Function at 0x14004c044
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [r11 - 0x58], 0xfffffffffffffffe
movabs rax, 0xffffe7a3dd31c000
add rax, rcx
mov qword [rsp + 0xa8], rax
xor ebx, ebx
mov r12d, ebx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [r11 - 0x88], rbx
mov dword [rsp + 0x60], ebx
lea rsi, str.___t_
mov rcx, qword [str.___t_]
cmp rcx, rsi
je 0x14004c0c3
test byte [rcx + 0x1c], 4
je 0x14004c0c3
cmp byte [rcx + 0x19], 5
jb 0x14004c0c3
mov edx, 0xa4
lea r8, [0x140083c00]
mov rcx, qword [rcx + 0x10]
call fcn.140001024
mov r9d, 0x20019
xor r8d, r8d
lea rdi, str.SoftwareMicrosoftFaxDevices_Cache
mov rdx, rdi
mov rcx, 0xffffffff80000002
call fcn.140066b60
mov r13, rax
mov qword [rsp + 0x98], rax
test rax, rax
jne 0x14004c137
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.___t_]
cmp rcx, rsi
je 0x14004c130
test byte [rcx + 0x1c], 4
je 0x14004c130
cmp byte [rcx + 0x19], 3
jb 0x14004c130
mov edx, 0xa5
mov qword [rsp + 0x20], rdi
mov r9d, eax
lea r8, [0x140083c00]
mov rcx, qword [rcx + 0x10]
call fcn.140001084
nop
mov eax, ebx
jmp 0x14004c492
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x110]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r14d, eax
mov dword [rsp + 0x128], eax
test eax, eax
je 0x14004c1d1
mov rcx, qword [str.___t_]
cmp rcx, rsi
je 0x14004c46b
test byte [rcx + 0x1c], 4
je 0x14004c46b
cmp byte [rcx + 0x19], 2
jb 0x14004c46b
mov edx, 0xa6
mov qword [rsp + 0x20], rdi
mov r9d, eax
lea r8, [0x140083c00]
mov rcx, qword [rcx + 0x10]
call fcn.140001084
jmp 0x14004c46b
mov eax, dword [rsp + 0x110]
inc eax
mov dword [rsp + 0x110], eax
mov ecx, eax
add rcx, rcx
mov eax, 0xffffffff
cmp rcx, rax
ja 0x14004c465
mov ecx, ecx
call fcn.140063430
mov r12, rax
mov qword [rsp + 0xa0], rax
test rax, rax
jne 0x14004c243
mov rcx, qword [str.___t_]
cmp rcx, rsi
je 0x14004c238
test byte [rcx + 0x1c], 4
je 0x14004c238
cmp byte [rcx + 0x19], 2
jb 0x14004c238
mov edx, 0xa7
lea r8, [0x140083c00]
mov rcx, qword [rcx + 0x10]
call fcn.140001024
mov r14d, 8
jmp 0x14004c46b
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x120], eax
mov eax, ebx
mov r15, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov edx, eax
inc eax
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x120]
mov r8, r12
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004c42d
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r12
mov rcx, r13
call fcn.140066b60
mov qword [rsp + 0x90], rax
test rax, rax
jne 0x14004c2f7
mov rcx, qword [str.___t_]
cmp rcx, rsi
je 0x14004c416
test byte [rcx + 0x1c], 4
je 0x14004c416
cmp byte [rcx + 0x19], 3
jb 0x14004c416
mov edx, 0xa8
mov r9, r12
lea r8, [0x140083c00]
mov rcx, qword [rcx + 0x10]
call fcn.1400011dc
jmp 0x14004c416
lea r8, [rsp + 0x88]
lea rdx, str.LastDetected
mov rcx, rax
call fcn.140066f7c
mov rsi, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x14004c32f
mov rax, qword [rsp + 0xa8]
cmp qword [rsi], rax
jae 0x14004c3f9
lea r8, [rsp + 0x118]
lea rdx, [0x140083be0]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_swscanf]
cmp eax, 1
jne 0x14004c3c5
test rdi, rdi
je 0x14004c387
mov rcx, r15
sub rcx, rdi
sar rcx, 2
mov rax, qword [rsp + 0x80]
sub rax, rdi
sar rax, 2
cmp rcx, rax
jae 0x14004c387
lea rcx, [r15 + 4]
mov eax, dword [rsp + 0x118]
mov dword [r15], eax
mov r15, rcx
mov qword [rsp + 0x78], rcx
jmp 0x14004c3a6
lea r9, [rsp + 0x118]
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.14004c860
mov r15, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
jmp 0x14004c3f9
mov rcx, qword [str.___t_]
lea rax, str.___t_
cmp rcx, rax
je 0x14004c3f9
test byte [rcx + 0x1c], 4
je 0x14004c3f9
cmp byte [rcx + 0x19], 3
jb 0x14004c3f9
mov edx, 0xaa
lea r8, [0x140083c00]
mov rcx, qword [rcx + 0x10]
call fcn.140001024
mov rcx, rsi
call fcn.1400634d4
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rsi, str.___t_
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x120], eax
mov eax, dword [rsp + 0x64]
jmp 0x14004c25d
mov rsi, r15
sub rsi, rdi
test rdi, rdi
je 0x14004c463
mov rax, rsi
sar rax, 2
test rax, rax
je 0x14004c463
mov ecx, dword [rsi + rdi - 4]
mov dword [rsp + 0x118], ecx
call fcn.140067a4c
sub r15, 4
mov qword [rsp + 0x78], r15
sub rsi, 4
jmp 0x14004c433
jmp 0x14004c470
mov r14d, 0x216
mov rdi, qword [rsp + 0x70]
mov rcx, r12
call fcn.1400634d4
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test rdi, rdi
je 0x14004c48f
mov rcx, rdi
call fcn.1400786fc
mov eax, r14d
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret