Function at 0x14002ebf0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x150], xmm6
mov qword [rbp + 0x148], 0xfffffffffffffffe
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rbp + 0xb0], xmm0
movaps xmmword [rbp + 0xa0], xmm0
movaps xmmword [rbp + 0x90], xmm0
movaps xmmword [rbp + 0x80], xmm0
movaps xmmword [rbp + 0x70], xmm0
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x50], xmm0
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
mov dword [rbp + 0x12c], 0x100
lea rdx, str.SOFTWAREMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
lea rcx, [rbp + 0x108]
mov r8d, 0x4d
call fcn.1400402f0
mov rdi, qword [rbp + 0x108]
test rdi, rdi
je 0x14002ed15
mov rbx, qword [rbp + 0x110]
movups xmm6, xmmword [rbp + 0x118]
movzx eax, byte [0x1400f92c0]
mov rcx, qword [0x1400f91f8]
test rcx, rcx
jne 0x14002ecd8
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14002f15c
mov rcx, rax
mov qword [0x1400f91f8], rax
mov r8d, 0x20
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x14002f15c
mov qword [rax], rdi
mov qword [rax + 8], rbx
movups xmmword [rax + 0x10], xmm6
mov qword [rsi + 8], rax
lea rax, [0x1400bba80]
mov qword [rsi + 0x10], rax
mov qword [rsi], 0
jmp 0x14002f141
mov rbx, qword [rbp + 0x110]
mov r15, qword [rbp + 0x118]
movzx eax, byte [0x1400f92c0]
mov rcx, qword [0x1400f91f8]
test rcx, rcx
jne 0x14002ed4f
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14002f16d
mov rcx, rax
mov qword [0x1400f91f8], rax
mov r8d, 7
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x14002f16d
mov word [rax + 4], 0x6449
mov dword [rax], 0x676f7250
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x110], 7
mov qword [rbp + 0x118], 6
lea rcx, [rbp + 0x108]
call fcn.1400404a0
mov r14, rax
mov r12, rdx
lea rax, [rbp + 0x12c]
mov qword [rsp + 0x30], rax
lea rdi, [rbp - 0x40]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
mov rcx, 0xffffffff80000001
mov rdx, rbx
mov r8, r14
mov r9d, 2
call sub.advapi32.dll_RegGetValueA
test eax, eax
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], r12
je 0x14002edfc
mov qword [rsi], 1
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
jmp 0x14002f103
mov r14d, dword [rbp + 0x12c]
cmp r14, 0x101
jae 0x14002f17e
mov qword [rbp + 0x100], r15
mov qword [rbp + 0xf8], rbx
mov qword [rbp + 0xd8], rdi
mov qword [rbp + 0xe0], r14
lea rcx, [rbp + 0x108]
lea rdx, [rbp + 0xd8]
call fcn.140045840
mov r12, qword [rbp + 0x108]
test r12, r12
je 0x14002eeab
mov r15, qword [rbp + 0x110]
cmp qword [rbp + 0x120], 0
je 0x14002eeb5
test r14d, r14d
je 0x14002eebd
movzx eax, byte [0x1400f92c0]
mov rcx, qword [0x1400f91f8]
test rcx, rcx
jne 0x14002ee89
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14002ee9c
mov rcx, rax
mov qword [0x1400f91f8], rax
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rcx, rax
test rax, rax
jne 0x14002eec2
mov ecx, 1
mov rdx, r14
call fcn.1400a9bd0
ud2
lea r12, str._rustc_82e1608dfa6e0b5569232559e3d385fea5a93112librarycore_src_slice_sort.rs
xor r15d, r15d
xor r14d, r14d
jmp 0x14002f05c
mov ecx, 1
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x138], r14
mov qword [rbp + 0x140], 0
cmp r15, r14
jbe 0x14002ef01
lea rcx, [rbp + 0x130]
xor edx, edx
mov r8, r15
call fcn.1400a9bf0
mov rcx, qword [rbp + 0x130]
mov rdi, qword [rbp + 0x140]
jmp 0x14002ef03
xor edi, edi
add rcx, rdi
mov rdx, r12
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov qword [rbp + 0x140], rdi
mov rax, qword [rbp + 0x138]
sub rax, rdi
cmp rax, 2
ja 0x14002ef47
lea rcx, [rbp + 0x130]
mov ecx, 8
mov ecx, 1
mov edx, 7
call fcn.1400a9bd0
ud2
lea r8, [0x1400bba48]
mov edx, 0x100
mov rcx, r14
call fcn.1400a9df0
ud2