Function at 0x1400117c4
Capabilities:
Get common file path
Get thread local storage value
Query or enumerate registry value
Set registry value
Set thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3d8]
sub rsp, 0x4b0
mov rax, qword [0x14003d0d8]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov r12, rcx
mov ecx, dword [0x14003d17c]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
or ebx, 0xffffffff
xor r13d, r13d
mov rsi, rax
test rax, rax
jne 0x140011835
mov ebx, dword [0x14003d17c]
lea rdx, [rsp + 0x68]
mov ecx, ebx
mov dword [rsp + 0x68], r13d
lea rsi, [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
inc dword [rsi]
mov r10, qword [0x14003d048]
lea rax, [0x14003d048]
lea r14, [0x140035650]
mov r15d, 0x1df
cmp r10, rax
je 0x140011891
test byte [r10 + 0x1c], 1
je 0x140011891
mov eax, dword [rsi]
lea ecx, [rax + rax*4]
cmp ecx, 0x1e1
ja 0x140011875
mov eax, ecx
mov ecx, r15d
sub rcx, rax
jmp 0x140011878
mov rcx, r13
lea r9, [rcx + r14]
mov edx, Ordinal_20
mov rcx, qword [r10 + 0x10]
lea r8, [0x140036400]
call fcn.1400012b0
lea r9, [rsp + 0x60]
mov qword [rsp + 0x60], r13
xor r8d, r8d
mov qword [r12], r13
mov edx, 0x8000
lea rcx, [0x140036f68]
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetKnownFolderPath]
mov edi, eax
test eax, eax
js 0x140011aa0
mov rcx, qword [0x14003d810]
lea r8, [rbp + 0x190]
mov r9d, 0x104
mov edx, 0xbbb
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x140011907
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
test edi, edi
js 0x140011aa0
lea rax, [rsp + 0x58]
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x30], rax
lea r8, str.NextShareFolder
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionProximity
mov r9d, Ordinal_20
mov qword [rsp + 0x20], r13
mov rcx, 0xffffffff80000001
mov r14d, r13d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov eax, dword [rsp + 0x50]
lea rdx, [rsp + 0x58]
mov r8d, eax
mov qword [rsp + 0x58], r13
inc eax
lea rcx, [rbp + 0x190]
mov dword [rsp + 0x50], eax
call fcn.14000d4cc
mov edi, eax
test eax, eax
js 0x1400119b9
mov rax, qword [rsp + 0x58]
lea r8, [0x140036378]
mov r9, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.1400104f0
mov edi, eax
test eax, eax
js 0x1400119b9
xor r8d, r8d
lea rdx, [rbp - 0x80]
xor ecx, ecx
call qword [sym.imp.api_ms_win_shell_shdirectory_l1_1_0.dll_Ordinal_290]
mov r14d, eax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], r13
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
test edi, edi
js 0x140011a17
cmp r14d, 0x50
je 0x140011954
cmp r14d, 0xb7
je 0x140011954
movzx edi, r14w
or edi, 0x80070000
test r14d, r14d
cmovle edi, r14d
test edi, edi
js 0x140011a17
lea rax, [rbp - 0x80]
or r9, 0xffffffffffffffff
inc r9
cmp word [rax + r9*2], r13w
jne 0x1400119fd
lea r8, [rbp - 0x80]
mov qword [rsp + 0x28], r12
call fcn.140013498
mov edi, eax
mov eax, dword [rsp + 0x50]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionProximity
mov qword [rsp + 0x40], r13
mov r14, 0xffffffff80000001
mov dword [rsp + 0x58], eax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, r14
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r13d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
jne 0x140011a99
mov rcx, qword [rsp + 0x70]
lea r9d, [rax + 4]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.NextShareFolder
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
cmp rcx, r14
je 0x140011a99
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea r14, [0x140035650]
mov rcx, qword [0x14003d048]
lea rax, [0x14003d048]
cmp rcx, rax
je 0x140011aed
test byte [rcx + 0x1c], 1
je 0x140011aed
mov eax, dword [rsi]
lea edx, [rax + rax*4]
cmp edx, 0x1e1
ja 0x140011acd
mov eax, edx
sub r15, rax
jmp 0x140011ad0
mov r15, r13
mov rcx, qword [rcx + 0x10]
lea r9, [r15 + r14]
mov edx, Ordinal_20
mov dword [rsp + 0x20], edi
lea r8, [0x140036400]
call fcn.140001304
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], r13
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
dec dword [rsi]
cmp ebx, 0xffffffff
je 0x140011b1b
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
test rax, rax
je 0x140011b1b
xor edx, edx
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
mov eax, edi
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1400304d0
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret