Function at 0x14004f178
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [r11 - 0x58], 0xfffffffffffffffe
movabs rax, 0xffffe7a3dd31c000
add rax, rcx
mov qword [rsp + 0xa8], rax
xor ebx, ebx
mov r12d, ebx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [r11 - 0x88], rbx
mov dword [rsp + 0x60], ebx
lea rsi, [0x14009b028]
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14004f1f7
test byte [rcx + 0x1c], 4
je 0x14004f1f7
cmp byte [rcx + 0x19], 5
jb 0x14004f1f7
mov edx, 0xa4
lea r8, [0x140089c20]
mov rcx, qword [rcx + 0x10]
call fcn.140001024
mov r9d, 0x20019
xor r8d, r8d
lea rdi, str.SoftwareMicrosoftFaxDevices_Cache
mov rdx, rdi
mov rcx, 0xffffffff80000002
call fcn.14006aa3c
mov r13, rax
mov qword [rsp + 0x98], rax
test rax, rax
jne 0x14004f271
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14004f26a
test byte [rcx + 0x1c], 4
je 0x14004f26a
cmp byte [rcx + 0x19], 3
jb 0x14004f26a
mov edx, 0xa5
mov qword [rsp + 0x20], rdi
mov r9d, eax
lea r8, [0x140089c20]
mov rcx, qword [rcx + 0x10]
call fcn.140001094
nop
mov eax, ebx
jmp 0x14004f5ea
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x110]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
mov r14d, eax
mov dword [rsp + 0x128], eax
test eax, eax
je 0x14004f311
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14004f5bd
test byte [rcx + 0x1c], 4
je 0x14004f5bd
cmp byte [rcx + 0x19], 2
jb 0x14004f5bd
mov edx, 0xa6
mov qword [rsp + 0x20], rdi
mov r9d, eax
lea r8, [0x140089c20]
mov rcx, qword [rcx + 0x10]
call fcn.140001094
jmp 0x14004f5bd
mov eax, dword [rsp + 0x110]
inc eax
mov dword [rsp + 0x110], eax
mov ecx, eax
add rcx, rcx
mov eax, 0xffffffff
cmp rcx, rax
ja 0x14004f5b7
mov ecx, ecx
call fcn.140066e68
mov r12, rax
mov qword [rsp + 0xa0], rax
test rax, rax
jne 0x14004f383
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14004f378
test byte [rcx + 0x1c], 4
je 0x14004f378
cmp byte [rcx + 0x19], 2
jb 0x14004f378
mov edx, 0xa7
lea r8, [0x140089c20]
mov rcx, qword [rcx + 0x10]
call fcn.140001024
mov r14d, 8
jmp 0x14004f5bd
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x120], eax
mov eax, ebx
mov r15, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov edx, eax
inc eax
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x120]
mov r8, r12
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14004f57f
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r12
mov rcx, r13
call fcn.14006aa3c
mov qword [rsp + 0x90], rax
test rax, rax
jne 0x14004f43d
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14004f568
test byte [rcx + 0x1c], 4
je 0x14004f568
cmp byte [rcx + 0x19], 3
jb 0x14004f568
mov edx, 0xa8
mov r9, r12
lea r8, [0x140089c20]
mov rcx, qword [rcx + 0x10]
call fcn.1400011fc
jmp 0x14004f568
lea r8, [rsp + 0x88]
lea rdx, str.LastDetected
mov rcx, rax
call fcn.14006aeb0
mov rsi, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x14004f475
mov rax, qword [rsp + 0xa8]
cmp qword [rsi], rax
jae 0x14004f545
lea r8, [rsp + 0x118]
lea rdx, [0x140089c00]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_swscanf]
nop dword [rax + rax]
cmp eax, 1
jne 0x14004f511
test rdi, rdi
je 0x14004f4d3
mov rcx, r15
sub rcx, rdi
sar rcx, 2
mov rax, qword [rsp + 0x80]
sub rax, rdi
sar rax, 2
cmp rcx, rax
jae 0x14004f4d3
lea rcx, [r15 + 4]
mov eax, dword [rsp + 0x118]
mov dword [r15], eax
mov r15, rcx
mov qword [rsp + 0x78], rcx
jmp 0x14004f4f2
lea r9, [rsp + 0x118]
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.14004f9bc
mov r15, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
jmp 0x14004f545
mov rcx, qword [0x14009b028]
lea rax, [0x14009b028]
cmp rcx, rax
je 0x14004f545
test byte [rcx + 0x1c], 4
je 0x14004f545
cmp byte [rcx + 0x19], 3
jb 0x14004f545
mov edx, 0xaa
lea r8, [0x140089c20]
mov rcx, qword [rcx + 0x10]
call fcn.140001024
mov rcx, rsi
call fcn.140066f24
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea rsi, [0x14009b028]
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x120], eax
mov eax, dword [rsp + 0x64]
jmp 0x14004f39d
mov rsi, r15
sub rsi, rdi
test rdi, rdi
je 0x14004f5b5
mov rax, rsi
sar rax, 2
test rax, rax
je 0x14004f5b5
mov ecx, dword [rsi + rdi - 4]
mov dword [rsp + 0x118], ecx
call fcn.14006ba30
sub r15, 4
mov qword [rsp + 0x78], r15
sub rsi, 4
jmp 0x14004f585
jmp 0x14004f5c2
mov r14d, 0x216
mov rdi, qword [rsp + 0x70]
mov rcx, r12
call fcn.140066f24
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
nop
test rdi, rdi
je 0x14004f5e7
mov rcx, rdi
call fcn.14007df14
mov eax, r14d
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret