Function at 0x14004f418
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [r11 - 0x58], 0xfffffffffffffffe
movabs rax, 0xffffe7a3dd31c000
add rax, rcx
mov qword [rsp + 0xa8], rax
xor ebx, ebx
mov r12d, ebx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [r11 - 0x88], rbx
mov dword [rsp + 0x60], ebx
lea rsi, [0x14009b028]
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14004f497
test byte [rcx + 0x1c], 4
je 0x14004f497
cmp byte [rcx + 0x19], 5
jb 0x14004f497
mov edx, 0xa4
lea r8, [0x140089df0]
mov rcx, qword [rcx + 0x10]
call fcn.140001024
mov r9d, 0x20019
xor r8d, r8d
lea rdi, str.SoftwareMicrosoftFaxDevices_Cache
mov rdx, rdi
mov rcx, 0xffffffff80000002
call fcn.14006b230
mov r13, rax
mov qword [rsp + 0x98], rax
test rax, rax
jne 0x14004f511
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14004f50a
test byte [rcx + 0x1c], 4
je 0x14004f50a
cmp byte [rcx + 0x19], 3
jb 0x14004f50a
mov edx, 0xa5
mov qword [rsp + 0x20], rdi
mov r9d, eax
lea r8, [0x140089df0]
mov rcx, qword [rcx + 0x10]
call fcn.140001094
nop
mov eax, ebx
jmp 0x14004f88a
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x110]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov r14d, eax
mov dword [rsp + 0x128], eax
test eax, eax
je 0x14004f5b1
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14004f85d
test byte [rcx + 0x1c], 4
je 0x14004f85d
cmp byte [rcx + 0x19], 2
jb 0x14004f85d
mov edx, 0xa6
mov qword [rsp + 0x20], rdi
mov r9d, eax
lea r8, [0x140089df0]
mov rcx, qword [rcx + 0x10]
call fcn.140001094
jmp 0x14004f85d
mov eax, dword [rsp + 0x110]
inc eax
mov dword [rsp + 0x110], eax
mov ecx, eax
add rcx, rcx
mov eax, 0xffffffff
cmp rcx, rax
ja 0x14004f857
mov ecx, ecx
call fcn.140067108
mov r12, rax
mov qword [rsp + 0xa0], rax
test rax, rax
jne 0x14004f623
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14004f618
test byte [rcx + 0x1c], 4
je 0x14004f618
cmp byte [rcx + 0x19], 2
jb 0x14004f618
mov edx, 0xa7
lea r8, [0x140089df0]
mov rcx, qword [rcx + 0x10]
call fcn.140001024
mov r14d, 8
jmp 0x14004f85d
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x120], eax
mov eax, ebx
mov r15, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov edx, eax
inc eax
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x120]
mov r8, r12
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14004f81f
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r12
mov rcx, r13
call fcn.14006b230
mov qword [rsp + 0x90], rax
test rax, rax
jne 0x14004f6dd
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14004f808
test byte [rcx + 0x1c], 4
je 0x14004f808
cmp byte [rcx + 0x19], 3
jb 0x14004f808
mov edx, 0xa8
mov r9, r12
lea r8, [0x140089df0]
mov rcx, qword [rcx + 0x10]
call fcn.1400011fc
jmp 0x14004f808
lea r8, [rsp + 0x88]
lea rdx, str.LastDetected
mov rcx, rax
call fcn.14006b6a4
mov rsi, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x14004f715
mov rax, qword [rsp + 0xa8]
cmp qword [rsi], rax
jae 0x14004f7e5
lea r8, [rsp + 0x118]
lea rdx, [0x140089dd0]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_swscanf]
nop dword [rax + rax]
cmp eax, 1
jne 0x14004f7b1
test rdi, rdi
je 0x14004f773
mov rcx, r15
sub rcx, rdi
sar rcx, 2
mov rax, qword [rsp + 0x80]
sub rax, rdi
sar rax, 2
cmp rcx, rax
jae 0x14004f773
lea rcx, [r15 + 4]
mov eax, dword [rsp + 0x118]
mov dword [r15], eax
mov r15, rcx
mov qword [rsp + 0x78], rcx
jmp 0x14004f792
lea r9, [rsp + 0x118]
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.14004fc5c
mov r15, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
jmp 0x14004f7e5
mov rcx, qword [0x14009b028]
lea rax, [0x14009b028]
cmp rcx, rax
je 0x14004f7e5
test byte [rcx + 0x1c], 4
je 0x14004f7e5
cmp byte [rcx + 0x19], 3
jb 0x14004f7e5
mov edx, 0xaa
lea r8, [0x140089df0]
mov rcx, qword [rcx + 0x10]
call fcn.140001024
mov rcx, rsi
call fcn.1400671c4
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea rsi, [0x14009b028]
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x120], eax
mov eax, dword [rsp + 0x64]
jmp 0x14004f63d
mov rsi, r15
sub rsi, rdi
test rdi, rdi
je 0x14004f855
mov rax, rsi
sar rax, 2
test rax, rax
je 0x14004f855
mov ecx, dword [rsi + rdi - 4]
mov dword [rsp + 0x118], ecx
call fcn.14006c224
sub r15, 4
mov qword [rsp + 0x78], r15
sub rsi, 4
jmp 0x14004f825
jmp 0x14004f862
mov r14d, 0x216
mov rdi, qword [rsp + 0x70]
mov rcx, r12
call fcn.1400671c4
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
nop
test rdi, rdi
je 0x14004f887
mov rcx, rdi
call fcn.14007e7a4
mov eax, r14d
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret