Function at 0x140060300
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r14
push r15
lea rbp, [rsp - 0x560]
sub rsp, 0x660
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rbp + 0x550], rax
mov r14, rcx
lea rcx, [rsp + 0x42]
xor ebx, ebx
xor edx, edx
mov r8d, 0x1fe
mov word [rsp + 0x40], bx
call fcn.1400a8b00
lea rcx, [rbp + 0x142]
xor edx, edx
mov r8d, 0x1fe
mov word [rbp + 0x140], bx
call fcn.1400a8b00
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU
mov rcx, 0xffffffff80000001
mov r15d, ebx
mov dword [rsp + 0x30], 0x41
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400605f1
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea rdx, str.MRUList
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x688], rsi
mov dword [rsp + 0x34], 0x200
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x690], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x40]
mov edx, 0x100
call fcn.1400aa140
or rdi, 0xffffffffffffffff
mov esi, ebx
mov rax, rdi
lea rcx, [rsp + 0x40]
nop
inc rax
cmp word [rcx + rax*2], bx
jne 0x1400603f0
test eax, eax
jle 0x1400604c1
nop dword [rax]
nop word [rax + rax]
movsxd rax, esi
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x208
movzx ecx, word [rsp + rax*2 + 0x40]
mov eax, 0x7a
sub eax, ecx
mov word [rsp + 0x30], cx
mov ecx, ebx
cmp eax, 1
lea rax, [rsp + 0x34]
setg cl
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x340]
or r15d, ecx
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400604a2
lea edx, [rax + 0x5c]
lea rcx, [rbp + 0x340]
call fcn.1400a9910
test rax, rax
je 0x14006048f
lea rcx, [rbp + 0x340]
mov edx, 0x5c
call fcn.1400a9910
mov word [rax], bx
lea rdx, [rbp + 0x340]
mov rcx, r14
call fcn.1400a9bbc
test eax, eax
je 0x1400604f6
inc esi
lea rcx, [rsp + 0x40]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x1400604b0
cmp esi, eax
jl 0x140060410
lea r8, [rsp + 0x40]
lea rcx, [rbp + 0x142]
mov edx, 0xff
call fcn.1400a97ac
mov word [rbp + 0x174], bx
nop
bt r15d, ebx
jae 0x140060506
inc ebx
cmp ebx, 0x1a
jl 0x1400604e0
movzx eax, word [rbp + 0x140]
jmp 0x140060509
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400605e1
lea eax, [rbx + 0x61]
cmp ebx, 0x1a
mov rbx, rdi
cmove ax, word [rsp + 0x72]
mov word [rbp + 0x140], ax
mov word [rsp + 0x30], ax
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x140060521
add rbx, 3
lea rcx, [rbx + rbx]
call fcn.1400a82f0
lea r8, str._s1
mov r9, r14
mov rcx, rax
mov rdx, rbx
mov rsi, rax
call fcn.1400aa928
mov rcx, rdi
cmp word [rsi + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140060554
lea eax, [rcx*2 + 2]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rax, [rbp + 0x140]
cmp word [rax + rdi*2 + 2], 0
lea rdi, [rdi + 1]
jne 0x140060590
mov rcx, qword [rsp + 0x38]
lea eax, [rdi*2 + 2]
lea rdx, str.MRUList
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x140]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.1400a82b0
mov rsi, qword [rsp + 0x688]
mov rdi, qword [rsp + 0x690]
mov rcx, qword [rbp + 0x550]
xor rcx, rsp
call fcn.1400ab140
mov rbx, qword [rsp + 0x698]
add rsp, 0x660
pop r15
pop r14
pop rbp
ret