Function at 0x1400ebb90
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x10b8
call fcn.140190a40
sub rsp, rax
mov qword [rsp + 0x68], rcx
mov rsi, qword [rdx]
mov qword [rsp + 0x98], rdx
mov ebp, dword [rdx + 8]
mov dword [rsp + 0x44], 0x800
lea rcx, [rsp + 0xb8]
mov r8d, 0x1000
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x48], 0x800
mov dword [rsp + 0x4c], 0
mov rax, qword [0x140472688]
movzx eax, byte [rax]
mov ecx, 0x800
mov edx, 1
call fcn.14000d8f0
test rax, rax
je 0x1400ebe2a
mov qword [rsp + 0x50], 0x800
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0
mov r15, qword [rsi]
lea rdi, [rsp + 0x4c]
lea r12, [rsp + 0xb8]
lea r13, [rsp + 0x44]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x90], rcx
sub rbx, rcx
nop dword [rax]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x38], rcx
mov rsi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
mov rcx, r15
mov edx, ebp
mov r8, r12
mov r9, r13
call sub.advapi32.dll_RegEnumValueW
cmp eax, 0xea
jne 0x1400ebcb1
inc dword [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
cmp rbx, r8
mov rax, rsi
jae 0x1400ebc50
lea rcx, [rsp + 0x50]
mov rdx, qword [rsp + 0x90]
call fcn.1400e9f60
mov rax, qword [rsp + 0x58]
jmp 0x1400ebc37
mov r14d, eax
test eax, eax
je 0x1400ebcde
cmp r14d, 0x103
movabs rbx, 0x8000000000000000
jne 0x1400ebd2c
lea rdi, [rbx + 1]
mov bpl, 1
mov rdx, qword [rsp + 0x50]
test rdx, rdx
jne 0x1400ebd43
jmp 0x1400ebd51
mov r8d, dword [rsp + 0x44]
cmp r8, 0x801
movabs rbx, 0x8000000000000000
jae 0x1400ebe39
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0xb8]
call fcn.140170450
mov rdx, qword [rsp + 0xa0]
cmp rdx, rbx
jne 0x1400ebdc7
movabs r14, 0xd00000002
jmp 0x1400ebd34
shl r14, 0x20
or r14, 2
xor ebp, ebp
mov rdi, rbx
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x1400ebd51
mov r8d, 1
mov rcx, rsi
call fcn.14000d900
test bpl, bpl
je 0x1400ebd79
mov rax, qword [rsp + 0x68]
mov qword [rax], rdi
mov qword [rax + 8], r14
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rax + 0x18], xmm0
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x28], rcx
jmp 0x1400ebdb3
mov rdx, rbx
mov rcx, r14
mov rax, qword [rsp + 0x98]
inc dword [rax + 8]
mov rax, qword [rsp + 0x68]
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r8
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rax + 0x18], xmm0
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x28], rcx
mov byte [rax + 0x30], r10b
add rsp, 0x10b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xb0]
mov eax, dword [rsp + 0x48]
mov qword [rsp + 0x60], rax
mov r10d, dword [rsp + 0x4c]
cmp r10d, 0xb
jbe 0x1400ebe0e
movabs r14, 0xde00000002
test rdx, rdx
je 0x1400ebd34
mov r8d, 1
call fcn.14000d900
jmp 0x1400ebd34
mov r9, qword [rsp + 0x60]
mov qword [rsp + 0x80], r9
movups xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm0
jmp 0x1400ebd7f
mov ecx, 1
mov edx, 0x800
call fcn.14016da70
lea rax, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinreg_0.7.0_srclib.rs
mov edx, 0x800
mov rcx, r8
mov r8, rax
call fcn.140181240
int3