14004fb5c
mov r15, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
jmp 0x14004f6e5
mov rcx, qword [0x14009b028]
lea rax, [0x14009b028]
cmp rcx, rax
je 0x14004f6e5
test byte [rcx + 0x1c], 4
je 0x14004f6e5
cmp byte [rcx + 0x19], 3
jb 0x14004f6e5
mov edx, 0xaa
lea r8, [0x140089db0]
mov rcx, qword [rcx + 0x10]
call fcn.140001024
mov rcx, rsi
call fcn.1400670c4
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea rsi, [0x14009b028]
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x120], eax
mov eax, dword [rsp + 0x64]
jmp 0x14004f53d
mov rsi, r15
sub rsi, rdi
test rdi, rdi
je 0x14004f755
mov rax, rsi
sar rax, 2
test rax, rax
je 0x14004f755
mov ecx, dword [rsi + rdi - 4]
mov dword [rsp + 0x118], ecx
call fcn.14006bbd0
sub r15, 4
mov qword [rsp + 0x78], r15
sub rsi, 4
jmp 0x14004f725
jmp 0x14004f762
mov r14d, 0x216
mov rdi, qword [rsp + 0x70]
mov rcx, r12
call fcn.1400670c4
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
nop
test rdi, rdi
je 0x14004f787
mov rcx, rdi
call fcn.14007e0b4
mov eax, r14d
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret