Function at 0x180022bf0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
lea rax, [0x18011764f]
mov qword [rsp + 0x38], rax
lea rax, [0x18011767b]
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x38]
call sym._ZN98__LT_alloc..vec..Vec_LT_T_GT__u20_as_u20_alloc..vec..spec_from_iter..SpecFromIter_LT_T_C_I_GT__GT_9from_iter17h4ca29c1cb4
add rsi, rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x48], 0
mov dword [rsp + 0x50], 1
lea rcx, [rsp + 0x88]
lea rdi, [rsp + 0x38]
mov rdx, rdi
call sym._ZN98__LT_alloc..vec..Vec_LT_T_GT__u20_as_u20_alloc..vec..spec_from_iter..SpecFromIter_LT_T_C_I_GT__GT_9from_iter17h4ca29c1cb4
mov rsi, qword [rsp + 0xa8]
call sym._ZN100__LT_windows..Win32..Storage..FileSystem..CLFS_MGMT_POLICY_0_9_u20_as_u20_core..default..Default_GT_7default17hf7f2443bf
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rdi
mov rcx, 0xffffffff80000002
mov rdx, rsi
xor r8d, r8d
mov r9d, 0x20019
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x180022cdd
movabs rax, 0x8000000000000000
mov qword [rbx], rax
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x180022ebd
mov rcx, qword [rsp + 0x90]
add rdx, rdx
mov r8d, 2
jmp 0x180022eb8
mov rdi, qword [rsp + 0x38]
mov dword [rsp + 0x34], 0x800
mov rax, qword [0x180143fe8]
movzx eax, byte [rax]
mov ecx, 0x800
mov edx, 1
call sym.__rust_alloc
test rax, rax
je 0x180022f42
mov r15, rax
mov qword [rsp + 0x70], 0x800
mov qword [rsp + 0x78], rax
mov r14, qword [rsp + 0x90]
mov dword [rsp + 0x58], 0
lea r12, [rsp + 0x34]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x180022e27
lea r13, [rsp + 0x58]
lea rbp, [rsp + 0x70]
jmp 0x180022da0
mov r15, qword [rsp + 0x78]
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
mov r9, r13
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x180022e27
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call sym._ZN108__LT_windows_result..error..Error_u20_as_u20_core..convert..From_LT_windows_result..hresult..HRESULT_GT__GT_4from17h6940
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], edx
mov qword [rsp + 0x38], 1
cmp edx, 0x800700ea
jne 0x180022ef0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x800700ea
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x80], rdx
mov r8d, dword [rsp + 0x34]
test r8, r8
je 0x180022e11
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rbp
call sym.alloc::raw_vec::RawVecInner_A_::reserve::do_reserve_and_handle::h6014465d3eb0841c
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x180022d70
mov rcx, r13
call sym.__windows_result::com::ComPtr_as_core::ops::drop::Drop_::drop::hb30c31d5e4e46df2
jmp 0x180022d70
mov eax, dword [rsp + 0x34]
and eax, 0xfffffffe
add rax, r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x38]
call sym._ZN95__LT_alloc..string..String_u20_as_u20_core..iter..traits..collect..FromIterator_LT_char_GT__GT_9from_iter17h03a2b4eea48ee
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x180022e6c
mov rcx, qword [rsp + 0x60]
cmp byte [rcx + rax - 1], 0
jne 0x180022e6e
dec rax
jne 0x180022e60
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbx], xmm0
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x180022e97
mov r8d, 1
mov rcx, r15
call sym.__rust_dealloc
mov rcx, rdi
call fcn.18010259c
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x180022ebd
add rdx, rdx
mov r8d, 2
mov rcx, r14
call sym.__rust_dealloc
mov rdx, qword [rsp + 0xa0]
test rdx, rdx
je 0x180022edb
add rdx, rdx
mov r8d, 2
mov rcx, rsi
call sym.__rust_dealloc
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs rcx, 0x8000000000000000
mov qword [rbx], rcx
test rax, rax
je 0x180022f0c
lea rcx, [rsp + 0x40]
call sym.__windows_result::com::ComPtr_as_core::ops::drop::Drop_::drop::hb30c31d5e4e46df2
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x180022f24
mov r8d, 1
mov rcx, r15
call sym.__rust_dealloc
mov rcx, rdi
call fcn.18010259c
mov rdx, qword [rsp + 0x88]
test rdx, rdx
jne 0x180022cc7
jmp 0x180022ebd
mov ecx, 1
mov edx, 0x800
call sym.alloc::raw_vec::handle_error::hcf880acc1984e8dc
ud2