Function at 0x140009fc0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
mov rsi, rdx
mov qword [rsp + 0x80], rcx
add r9, r8
mov qword [rsp + 0xa0], r8
mov qword [rsp + 0xa8], r9
mov word [rsp + 0xb0], 0
mov dword [rsp + 0xb8], 1
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0xa0]
call fcn.1400083a0
mov dword [rsp + 0x64], 0x800
mov dword [rsp + 0x74], 0
movzx eax, byte [0x1401de2b8]
mov rcx, qword [0x1401de220]
test rcx, rcx
jne 0x14000a054
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14000ac10
mov rcx, rax
mov qword [0x1401de220], rax
mov r8d, 0x800
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x14000ac10
mov rdi, rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 0x800
mov qword [rsp + 0xb0], 0
mov rbx, qword [rsp + 0x40]
lea rbp, [rsp + 0x64]
lea r15, [rsp + 0x74]
mov r12, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xb0]
sub r12, r13
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
mov r9, r15
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x14000a0f6
mov r8d, dword [rsp + 0x64]
cmp r12, r8
jae 0x14000a0b0
lea rcx, [rsp + 0xa0]
mov rdx, r13
call fcn.14011c970
mov rdi, qword [rsp + 0xa0]
jmp 0x14000a09d
mov r14d, eax
test eax, eax
jne 0x14000a12b
mov esi, dword [rsp + 0x64]
mov qword [rsp + 0xb0], rsi
mov ebp, dword [rsp + 0x74]
mov rax, qword [rsp + 0xa8]
cmp ebp, 0xb
jbe 0x14000a195
movabs r14, 0xde00000002
test rax, rax
jne 0x14000a140
jmp 0x14000a152
shl r14, 0x20
or r14, 2
mov rax, qword [rsp + 0xa8]
test rax, rax
je 0x14000a152
mov rcx, qword [0x1401de220]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x48], 0
je 0x14000a16e
mov r8, qword [rsp + 0x40]
mov rcx, qword [0x1401de220]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, qword [rsp + 0x80]
mov qword [rax + 8], r14
mov qword [rax], 0
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x140], rax
cmp qword [rsp + 0x48], 0
je 0x14000a1b7
mov rcx, qword [0x1401de220]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp bpl, 7
ja 0x14000a8d4
movzx eax, bpl
mov ecx, 0x86
bt ecx, eax
jae 0x14000a8d4
mov dword [rsp + 0x70], ebp
mov ebx, esi
shr ebx, 1
mov qword [rsp + 0xa0], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0xa8], xmm0
shr esi, 2
mov r8d, ebx
and r8d, 1
add r8, rsi
jne 0x14000aba8
lea r12, [rdi + rbx*2]
xor r13d, r13d
lea rsi, [rsp + 0xa0]
movabs r15, 0x100000000
mov rbp, rdi
test r13w, r13w
je 0x14000a29f
nop word [rax + rax]
mov ecx, ebx
lea eax, [rcx + 0x2000]
movzx eax, ax
cmp eax, 0xf800
jae 0x14000a2c0
movzx eax, cx
shl rax, 0x10
mov r14, rax
shr r14, 0x10
cmp r14d, 0x80
jae 0x14000a322
mov rdx, qword [rsp + 0xb0]
cmp rdx, qword [rsp + 0xa8]
jne 0x14000a27f
mov rcx, rsi
call fcn.1400e6cf0
mov rdx, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xa0]
mov byte [rax + rdx], r14b
inc rdx
mov qword [rsp + 0xb0], rdx
xor r13d, r13d
test r13w, r13w
jne 0x14000a230
cmp rbp, r12
je 0x14000a45f
movzx ecx, word [rbp]
add rbp, 2
lea eax, [rcx + 0x2000]
movzx eax, ax
cmp eax, 0xf800
jb 0x14000a242
movzx eax, cx
cmp eax, 0xdbff
ja 0x14000a354
cmp rbp, r12
je 0x14000a359
movzx eax, word [rbp]
add rbp, 2
mov edx, eax
add edx, 0x2000
movzx edx, dx
cmp edx, 0xfc00
jb 0x14000a36f
movzx eax, ax
and ecx, 0x3ff
and eax, 0x3ff
shl rcx, 0x1a
shl rax, 0x10
or rax, rcx
add rax, r15
mov r14, rax
shr r14, 0x10
cmp r14d, 0x80
jb 0x14000a25d
mov dword [rsp + 0x40], 0
cmp r14d, 0x800
jae 0x14000a361
shr eax, 0x16
or al, 0xc0
mov byte [rsp + 0x40], al
and r14b, 0x3f
or r14b, 0x80
mov byte [rsp + 0x41], r14b
mov r14d, 2
jmp 0x14000a3f0
xor r13d, r13d
jmp 0x14000a376
xor r13d, r13d
mov rbp, r12
jmp 0x14000a376
cmp r14d, 0x10000
jae 0x14000a3b3
xor r13d, r13d
jmp 0x14000a384
mov r13w, 1
mov ebx, eax
mov dword [rsp + 0x40], 0
mov r14d, 0xfffd
mov eax, r14d
shr eax, 0xc
or al, 0xe0
mov byte [rsp + 0x40], al
mov eax, r14d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x41], al
and r14b, 0x3f
or r14b, 0x80
mov byte [rsp + 0x42], r14b
mov r14d, 3
jmp 0x14000a3f3
mov rcx, rax
shr rcx, 0x22
or cl, 0xf0
mov byte [rsp + 0x40], cl
mov rcx, rax
shr rcx, 0x1c
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x41], cl
shr eax, 0x16
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x42], al
and r14b, 0x3f
or r14b, 0x80
mov byte [rsp + 0x43], r14b
mov r14d, 4
xor r13d, r13d
mov rax, qword [rsp + 0xa8]
mov r15, qword [rsp + 0xb0]
sub rax, r15
cmp rax, r14
jb 0x14000a447
mov rcx, qword [rsp + 0xa0]
add rcx, r15
lea rdx, [rsp + 0x40]
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
add r15, r14
mov qword [rsp + 0xb0], r15
movabs r15, 0x100000000
test r13w, r13w
jne 0x14000a230
jmp 0x14000a29f
mov rcx, rsi
mov rdx, r15
mov r8, r14
call fcn.14011a6f0
mov r15, qword [rsp + 0xb0]
jmp 0x14000a40b
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xb0]
inc rax
mov ebp, dword [rsp + 0x70]
nop
cmp rax, 1
je 0x14000a8af
lea r14, [rax - 1]
cmp byte [rsi + rax - 2], 0
mov rax, r14
je 0x14000a480
cmp bpl, 7
jne 0x14000a8bc
mov qword [rsp + 0x40], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x20], 1
lea r9, [0x1401d1949]
lea rcx, [rsp + 0xa0]
mov rdx, rsi
mov r8, r14
call fcn.14001cc50
mov rbp, qword [rsp + 0xa8]
mov r10, qword [rsp + 0xb8]
mov r11, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xf0]
cmp qword [rsp + 0xa0], 0
mov qword [rsp + 0x90], r11
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0x138], rbx
je 0x14000a8f6
mov qword [rsp + 0x88], r10
mov r13, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0x100]
lea rcx, [rbx - 1]
mov rax, rcx
mov qword [rsp + 0x68], rcx
lea rax, [rcx + r13]
cmp rax, r15
jae 0x14000a903
mov r8, qword [rsp + 0xc0]
mov r10, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xf8]
mov rcx, rbx
sub rcx, qword [rsp + 0x88]
mov qword [rsp + 0x118], rcx
mov ecx, 1
mov edx, 1
sub rdx, rbp
mov qword [rsp + 0x108], rdx
lea rdx, [rbp - 1]
mov qword [rsp + 0x110], rdx
cmp rdx, rbx
setb byte [rsp + 0x3f]
lea rdx, [rsi + rbp]
dec rdx
mov qword [rsp + 0x120], rdx
xor r12d, r12d
xor edx, edx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x78], r8
cmp r10, 0xffffffffffffffff
je 0x14000a6dc
movzx eax, byte [r11 + rax]
bt r8, rax
jb 0x14000a60e
add r13, rbx
mov rax, qword [rsp + 0x68]
add rax, r13
cmp rax, r15
jae 0x14000a910
nop dword [rax]
movzx edx, byte [r11 + rax]
bt r8, rdx
jb 0x14000a60b
add r13, rbx
add rax, rbx
cmp rax, r15
jb 0x14000a5f0
jmp 0x14000a910
xor r10d, r10d
cmp rbp, r10
mov rax, r10
cmova rax, rbp
cmp rax, rbx
jae 0x14000a650
lea r8, [r11 + r13]
mov rdx, rax
nop word cs:[rax + rax]
lea r9, [rdx + r13]
cmp r9, r15
jae 0x14000abf2
movzx r9d, byte [rsi + rdx]
cmp r9b, byte [r8 + rdx]
jne 0x14000a69f
inc rdx
cmp rbx, rdx
jne 0x14000a630
mov rdx, rbp
nop word cs:[rax + rax]
cmp r10, rdx
jae 0x14000a7a3
dec rdx
cmp rdx, rbx
jae 0x14000a89b
lea rax, [rdx + r13]
cmp rax, r15
jae 0x14000abdb
movzx r8d, byte [rsi + rdx]
cmp r8b, byte [r11 + rax]
je 0x14000a660
add r13, qword [rsp + 0x88]
mov r10, qword [rsp + 0x118]
jmp 0x14000a6ad
add r13, qword [rsp + 0x108]
add r13, rdx
xor r10d, r10d
mov r8, qword [rsp + 0x78]
mov rax, qword [rsp + 0x68]
add rax, r13
cmp rax, r15
jb 0x14000a5ca
jmp 0x14000a910
add r13, rbx
mov rax, qword [rsp + 0x68]
add rax, r13
cmp rax, r15
jae 0x14000a910
movzx eax, byte [r11 + rax]
bt r8, rax
jae 0x14000a6c8
cmp rbp, rbx
jae 0x14000a720
lea rdx, [r11 + r13]
mov rax, rbp
nop word cs:[rax + rax]
lea r8, [rax + r13]
cmp r8, r15
jae 0x14000abef
movzx r8d, byte [rsi + rax]
cmp r8b, byte [rdx + rax]
jne 0x14000a77d
inc rax
cmp rbx, rax
jne 0x14000a700
test byte [rsp + 0x3f], 1
je 0x14000a883
mov rax, qword [rsp + 0x110]
add rax, r13
mov rdx, qword [rsp + 0x120]
mov r8, rbp
nop word cs:[rax + rax]
sub r8, 1
jb 0x14000a7a7
cmp rax, r15
jae 0x14000abdb
movzx r9d, byte [rdx]
dec rdx
lea r10, [rax - 1]
cmp r9b, byte [r11 + rax]
mov rax, r10
je 0x14000a750
add r13, qword [rsp + 0x88]
jmp 0x14000a788
add r13, qword [rsp + 0x108]
add r13, rax
mov rax, qword [rsp + 0x68]
add rax, r13
cmp rax, r15
mov r8, qword [rsp + 0x78]
jb 0x14000a6dc
jmp 0x14000a910
xor eax, eax
jmp 0x14000a7ae
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x130], rax
mov r8, r13
mov rdx, qword [rsp + 0x58]
sub r8, rdx
mov rax, qword [rsp + 0x48]
sub rax, r12
cmp rax, r8
jb 0x14000a83f
add rdx, qword [rsp + 0x98]
add rcx, r12
mov qword [rsp + 0x128], r8
call sub.VCRUNTIME140.dll_memcpy
add r12, qword [rsp + 0x128]
mov qword [rsp + 0x50], r12
cmp qword [rsp + 0x48], r12
je 0x14000a866
add r13, rbx
mov rcx, qword [rsp + 0x40]
mov byte [rcx + r12], 0xa
inc r12
mov qword [rsp + 0x50], r12
mov rax, qword [rsp + 0x68]
add rax, r13
mov qword [rsp + 0x58], r13
cmp rax, r15
mov r11, qword [rsp + 0x90]
mov r8, qword [rsp + 0x78]
mov r10, qword [rsp + 0x130]
jb 0x14000a5c0
jmp 0x14000a915
lea rcx, [rsp + 0x40]
mov rdx, r12
mov r12, r8
call fcn.14011a6f0
mov r8, r12
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
jmp 0x14000a7ce
mov r8d, 1
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.14011a6f0
mov r12, qword [rsp + 0x50]
jmp 0x14000a7fa
mov rax, 0xffffffffffffffff
test rbp, rbp
je 0x14000a7ae
mov rdx, qword [rsp + 0x110]
lea r8, str._rustc_cc66ad468955717ab92600c770da8c1601a4ff33librarycore_src_strpattern.rs
mov rcx, rdx
mov rdx, rbx
call fcn.140115070
ud2
xor r14d, r14d
cmp bpl, 7
je 0x14000a4a2
mov rax, qword [rsp + 0x80]
mov qword [rax], rsi
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r14
jmp 0x14000a980
movabs rax, 0xde00000002
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 8], rax
mov qword [rcx], 0
jmp 0x14000a980
test r10d, 0xff0000
je 0x14000a9b0
mov ecx, 1
xor r12d, r12d
xor r13d, r13d
jmp 0x14000a915
mov r13, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x98]
lea rsi, [rbx + r13]
sub r14, r13
mov rax, qword [rsp + 0x48]
sub rax, r12
cmp rax, r14
jb 0x14000abbc
add rcx, r12
mov rdx, rsi
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
add r12, r14
mov qword [rsp + 0x50], r12
movups xmm0, xmmword [rsp + 0x40]
mov rax, qword [rsp + 0x80]
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
cmp qword [rsp + 0x138], 0
mov ebp, dword [rsp + 0x70]
je 0x14000a980
mov rcx, qword [0x1401de220]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp bpl, 0xc
je 0x14000a181
cmp qword [rsp + 0x140], 0
je 0x14000a181
mov rcx, qword [0x1401de220]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14000a181
mov rbx, r10
mov ecx, 1
xor r12d, r12d
xor r13d, r13d
jmp 0x14000a9dd
mov rcx, qword [rsp + 0x40]
mov byte [rcx + r12], 0xa
inc r12
mov qword [rsp + 0x50], r12
mov r13, rbp
mov r11, qword [rsp + 0x90]
mov rax, r15
test rbp, rbp
je 0x14000aa06
mov rax, r15
sub rax, rbp
jbe 0x14000aa00
cmp byte [r11 + rbp], 0xc0
jge 0x14000aa06
jmp 0x14000ac21
jne 0x14000ac21
test rax, rax
je 0x14000aa80
movzx r8d, byte [r11 + rbp]
movzx eax, r8b
test al, al
js 0x14000aae8
test bl, bl
jne 0x14000aa88
cmp eax, 0x110000
je 0x14000a915
mov edx, 1
cmp eax, 0x80
jb 0x14000aa51
mov edx, 2
cmp eax, 0x800
jb 0x14000aa51
cmp eax, 0x10000
mov edx, 4
sbb rdx, 0
mov rax, r15
add rbp, rdx
je 0x14000ab55
mov rax, r15
sub rax, rbp
jbe 0x14000ab4f
cmp byte [r11 + rbp], 0xc0
jge 0x14000ab55
jmp 0x14000ac21
test bl, bl
je 0x14000a915
xor bl, 1
mov rsi, rbp
sub rsi, r13
mov rax, qword [rsp + 0x48]
sub rax, r12
cmp rax, rsi
jb 0x14000ab89
add r13, qword [rsp + 0x98]
add rcx, r12
mov rdx, r13
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add r12, rsi
mov qword [rsp + 0x50], r12
cmp qword [rsp + 0x48], r12
jne 0x14000a9c0
mov r8d, 1
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.14011a6f0
mov r12, qword [rsp + 0x50]
jmp 0x14000a9c0
mov edx, eax
and edx, 0x1f
movzx r9d, byte [r11 + rbp + 1]
and r9d, 0x3f
cmp al, 0xe0
jb 0x14000ab3a
movzx eax, byte [r11 + rbp + 2]
shl r9d, 6
and eax, 0x3f
or eax, r9d
cmp r8b, 0xf0
jb 0x14000ab77
movzx r8d, byte [r11 + rbp + 3]
and edx, 7
shl edx, 0x12
shl eax, 6
and r8d, 0x3f
or r8d, eax
or r8d, edx
mov eax, r8d
test bl, bl
jne 0x14000aa88
jmp 0x14000aa20
shl edx, 6
or edx, r9d
mov eax, edx
test bl, bl
jne 0x14000aa88
jmp 0x14000aa20
jne 0x14000ac21
test rax, rax
je 0x14000ab70
movzx eax, byte [r11 + rbp]
mov bl, 1
test al, al
jns 0x14000aa88
cmp al, 0xe0
jmp 0x14000aa88
xor ebx, ebx
jmp 0x14000aa8b
shl edx, 0xc
or eax, edx
test bl, bl
jne 0x14000aa88
jmp 0x14000aa20
lea rcx, [rsp + 0x40]
mov rdx, r12
mov r8, rsi
call fcn.14011a6f0
mov rcx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
jmp 0x14000aaa2
lea rcx, [rsp + 0xa0]
xor edx, edx
call fcn.14011a6f0
jmp 0x14000a205
lea rcx, [rsp + 0x40]
mov rdx, r12
mov r8, r14
call fcn.14011a6f0
mov rcx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
jmp 0x14000a935
lea r8, str._rustc_cc66ad468955717ab92600c770da8c1601a4ff33librarycore_src_strpattern.rs
mov rcx, rax
mov rdx, r15
call fcn.140115070
ud2
mov rax, rbp
add r13, rax
cmp r15, r13
cmova r13, r15
lea r8, str._rustc_cc66ad468955717ab92600c770da8c1601a4ff33librarycore_src_strpattern.rs
mov rcx, r13
mov rdx, r15
call fcn.140115070
ud2
mov ecx, 1
mov edx, 0x800
call fcn.140114cd0
ud2
lea rax, str._rustc_cc66ad468955717ab92600c770da8c1601a4ff33librarycore_src_strpattern.rs
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x90]
mov rdx, r15
mov r8, rbp
mov r9, r15
call fcn.1401155e0
ud2