Function at 0x140022f34
Capabilities:
Get file size
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov dword [rsp + 0x20], r9d
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, rdx
mov r15d, r8d
xor edx, edx
mov r14, rcx
mov edi, 0x8007000e
call fcn.140026f28
xor r12d, r12d
test rax, rax
je 0x140022f83
mov r8, rbp
lea rdx, str.FilesFile
mov rcx, rax
call fcn.14001bb20
mov rbx, rax
jmp 0x140022f86
mov rbx, r12
test rbp, rbp
jne 0x140022fa9
test rbx, rbx
je 0x140022f9f
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, 0x80004003
jmp 0x14002321d
test rbx, rbx
je 0x14002321b
or rsi, 0xffffffffffffffff
mov rax, rsi
inc rax
cmp word [rbp + rax*2], r12w
jne 0x140022fb9
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test r15d, r15d
lea rdi, [0x14004e5cc]
lea rcx, [0x14004e1e0]
mov rax, rsi
cmove rcx, rdi
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140023006
lea eax, [rax*2 + 2]
mov rdx, rbx
mov dword [rsp + 0x30], eax
lea r8, [0x14004de10]
mov qword [rsp + 0x28], rcx
mov ecx, dword [r14 + 0x14]
call fcn.14001cb9c
mov rax, rsi
inc rax
cmp word [rdi + rax*2], r12w
jne 0x140023036
mov ecx, dword [r14 + 0x14]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x30], eax
lea r8, str.InProc
mov rdx, rbx
mov qword [rsp + 0x28], rdi
call fcn.14001cb9c
mov rcx, rbp
call fcn.14001ab20
test eax, eax
je 0x140023209
mov ecx, 0x82
call fcn.1400014a0
mov rdi, rax
test rax, rax
je 0x140023209
mov qword [rsp + 0x30], r12
mov r8d, 3
mov dword [rsp + 0x28], 0x8000080
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r8d
mov rcx, rbp
mov dword [rsp + 0x78], r12d
mov dword [rsp + 0x88], r12d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov r14, rax
mov r15d, 0x41
cmp rax, rsi
je 0x140023173
lea rdx, [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
nop dword [rax + rax]
mov dword [rsp + 0x78], eax
cmp eax, 0xffffffff
je 0x140023164
mov r9d, dword [rsp + 0x88]
mov edx, r15d
mov rcx, rdi
test r9d, r9d
je 0x140023119
lea r8, str._lu_lu
mov dword [rsp + 0x20], eax
call fcn.140010e44
jmp 0x140023128
mov r9d, eax
lea r8, [0x14004b360]
call fcn.140010e44
mov rax, rsi
inc rax
cmp word [rdi + rax*2], r12w
jne 0x14002312b
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rdx, str.Size
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
lea r8, [rsp + 0x78]
mov rcx, rbp
lea rdx, [rsp + 0x88]
call fcn.14001aeb8
test eax, eax
js 0x140023201
mov r8d, dword [rsp + 0x78]
mov rdx, r15
mov r9d, dword [rsp + 0x88]
movzx ecx, r8w
mov dword [rsp + 0x30], ecx
mov rcx, rdi
shr r8d, 0x10
mov dword [rsp + 0x28], r8d
lea r8, str._lu._lu._lu._lu
movzx eax, r9w
shr r9d, 0x10
mov dword [rsp + 0x20], eax
call fcn.140010e44
inc rsi
cmp word [rdi + rsi*2], r12w
jne 0x1400231c8
lea eax, [rsi*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rdx, [0x140048c28]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, rdi
call fcn.140001454
mov rcx, rbx
mov edi, r12d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, edi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret