Function at 0x40e8a0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov rbx, r8
mov rsi, rdx
mov r13, rcx
mov rdi, qword [r8 + 8]
mov rax, qword [r8 + 0x10]
add rax, rdi
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], rdi
mov word [rsp + 0xf0], 0
mov dword [rsp + 0xf8], 1
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0xe0]
call fcn.0041b0d0
mov rax, qword [rbx]
test rax, rax
je 0x40e936
mov rcx, rax
and rcx, 0xfffffffffffffffe
mov edx, eax
and edx, 1
or rax, 0xfffffffffffffffe
inc rax
imul rax, rcx
or rax, rdx
je 0x40e936
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
mov dword [rsp + 0x68], 0x800
mov dword [rsp + 0x98], 0
mov rcx, qword [0x00576170]
test rcx, rcx
jne 0x40e96d
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x40f74b
mov rcx, rax
mov qword [0x00576170], rax
mov r8d, 0x800
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x40f74b
mov rbp, rax
mov qword [rsp + 0xe0], 0x800
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], 0
mov r14, qword [rsp + 0x88]
lea rdi, [rsp + 0x68]
lea r15, [rsp + 0x98]
lea r12, [rsp + 0xe0]
nop word cs:[rax + rax]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbp
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
mov r9, r15
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x40ea21
mov r8d, dword [rsp + 0x68]
mov rax, qword [rsp + 0xe0]
mov rdx, qword [rsp + 0xf0]
sub rax, rdx
cmp rax, r8
jae 0x40e9d0
mov rcx, r12
call fcn.00405f50
mov rbp, qword [rsp + 0xe8]
jmp 0x40e9d0
mov ebx, eax
test eax, eax
jne 0x40eb58
movabs rbx, 0xde00000002
mov r15d, dword [rsp + 0x68]
mov qword [rsp + 0xf0], r15
mov ecx, dword [rsp + 0x98]
cmp ecx, 0xb
ja 0x40eb60
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0xd8], rax
cmp qword [rsp + 0x80], 0
mov dword [rsp + 0x44], ecx
je 0x40ea86
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
mov ecx, dword [rsp + 0x44]
cmp cl, 7
ja 0x40ebe2
movzx eax, cl
mov ecx, 0x86
bt ecx, eax
mov ecx, dword [rsp + 0x44]
jae 0x40ebe2
mov qword [rsp + 0xc8], rbp
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 1
mov qword [rsp + 0x78], 0
mov rax, r15
shr rax, 2
bt r15d, 1
adc rax, 0
je 0x40ebdb
cmp rax, 9
mov esi, 8
cmovae rsi, rax
mov qword [rsp + 0xf0], 0
lea rcx, [rsp + 0x80]
mov ebp, 1
lea r9, [rsp + 0xe0]
mov r8d, 1
mov rdx, rsi
call fcn.004fef2d
cmp qword [rsp + 0x80], 0
mov rcx, qword [rsp + 0x88]
je 0x40ebfb
mov rdx, qword [rsp + 0x90]
movabs rax, 0x8000000000000001
cmp rdx, rax
je 0x40ec08
jmp 0x40f659
shl rbx, 0x20
or rbx, 2
mov rax, qword [rsp + 0xe0]
test rax, rax
je 0x40eb9a
mov rcx, rax
and rcx, 0xfffffffffffffffe
mov edx, eax
and edx, 1
or rax, 0xfffffffffffffffe
inc rax
imul rax, rcx
or rax, rdx
je 0x40eb9a
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, rbp
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x80], 0
je 0x40ebbb
mov r8, qword [rsp + 0x88]
mov rcx, qword [0x00576170]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov qword [r13], rbx
mov qword [r13 + 8], 0
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ebp, 1
jmp 0x40ec08
mov qword [r13], rbx
mov qword [r13 + 8], 0
mov rdx, qword [rsp + 0xd8]
jmp 0x40f6cb
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rsi
mov rbp, rcx
and r15d, 0xfffffffe
mov rdi, qword [rsp + 0xc8]
add r15, rdi
xor ebx, ebx
xor esi, esi
jmp 0x40ec44
lea rbx, [r12 + r13]
mov rbp, qword [rsp + 0x70]
add r12, rbp
mov rcx, r12
lea rdx, [rsp + 0x98]
mov r8, r13
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x78], rbx
mov r12, rbx
movabs rbx, 0x100000000
jmp 0x40ec6f
mov byte [rbp + r12], r13b
inc r12
mov qword [rsp + 0x78], r12
xor esi, esi
test si, si
je 0x40ecf0
mov ecx, r14d
mov eax, ecx
and eax, 0xf800
cmp eax, 0xd800
jne 0x40ed12
movzx eax, cx
cmp eax, 0xdbff
ja 0x40ed8c
cmp rdi, r15
je 0x40ed90
movzx eax, word [rdi]
add rdi, 2
mov edx, eax
add edx, 0x2000
movzx edx, dx
cmp edx, 0xfc00
jb 0x40eda4
movzx eax, ax
and ecx, 0x3ff
and eax, 0x3ff
shl rcx, 0x1a
shl rax, 0x10
or rax, rcx
add rax, rbx
mov r13, rax
shr r13, 0x10
cmp r13d, 0x7f
jbe 0x40ed26
jmp 0x40ed50
cmp rdi, r15
je 0x40ef07
movzx ecx, word [rdi]
add rdi, 2
mov eax, ecx
and eax, 0xf800
cmp eax, 0xd800
je 0x40ec89
movzx eax, cx
shl rax, 0x10
mov r13, rax
shr r13, 0x10
cmp r13d, 0x7f
ja 0x40ed50
cmp r12, qword [rsp + 0x68]
jne 0x40ec60
lea rcx, [rsp + 0x68]
mov rdx, r12
call fcn.004ff05b
mov rbp, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
jmp 0x40ec60
mov dword [rsp + 0x98], 0
cmp r13d, 0x800
jae 0x40ed97
shr rax, 0x16
or al, 0xc0
mov byte [rsp + 0x98], al
and r13b, 0x3f
or r13b, 0x80
mov byte [rsp + 0x99], r13b
mov r13d, 2
jmp 0x40ee3e
xor esi, esi
jmp 0x40edab
xor esi, esi
mov rdi, r15
jmp 0x40edab
cmp r13d, 0x10000
jae 0x40edf4
xor esi, esi
jmp 0x40edbc
mov si, 1
mov r14d, eax
mov dword [rsp + 0x98], 0
mov r13d, 0xfffd
mov eax, r13d
shr eax, 0xc
or al, 0xe0
mov byte [rsp + 0x98], al
mov eax, r13d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x99], al
and r13b, 0x3f
or r13b, 0x80
mov byte [rsp + 0x9a], r13b
mov r13d, 3
jmp 0x40ee40
mov rcx, rax
shr rcx, 0x22
or cl, 0xf0
mov byte [rsp + 0x98], cl
mov rcx, rax
shr rcx, 0x1c
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x99], cl
shr rax, 0x16
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x9a], al
and r13b, 0x3f
or r13b, 0x80
mov byte [rsp + 0x9b], r13b
mov r13d, 4
xor esi, esi
mov rax, qword [rsp + 0x68]
mov rcx, rax
sub rcx, r12
cmp rcx, r13
jae 0x40ec20
mov rbx, r12
add rbx, r13
jb 0x40f662
lea rbp, [rax + rax]
cmp rbp, rbx
cmovbe rbp, rbx
cmp rbp, 9
mov ecx, 8
cmovb rbp, rcx
mov r8, rbp
not r8
shr r8, 0x3f
test rax, rax
je 0x40eea3
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0xe0], rcx
mov qword [rsp + 0xe8], rax
mov eax, 1
jmp 0x40eea5
xor eax, eax
mov qword [rsp + 0xf0], rax
lea rcx, [rsp + 0x80]
mov rdx, rbp
lea r9, [rsp + 0xe0]
call fcn.004fef2d
cmp qword [rsp + 0x80], 0
mov rcx, qword [rsp + 0x88]
je 0x40eef8
mov rdx, qword [rsp + 0x90]
movabs rax, 0x8000000000000001
cmp rdx, rax
je 0x40ec24
jmp 0x40f659
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbp
jmp 0x40ec24
mov rdx, qword [rsp + 0x70]
inc r12
mov rcx, qword [rsp + 0xd0]
mov rbp, qword [rsp + 0xc8]
nop
cmp r12, 1
je 0x40f528
lea rbx, [r12 - 1]
cmp byte [rdx + r12 - 2], 0
mov r12, rbx
je 0x40ef20
mov qword [rsp + 0x78], rbx
cmp byte [rsp + 0x44], 7
jne 0x40f53a
mov qword [rsp + 0x20], 1
lea r9, [0x00562ef1]
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x148], rdx
mov r8, rbx
call fcn.0042c5b0
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x150], rax
mov r13, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xe8]
mov r9, qword [rsp + 0x108]
movzx eax, byte [rsp + 0x118]
mov dword [rsp + 0x54], eax
mov r15, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x160], rax
movzx eax, byte [rsp + 0x11a]
mov byte [rsp + 0x37], al
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x60], rax
mov eax, 1
mov qword [rsp + 0x48], rax
mov r11, qword [rsp + 0x128]
xor eax, eax
mov qword [rsp + 0x58], rax
xor edi, edi
xor eax, eax
jmp 0x40f029
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x48], rcx
mov r11, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov byte [rax + rdi], 0xa
inc rdi
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xb0], rdi
cmp qword [rsp + 0x150], 0
mov qword [rsp + 0x38], r9
je 0x40f1b0
mov rax, qword [rsp + 0x118]
mov r8, rbp
mov qword [rsp + 0xb8], rax
sub r8, rax
neg r9
mov r10, qword [rsp + 0x60]
mov r12, r11
jmp 0x40f07f
mov r12, r11
cmp qword [rsp + 0x60], 0xffffffffffffffff
jne 0x40f179
lea rax, [r12 + rbp]
dec rax
cmp rax, rsi
jae 0x40f550
lea r11, [r12 + rbp]
movzx eax, byte [r13 + rax]
mov rcx, qword [rsp + 0x160]
bt rcx, rax
jae 0x40f070
mov rdx, r11
mov rax, qword [rsp + 0x38]
cmp rax, r10
mov rcx, r10
cmova rcx, rax
cmp qword [rsp + 0x60], 0xffffffffffffffff
cmove rcx, rax
lea rax, [r12 + r13]
mov r11, rcx
nop word [rax + rax]
cmp r11, rbp
jae 0x40f110
lea rdi, [r12 + r11]
cmp rdi, rsi
jae 0x40f713
lea rdi, [r11 + 1]
movzx r14d, byte [r15 + r11]
cmp r14b, byte [rax + r11]
mov r11, rdi
je 0x40f0d0
mov r11, r12
add r11, r9
lea r12, [r11 + rdi]
cmp qword [rsp + 0x60], 0xffffffffffffffff
je 0x40f07f
jmp 0x40f181
cmp qword [rsp + 0x60], 0xffffffffffffffff
mov r11, r10
mov eax, 0
cmove r11, rax
mov rcx, qword [rsp + 0x38]
nop word [rax + rax]
cmp r11, rcx
jae 0x40f190
dec rcx
cmp rcx, rbp
jae 0x40f726
lea rax, [rcx + r12]
cmp rax, rsi
jae 0x40f737
movzx edi, byte [r15 + rcx]
cmp dil, byte [r13 + rax]
je 0x40f130
add r12, qword [rsp + 0xb8]
cmp qword [rsp + 0x60], 0xffffffffffffffff
je 0x40f07f
mov r10, r8
mov r11, r12
jmp 0x40f06b
xor r10d, r10d
jmp 0x40f06b
add r11, rdi
xor r10d, r10d
jmp 0x40f06b
cmp qword [rsp + 0x60], 0xffffffffffffffff
mov eax, 0
cmovne r10, rax
mov qword [rsp + 0x60], r10
mov r11, rdx
jmp 0x40f290
cmp byte [rsp + 0x37], 0
jne 0x40f550
mov r12, qword [rsp + 0x38]
test r12, r12
je 0x40f1dd
cmp rsi, r12
jbe 0x40f1d7
cmp byte [r13 + r12], 0xc0
jge 0x40f1dd
jmp 0x40f761
jne 0x40f761
cmp r12, rsi
mov r9d, dword [rsp + 0x54]
jne 0x40f210
mov eax, r9d
xor al, 1
mov byte [rsp + 0x118], al
mov qword [rsp + 0x38], rsi
mov r12, rsi
mov rdx, rsi
test r9b, r9b
mov dword [rsp + 0x54], eax
jne 0x40f290
jmp 0x40f550
movzx ecx, byte [r13 + r12]
test cl, cl
js 0x40f21e
mov eax, ecx
jmp 0x40f26c
mov eax, ecx
and eax, 0x1f
movzx r8d, byte [r13 + r12 + 1]
and r8d, 0x3f
cmp cl, 0xe0
jb 0x40f25f
movzx edx, byte [r13 + r12 + 2]
shl r8d, 6
and edx, 0x3f
or edx, r8d
cmp cl, 0xf0
jb 0x40f267
movzx ecx, byte [r13 + r12 + 3]
and eax, 7
shl eax, 0x12
shl edx, 6
and ecx, 0x3f
or ecx, edx
or eax, ecx
jmp 0x40f26c
shl eax, 6
or eax, r8d
jmp 0x40f26c
shl eax, 0xc
or eax, edx
test r9b, r9b
je 0x40f498
xor r9b, 1
mov dword [rsp + 0x54], r9d
mov byte [rsp + 0x118], r9b
mov qword [rsp + 0x38], r12
mov rdx, r12
nop
mov rax, qword [rsp + 0x148]
mov r9, qword [rsp + 0xc0]
add r9, rax
add r12, rax
sub r12, r9
mov rcx, qword [rsp + 0x58]
mov rax, rcx
mov r8, qword [rsp + 0xb0]
sub rax, r8
cmp rax, r12
mov qword [rsp + 0xb8], r11
mov qword [rsp + 0x158], rdx
jae 0x40f330
mov rdi, r8
add rdi, r12
jb 0x40f662
lea r14, [rcx + rcx]
cmp r14, rdi
cmovbe r14, rdi
cmp r14, 9
mov eax, 8
cmovb r14, rax
mov r8, r14
not r8
shr r8, 0x3f
test rcx, rcx
mov qword [rsp + 0xc0], r9
je 0x40f339
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rcx
mov eax, 1
jmp 0x40f33b
lea rdi, [r8 + r12]
jmp 0x40f3c0
xor eax, eax
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x98]
mov rdx, r14
lea r9, [rsp + 0x80]
call fcn.004fef2d
cmp qword [rsp + 0x98], 0
mov rcx, qword [rsp + 0xa0]
je 0x40f39a
mov rdx, qword [rsp + 0xa8]
movabs rax, 0x8000000000000001
cmp rdx, rax
mov r8, qword [rsp + 0xb0]
mov r9, qword [rsp + 0xc0]
je 0x40f3c0
jmp 0x40f659
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x48], rcx
mov r8, qword [rsp + 0xb0]
mov r9, qword [rsp + 0xc0]
nop word cs:[rax + rax]
add r8, qword [rsp + 0x48]
mov rcx, r8
mov rdx, r9
mov r8, r12
call sub.msvcrt.dll_memcpy
cmp qword [rsp + 0x58], rdi
jne 0x40f008
mov r14, rdi
inc r14
je 0x40f662
lea rax, [rdi + rdi]
cmp rax, r14
cmova r14, rax
cmp r14, 9
mov eax, 8
cmovb r14, rax
mov r8, r14
not r8
shr r8, 0x3f
test rdi, rdi
je 0x40f42d
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rdi
mov eax, 1
jmp 0x40f42f
xor eax, eax
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x98]
mov rdx, r14
lea r9, [rsp + 0x80]
call fcn.004fef2d
cmp qword [rsp + 0x98], 0
mov rcx, qword [rsp + 0xa0]
je 0x40effe
mov rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x58], rdi
movabs rax, 0x8000000000000001
cmp rdx, rax
mov r11, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x38]
je 0x40f015
jmp 0x40f659
cmp eax, 0x110000
je 0x40f550
mov r12d, 1
cmp eax, 0x80
jb 0x40f4cc
mov r12d, 2
cmp eax, 0x800
jb 0x40f4cc
cmp eax, 0x10000
mov r12d, 4
sbb r12, 0
add r12, qword [rsp + 0x38]
je 0x40f4eb
cmp rsi, r12
jbe 0x40f4e5
cmp byte [r13 + r12], 0xbf
jg 0x40f4eb
jmp 0x40f75c
jne 0x40f75c
cmp r12, rsi
jne 0x40f510
mov byte [rsp + 0x118], 0
mov dword [rsp + 0x54], 0
mov qword [rsp + 0x38], rsi
mov r12, rsi
mov rdx, rsi
jmp 0x40f290
movzx eax, byte [r13 + r12]
mov r9b, 1
test al, al
jns 0x40f275
cmp al, 0xe0
jmp 0x40f275
xor ebx, ebx
mov qword [rsp + 0x78], rbx
cmp byte [rsp + 0x44], 7
je 0x40ef4a
mov rax, qword [rsp + 0x78]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rcx], xmm0
jmp 0x40f6bf
mov rax, qword [rsp + 0x148]
mov r9, qword [rsp + 0xc0]
add r9, rax
add rbx, rax
sub rbx, r9
mov rcx, qword [rsp + 0x58]
mov rax, rcx
mov r8, qword [rsp + 0xb0]
sub rax, r8
cmp rax, rbx
jae 0x40f5ea
mov rdi, r8
add rdi, rbx
mov r14, qword [rsp + 0xd0]
mov rbp, qword [rsp + 0xc8]
jb 0x40f662
lea rax, [rcx + rcx]
cmp rax, rdi
cmovbe rax, rdi
cmp rax, 9
mov esi, 8
cmovae rsi, rax
mov r8, rsi
not r8
shr r8, 0x3f
mov r15, r9
test rcx, rcx
je 0x40f600
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], rcx
mov qword [rsp + 0xf0], 1
jmp 0x40f60c
lea rdi, [r8 + rbx]
mov r14, qword [rsp + 0xd0]
mov rbp, qword [rsp + 0xc8]
jmp 0x40f67e
mov qword [rsp + 0xf0], 0
lea rcx, [rsp + 0x80]
lea r9, [rsp + 0xe0]
mov rdx, rsi
call fcn.004fef2d
cmp qword [rsp + 0x80], 0
mov rcx, qword [rsp + 0x88]
je 0x40f669
mov rdx, qword [rsp + 0x90]
movabs rax, 0x8000000000000001
cmp rdx, rax
mov r8, qword [rsp + 0xb0]
mov r9, r15
je 0x40f67e
test rdx, rdx
jne 0x40f755
call fcn.00403940
ud2
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x48], rcx
mov r8, qword [rsp + 0xb0]
mov r9, r15
mov rsi, qword [rsp + 0x48]
add r8, rsi
mov rcx, r8
mov rdx, r9
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x58]
mov qword [r14], rax
mov qword [r14 + 8], rsi
mov qword [r14 + 0x10], rdi
cmp qword [rsp + 0x68], 0
je 0x40f6bf
mov r8, qword [rsp + 0x70]
mov rcx, qword [0x00576170]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rdx, qword [rsp + 0xd8]
mov ecx, dword [rsp + 0x44]
cmp cl, 0xc
je 0x40ebc7
test rdx, rdx
je 0x40ebc7
mov rax, rdx
and rax, 0xfffffffffffffffe
mov ecx, edx
and ecx, 1
or rdx, 0xfffffffffffffffe
inc rdx
imul rdx, rax
or rdx, rcx
je 0x40ebc7
mov rcx, qword [0x00576170]
xor edx, edx
mov r8, rbp
call sub.kernel32.dll_HeapFree
jmp 0x40ebc7
add rcx, r12
cmp rsi, rcx
cmova rcx, rsi
lea r8, str._repos_rust_1.70.0_library_core_src_str_pattern.rs
jmp 0x40f741
lea r8, str._repos_rust_1.70.0_library_core_src_str_pattern.rs
mov rdx, rbp
call fcn.0042f150
ud2
lea r8, str._repos_rust_1.70.0_library_core_src_str_pattern.rs
mov rcx, rax
mov rdx, rsi
call fcn.0042f150
ud2
mov ecx, 0x800
mov edx, 1
call fcn.004043b0
ud2
mov qword [rsp + 0x38], r12
lea rax, str._repos_rust_1.70.0_library_core_src_str_pattern.rs
mov qword [rsp + 0x20], rax
mov rcx, r13
mov rdx, rsi
mov r8, qword [rsp + 0x38]
mov r9, rsi
call fcn.0042eb10
ud2