Function at 0x140004de0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x6d8
mov rsi, rcx
lea r8, str.Recent_file_list
lea rcx, [rsp + 0x38]
xor edx, edx
call sym.registry_get_handle
test rax, rax
jne 0x140005288
movabs rdi, 0x100000000
movabs rax, 0x20006400250026
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
mov dword [rsp + 0x34], 0x208
mov rcx, rsi
call qword [sym.imp.user32.dll_GetMenu]
mov rsi, rax
movabs rax, 0x16200000050
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x60], 0x3ed
xor ebx, ebx
mov rcx, rsi
mov edx, 0x3f1
xor r8d, r8d
call qword [sym.imp.user32.dll_RemoveMenu]
lea r15, [rsp + 0xa4]
mov r12, qword [sym.imp.user32.dll_wsprintfW]
lea r13, [rsp + 0x4d0]
lea rbp, [rsp + 0x2c0]
jmp 0x140004edc
mov rcx, rsi
mov edx, 0x3e8
xor r8d, r8d
lea r9, [rsp + 0x50]
call qword [sym.imp.user32.dll_InsertMenuItemW]
inc dword [rsp + 0x60]
mov dword [rsp + 0x34], 0x208
cmp rbx, 4
je 0x140005258
mov r14, rbx
inc rbx
mov rcx, r15
lea rdx, str.File_d
mov r8d, ebx
call r12
lea edx, [r14 + 0x3ed]
mov rcx, rsi
xor r8d, r8d
call qword [sym.imp.user32.dll_RemoveMenu]
lea rax, [0x14000f5a0]
mov r14, qword [rax + r14*8]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005258
mov qword [rsp + 0x80], r14
lea rcx, [rsp + 0xb0]
lea rdx, [rsp + 0x40]
mov r8d, ebx
call r12
xor eax, eax
nop dword [rax + rax]
movzx ecx, word [r14 + rax]
mov word [rsp + rax + 0x2c0], cx
add rax, 2
test cx, cx
jne 0x140004f60
mov qword [rsp + 0x20], r13
xor ecx, ecx
mov edx, 5
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.shell32.dll_SHGetFolderPathW]
mov rcx, rbp
call sym.file_basename
mov r14, rax
mov word [rax - 2], 0
mov rcx, rbp
mov rdx, r13
call qword [sym.imp.kernel32.dll_lstrcmpiW]
test eax, eax
je 0x140004fd3
xor eax, eax
nop word cs:[rax + rax]
cmp word [r14 + rax*2], 0
lea rax, [rax + 1]
jne 0x140004fc0
dec eax
cmp eax, 0x22
jl 0x140005020
mov word [r14 - 2], 0x5c
lea rax, [rsp + 0xae]
nop word cs:[rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140004ff0
xor ecx, ecx
nop dword [rax]
movzx edx, word [r14 + rcx]
mov word [rax + rcx], dx
add rcx, 2
test dx, dx
jne 0x140005000
jmp 0x140004eb0
mov word [r14 - 2], 0x5c
cmp r14, rbp
jbe 0x140005097
mov rax, rbp
xor ecx, ecx
jmp 0x140005049
add rax, 2
cmp rax, r14
jae 0x140005099
movzx edx, word [rax]
cmp edx, 0x5c
je 0x140005056
cmp edx, 0x2f
jne 0x140005040
movabs rdx, 0xffffffff00000000
mov r8, r14
test rcx, rcx
jne 0x14000518a
nop dword [rax]
add rdx, rdi
cmp word [r8], 0
lea r8, [r8 + 2]
jne 0x140005070
mov rcx, rax
sub rcx, rbp
sar rcx, 1
sar rdx, 0x20
add rdx, rcx
mov rcx, rax
cmp rdx, 0x21
jle 0x140005040
xor ecx, ecx
xor eax, eax
cmp rcx, r14
je 0x140004fda
cmp rcx, rax
je 0x140005149
test rax, rax
je 0x140005149
mov word [rcx + 2], 0
lea rcx, [rsp + 0xae]
nop word cs:[rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400050d0
xor edx, edx
nop dword [rax]
movzx r8d, word [rsp + rdx + 0x2c0]
mov word [rcx + rdx], r8w
add rdx, 2
test r8w, r8w
jne 0x1400050e0
lea rcx, [rsp + 0xb0]
cmp word [rcx], 0
lea rcx, [rcx + 2]
jne 0x140005100
movabs rdx, 0x2e002e002e
mov qword [rcx - 2], rdx
lea rcx, [rsp + 0xae]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140005120
xor edx, edx
nop dword [rax]
movzx r8d, word [rax + rdx]
mov word [rcx + rdx], r8w
add rdx, 2
test r8w, r8w
jne 0x140005130
jmp 0x140004eb0
lea rax, [rsp + 0xae]
nop word cs:[rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140005160
xor ecx, ecx
nop dword [rax]
movzx edx, word [rsp + rcx + 0x2c0]
mov word [rax + rcx], dx
add rcx, 2
test dx, dx
jne 0x140005170
jmp 0x140004eb0
movabs r9, 0xffffffff00000000
mov rdx, r14
nop word [rax + rax]
add r9, rdi
cmp word [rdx], 0
lea rdx, [rdx + 2]
jne 0x1400051a0
mov rdx, rax
sub rdx, rbp
sar rdx, 1
sar r9, 0x20
add r9, rdx
mov r8, rax
cmp r9, 0x22
cmovge r8, rcx
jge 0x140005099
cmp r14, rax
jae 0x1400051dd
mov rcx, rax
xor eax, eax
jmp 0x14000509b
mov rcx, r14
xor eax, eax
jmp 0x1400051ff
mov r9, rax
add rcx, 0xfffffffffffffffe
mov rax, r9
cmp rcx, r8
jb 0x14000524d
movzx r9d, word [rcx]
cmp r9d, 0x5c
je 0x14000520f
cmp r9d, 0x2f
jne 0x1400051f0
movabs r9, 0xffffffff00000000
mov r10, r14
nop dword [rax]
add r9, rdi
cmp word [r10], 0
lea r10, [r10 + 2]
jne 0x140005220
sar r9, 0x20
add r9, rdx
lea r10, [r14 + r9*2]
sub r10, rcx
mov r9, rcx
cmp r10, 0x42
jle 0x1400051f3
mov rcx, r8
jmp 0x14000509b
mov rcx, r8
mov rax, r9
jmp 0x14000509b
movabs rax, 0x80000000102
mov qword [rsp + 0x54], rax
lea r9, [rsp + 0x50]
mov rcx, rsi
mov edx, 0x3e8
xor r8d, r8d
call qword [sym.imp.user32.dll_InsertMenuItemW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.advapi32.dll_RegCloseKey]
nop
add rsp, 0x6d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret