Function at 0x1400b55b0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov rax, r8
mov r14, rdx
mov rsi, rcx
lea rcx, [rsp + 0xb8]
mov r8d, 0xb
mov rdx, rax
call fcn.1400a9070
mov dword [rsp + 0x5c], 0
mov dword [rsp + 0x3c], 0
mov rbx, qword [rsp + 0xc0]
lea rbp, [rsp + 0x3c]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x5c]
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
call sub.advapi32.dll_RegQueryValueExW
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
je 0x1400b5664
mov qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
cmp qword [rsp + 0xb8], 0
je 0x1400b584a
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rbx
jmp 0x1400b5845
mov eax, dword [rsp + 0x5c]
dec eax
cmp eax, 0xa
ja case.0x1400b5681.5
lea rcx, [0x140146890]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov r12d, dword [rsp + 0x3c]
mov edi, 2
cmp r12, 2
jb 0x1400b56ba
mov r15d, r12d
and r15d, 0xfffffffe
movzx eax, byte [0x1401aa178]
mov ecx, 8
mov rdx, r15
call fcn.14011ab20
test rax, rax
je 0x1400b5dd2
mov rdi, rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call sub.advapi32.dll_RegQueryValueExW
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
je 0x1400b58f8
mov qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
cmp r12d, 2
jb 0x1400b5643
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
jmp 0x1400b5643
mov edi, dword [rsp + 0x3c]
test rdi, rdi
je 0x1400b59de
movzx eax, byte [0x1401aa178]
mov ecx, 8
mov rdx, rdi
call fcn.14011ab20
mov r15, rax
mov r12, rdi
test rax, rax
jne 0x1400b59e7
lea r8, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001fwindows_registry_0.2.0_srckey.rs
mov ecx, 1
mov rdx, rdi
call fcn.140006e11
cmp dword [rsp + 0x3c], 8
jne case.0x1400b5681.5
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x28], rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call sub.advapi32.dll_RegQueryValueExW
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jne 0x1400b5632
mov rax, qword [rsp + 0x40]
mov dword [rsi], 1
mov qword [rsi + 8], rax
jmp 0x1400b5825
cmp dword [rsp + 0x3c], 4
jne case.0x1400b5681.5
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x28], rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call sub.advapi32.dll_RegQueryValueExW
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jne 0x1400b5632
mov eax, dword [rsp + 0x40]
mov dword [rsi], 0
mov dword [rsi + 4], eax
jmp 0x1400b5825
mov qword [rsi + 8], 0
mov dword [rsi + 0x10], 0x8007000d
mov dword [rsi], 6
cmp qword [rsp + 0xb8], 0
je 0x1400b584a
mov rsi, qword [rsp + 0xc0]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
nop
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, dword [rsp + 0x3c]
mov r12d, 2
cmp rdi, 2
jb 0x1400b5896
mov r15d, edi
and r15d, 0xfffffffe
movzx eax, byte [0x1401aa178]
mov ecx, 8
mov rdx, r15
call fcn.14011ab20
test rax, rax
je 0x1400b5de6
mov r12, rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r12
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call sub.advapi32.dll_RegQueryValueExW
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
je 0x1400b5a49
mov qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
cmp edi, 2
jb 0x1400b5643
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.kernel32.dll_HeapFree
jmp 0x1400b5643
mov eax, r12d
shr eax, 1
inc rax
cmp rax, 1
je 0x1400b5917
lea rcx, [rax - 1]
cmp word [rdi + rax*2 - 4], 0
mov rax, rcx
je 0x1400b5900
jmp 0x1400b5919
xor ecx, ecx
lea rbx, [rdi + rcx*2]
lea rax, [rcx + rcx]
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 1
mov qword [rsp + 0xb0], 0
movabs r8, 0x7fffffffffffffff
and r8, rcx
shr rax, 2
sub r8, rax
jne 0x1400b5d8f
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0xa0]
call fcn.140089e20
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [rsp + 0x44], xmm0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x54], rax
mov dword [rsi], 2
movups xmm0, xmmword [rsp + 0x40]
mov rax, qword [rsp + 0x4c]
movups xmmword [rsi + 4], xmm0
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x54]
mov qword [rsi + 0x18], rax
cmp r12d, 2
jb 0x1400b5825
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
jmp 0x1400b5825
xor r12d, r12d
mov r15d, 1
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r15
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call sub.advapi32.dll_RegQueryValueExW
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
je 0x1400b5a97
mov qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
test r12, r12
je 0x1400b5643
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.kernel32.dll_HeapFree
jmp 0x1400b5643
mov ebp, edi
shr ebp, 1
lea rax, [rbp*2 + 2]
inc rbp
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rbp, 1
je 0x1400b5aae
lea rcx, [rax - 2]
dec rbp
cmp word [r12 + rax - 4], 0
mov rax, rcx
je 0x1400b5a60
xor eax, eax
cmp word [r12 + rax*2], 0
je 0x1400b5aba
inc rax
add rcx, 0xfffffffffffffffe
jne 0x1400b5a7b
mov r15b, 1
mov rdi, r12
mov rax, rbp
jmp 0x1400b5acc
mov dword [rsi], 3
mov qword [rsi + 8], r12
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdi
jmp 0x1400b5825
mov r15b, 1
xor ebp, ebp
mov rdi, r12
xor eax, eax
jmp 0x1400b5acc
lea rcx, [rax + 1]
sub rbp, rcx
lea rdi, [r12 + rax*2]
add rdi, 2
xor r15d, r15d
lea rbx, [r12 + rax*2]
lea rcx, [rax + rax]
mov qword [rsp + 0x60], 0
lea r14, [rsp + 0x68]
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], 0
movabs r8, 0x7fffffffffffffff
and r8, rax
shr rcx, 2
sub r8, rcx
jne 0x1400b5db2
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x60]
call fcn.140089e20
mov rbx, qword [rsp + 0x60]
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0xd0], xmm0
mov rax, rbx
neg rax
jno 0x1400b5b56
mov r13d, 8
xor ebx, ebx
xor edx, edx
jmp 0x1400b5d58
movzx eax, byte [0x1401aa178]
mov edx, 0x60
xor ecx, ecx
call fcn.14011ab20
test rax, rax
je 0x1400b5dfa
mov r13, rax
mov qword [rax], rbx
movaps xmm0, xmmword [rsp + 0xd0]
movups xmmword [rax + 8], xmm0
mov qword [rsp + 0x88], 4
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
test r15b, r15b
je 0x1400b5bb8
mov edx, 4
mov ebx, 1
jmp 0x1400b5d58
mov ebx, 1
test rbp, rbp
je 0x1400b5bf1
lea rcx, [rbp*2]
xor r8d, r8d
nop dword [rax]
cmp word [rdi + r8*2], 0
je 0x1400b5c1d
inc r8
add rcx, 0xfffffffffffffffe
jne 0x1400b5bd0
mov r14b, 1
mov qword [rsp + 0x80], rdi
mov r8, rbp
jmp 0x1400b5c37
lea r15, [rdi + rbp*2]
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], 0
mov r14b, 1
mov qword [rsp + 0x80], rdi
jmp 0x1400b5c5f
mov r14d, r15d
lea rcx, [r8 + 1]
sub rbp, rcx
lea rcx, [rdi + r8*2]
add rcx, 2
mov qword [rsp + 0x80], rcx
lea r15, [rdi + r8*2]
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], 0
test r8, r8
jne 0x1400b5d1f
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r15
mov word [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x60]
call fcn.140089e20
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xe0], xmm0
mov rdx, qword [rsp + 0x88]
movabs rax, 0x8000000000000000
cmp rdi, rax
je 0x1400b5d50
cmp rbx, rdx
mov r15d, r14d
je 0x1400b5ced
lea rcx, [rbx + rbx*2]
mov qword [r13 + rcx*8], rdi
movaps xmm0, xmmword [rsp + 0xe0]
movups xmmword [r13 + rcx*8 + 8], xmm0
inc rbx
mov qword [rsp + 0x98], rbx
mov rdi, qword [rsp + 0x80]
test r15b, 1
je 0x1400b5bbd
jmp 0x1400b5d48
mov al, 2
sub al, r15b
movzx r8d, al
mov qword [rsp + 0x20], 0x18
mov r9d, 8
lea rcx, [rsp + 0x88]
mov rdx, rbx
call fcn.1400370e0
mov r13, qword [rsp + 0x90]
jmp 0x1400b5cb7
mov rax, r8
shr rax, 1
sub r8, rax
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.1400370e0
jmp 0x1400b5c5f
mov rdx, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x78]
mov dword [rsi], 4
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], rbx
cmp ecx, 2
jb 0x1400b5825
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.kernel32.dll_HeapFree
jmp 0x1400b5825
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0xa0]
mov r9d, 1
xor edx, edx
call fcn.1400370e0
jmp 0x1400b595f
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x60]
mov r9d, 1
xor edx, edx
call fcn.1400370e0
jmp 0x1400b5b0e
lea r8, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001fwindows_registry_0.2.0_srckey.rs
mov ecx, 2
mov rdx, r15
call fcn.140006e11
lea r8, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001fwindows_registry_0.2.0_srckey.rs
mov ecx, 2
mov rdx, r15
call fcn.140006e11
lea r8, str.C:UsersUser.rustup_toolchains_nightly_x86_64_pc_windows_gnulib_rustlib_src_rustlibrarycore_srciter_traitsiterator.rs
mov ecx, 8
mov edx, 0x60
call fcn.140006e11
int3