Function at 0x14008a300
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r14
push r15
lea rbp, [rsp - 0x560]
sub rsp, 0x660
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rbp + 0x550], rax
mov r14, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call fcn.1400e36c0
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x200
call fcn.1400e36c0
xor ebx, ebx
mov dword [rsp + 0x30], 0x41
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU
mov r15d, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14008a5e1
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.MRUList
lea rax, [rsp + 0x40]
mov qword [rsp + 0x688], rsi
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x690], rdi
mov dword [rsp + 0x34], 0x200
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, 0x100
lea rcx, [rsp + 0x40]
call fcn.1400e8fb8
mov rdi, 0xffffffffffffffff
lea rcx, [rsp + 0x40]
mov rax, rdi
mov esi, ebx
inc rax
cmp word [rcx + rax*2], bx
jne 0x14008a3e5
test eax, eax
jle 0x14008a4b1
nop word [rax + rax]
movsxd rax, esi
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x208
movzx ecx, word [rsp + rax*2 + 0x40]
mov eax, 0x7a
sub eax, ecx
mov word [rsp + 0x30], cx
cmp eax, 1
mov ecx, ebx
lea rax, [rsp + 0x34]
setg cl
mov qword [rsp + 0x28], rax
or r15d, ecx
lea rax, [rbp + 0x340]
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008a492
lea edx, [rax + 0x5c]
lea rcx, [rbp + 0x340]
call fcn.1400e3c28
test rax, rax
je 0x14008a47f
mov edx, 0x5c
lea rcx, [rbp + 0x340]
call fcn.1400e3c28
mov word [rax], bx
lea rdx, [rbp + 0x340]
mov rcx, r14
call fcn.1400e89f4
test eax, eax
je 0x14008a4e6
inc esi
lea rcx, [rsp + 0x40]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x14008a4a0
cmp esi, eax
jl 0x14008a400
lea r8, [rsp + 0x40]
mov edx, 0xff
lea rcx, [rbp + 0x142]
call fcn.1400e86e4
mov word [rbp + 0x174], bx
nop
bt r15d, ebx
jae 0x14008a4f6
inc ebx
cmp ebx, 0x1a
jl 0x14008a4d0
movzx eax, word [rbp + 0x140]
jmp 0x14008a4f9
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14008a5d1
lea eax, [rbx + 0x61]
cmp ebx, 0x1a
mov rbx, rdi
cmove ax, word [rsp + 0x72]
mov word [rbp + 0x140], ax
mov word [rsp + 0x30], ax
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x14008a511
add rbx, 3
lea rcx, [rbx + rbx]
call fcn.1400e8270
mov r9, r14
lea r8, str._s1
mov rdx, rbx
mov rcx, rax
mov rsi, rax
call fcn.1400192b0
mov rcx, rdi
cmp word [rsi + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14008a544
lea eax, [rcx*2 + 2]
mov r9d, 1
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rax, [rbp + 0x140]
cmp word [rax + rdi*2 + 2], 0
lea rdi, [rdi + 1]
jne 0x14008a580
mov rcx, qword [rsp + 0x38]
lea eax, [rdi*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.MRUList
lea rax, [rbp + 0x140]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.1400e825c
mov rsi, qword [rsp + 0x688]
mov rdi, qword [rsp + 0x690]
mov rcx, qword [rbp + 0x550]
xor rcx, rsp
call fcn.1400e17a0
mov rbx, qword [rsp + 0x698]
add rsp, 0x660
pop r15
pop r14
pop rbp
ret