Function at 0x1400aa6f0
Capabilities:
Query or enumerate registry value
Set environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov rbx, rcx
lea rcx, [rsp + 0x60]
mov rdi, rdx
call fcn.140063500
lea rcx, [rsp + 0x68]
call fcn.140063500
xor r13d, r13d
mov r11, 0xffffffff80000001
mov esi, r13d
mov dword [rsp + 0x100], r13d
lea rcx, [0x140000000]
cmp word [rdi], si
cmove rdi, r13
cmp word [rbx], si
sete r12b
mov qword [rsp + 0xf8], rdi
mov byte [rsp + 0xf0], r12b
test r12b, r12b
jne 0x1400aa818
lea r8d, [r13 + 5]
lea rcx, str.HKCU_
mov rdx, rbx
call fcn.14005c510
test al, al
je 0x1400aa792
mov rbp, qword [rsp + 0x60]
mov esi, 2
add rbx, 0xa
mov dword [rsp + 0x100], esi
jmp 0x1400aa839
lea rcx, str.HKEY_CURRENT_USER_
mov r8d, 0x13
mov rdx, rbx
call fcn.14005c510
test al, al
je 0x1400aa7c2
mov rbp, qword [rsp + 0x60]
mov esi, 2
add rbx, 0x24
mov dword [rsp + 0x100], esi
jmp 0x1400aa839
lea rcx, str.HKLM_
mov r8d, 5
mov rdx, rbx
call fcn.14005c510
test al, al
je 0x1400aa7e1
add rbx, 0xa
jmp 0x1400aa7fe
lea rcx, str.HKEY_LOCAL_MACHINE_
mov r8d, 0x13
mov rdx, rbx
call fcn.14005c510
test al, al
je 0x1400aa805
add rbx, 0x26
mov r11, 0xffffffff80000002
mov rbp, qword [rsp + 0x60]
mov esi, 2
mov dword [rsp + 0x100], esi
jmp 0x1400aa839
mov rbp, qword [rsp + 0x60]
cmp esi, 3
jae 0x1400aab76
movsxd rax, esi
mov r11, qword [rcx + rax*8 + 0x152e18]
mov rbx, qword [rcx + rax*8 + 0x152e00]
lea rax, [rsp + 0x78]
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov rcx, r11
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], r13d
mov dword [rsp + 0x108], r13d
mov dword [rsp + 0x74], r13d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400aab34
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
lea rax, [rsp + 0x74]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x108]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
test eax, eax
jne 0x1400aab49
mov edx, dword [rsp + 0x108]
lea rcx, [rsp + 0x98]
lea edx, [rdx*4 + 8]
call fcn.140063580
mov edx, dword [rsp + 0x74]
lea rcx, [rsp + 0x90]
lea edx, [rdx*4 + 8]
call fcn.140063580
cmp dword [rsp + 0x70], ebx
mov r15d, r13d
jle 0x1400aab03
mov rbx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
nop
mov eax, dword [rsp + 0x108]
lea r9, [rsp + 0x8c]
mov r8, rbx
shl eax, 2
mov edx, r15d
mov dword [rsp + 0x8c], eax
mov eax, dword [rsp + 0x74]
shl eax, 2
mov dword [rsp + 0x88], eax
lea rax, [rsp + 0x88]
mov word [rbx], r13w
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1400aaaf5
cmp word [rbx], ax
je 0x1400aaaf5
test rdi, rdi
je 0x1400aa9a2
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400aaaf5
mov eax, dword [rsp + 0x88]
lea rcx, str.PATH
mov rdx, rbx
shr eax, 1
mov r10, rsi
mov r14, rbx
mov word [rsi + rax*2], r13w
call fcn.14005c550
test al, al
je 0x1400aaa03
cmp word [rsi], 0
je 0x1400aa9f9
cmp word [rbp], 0
je 0x1400aa9e7
lea rdx, [0x140152df4]
lea rcx, [rsp + 0x60]
call fcn.140063600
lea rcx, [rsp + 0x60]
mov rdx, rsi
call fcn.140063600
mov rbp, qword [rsp + 0x60]
mov r10, rbp
lea r14, [0x140152de8]
lea r8, [rsp + 0x68]
lea rcx, [0x14019c170]
or r9d, 0xffffffff
mov rdx, r10
mov byte [rsp + 0x20], 0
call fcn.14006bc40
mov rdi, qword [rsp + 0x68]
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test r12b, r12b
je 0x1400aaaed
lea r12, str.Favorites
mov r13d, 8
nop word [rax + rax]
mov rcx, qword [r12]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400aaad6
lea rdx, [0x140152ddc]
lea rcx, [rsp + 0x80]
call fcn.140071240
mov rdx, qword [r12]
lea rcx, [rsp + 0x80]
call fcn.140063600
lea rdx, [0x140152d08]
lea rcx, [rsp + 0x80]
call fcn.140063600
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.140063600
mov rdx, qword [rsp + 0x80]
lea rcx, [0x14019c170]
xor r9d, r9d
xor r8d, r8d
mov byte [rsp + 0x20], 1
call fcn.140089700
lea rcx, [rsp + 0x80]
call fcn.14005b520
add r12, 0x10
sub r13, 1
jne 0x1400aaa50
movzx r12d, byte [rsp + 0xf0]
mov rdi, qword [rsp + 0xf8]
inc r15d
cmp r15d, dword [rsp + 0x70]
jl 0x1400aa920
lea rcx, [rsp + 0x90]
call fcn.14005b520
lea rcx, [rsp + 0x98]
call fcn.14005b520
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400aab2d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [rsp + 0x100]
inc esi
lea rcx, [0x140000000]
mov dword [rsp + 0x100], esi
jmp 0x1400aa81d
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400aab59
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x78], r13
call fcn.14005b520
lea rcx, [rsp + 0x60]
call fcn.14005b520
mov eax, ebx
jmp 0x1400aabd3
test rdi, rdi
je 0x1400aabbd
lea rcx, str.PATH
mov rdx, rdi
call fcn.14005c550
test al, al
je 0x1400aabbd
lea r8, [rsp + 0x68]
lea rcx, [0x14019c170]
or r9d, 0xffffffff
mov rdx, rbp
mov byte [rsp + 0x20], 0
call fcn.14006bc40
mov rdx, qword [rsp + 0x68]
lea rcx, [0x140152de8]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, [rsp + 0x68]
call fcn.14005b520
lea rcx, [rsp + 0x60]
call fcn.14005b520
xor eax, eax
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret