Function at 0x140022740
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
lea r13, [r8 + r9]
test r9, r9
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rcx
je 0x140022778
mov rbx, r8
movzx r9d, byte [r8]
movzx esi, r9b
test sil, sil
js 0x140022791
inc rbx
jmp 0x1400227f5
mov r12d, 4
mov r14d, 8
xor ebx, ebx
xor esi, esi
xor ebp, ebp
xor edi, edi
jmp 0x140022848
mov eax, esi
and eax, 0x1f
movzx r8d, byte [rbx + 1]
and r8d, 0x3f
cmp sil, 0xdf
jbe 0x1400227e9
movzx esi, byte [rbx + 2]
shl r8d, 6
and esi, 0x3f
or esi, r8d
cmp r9b, 0xf0
jb 0x140022ad4
movzx r8d, byte [rbx + 3]
add rbx, 4
and eax, 7
shl eax, 0x12
shl esi, 6
and r8d, 0x3f
or r8d, esi
or r8d, eax
mov esi, r8d
cmp esi, 0xffff
jbe 0x1400227f5
jmp 0x140022ae9
add rbx, 2
shl eax, 6
or eax, r8d
mov esi, eax
xor edi, edi
xor eax, eax
mov r9, r13
sub r9, rbx
add r9, 3
mov r8, 0xffffffffffffffff
cmovae r8, r9
shr r8, 2
add rax, r8
inc rax
cmp rax, 4
mov r12d, 3
cmovae r12, rax
lea r14, [r12*2 + 2]
movabs r8, 0x3ffffffffffffffe
cmp rax, r8
ja 0x140022b28
inc r12
mov bp, 1
movzx eax, byte [0x140090df8]
xor ecx, ecx
mov rdx, r14
call fcn.14004a280
test rax, rax
je 0x140022b16
mov r15, rax
mov word [rax], si
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 1
mov r14d, 1
jmp 0x1400228ae
xor eax, eax
mov esi, edi
cmp r14, qword [rsp + 0x30]
je 0x14002294c
mov edi, eax
mov word [r15 + r14*2], si
inc r14
mov qword [rsp + 0x40], r14
test rbx, rbx
je 0x1400228d0
test di, di
jne 0x140022890
cmp rbx, r13
je 0x1400228d0
movzx ecx, byte [rbx]
movzx esi, cl
test sil, sil
js 0x1400228f8
inc rbx
xor eax, eax
jmp 0x140022894
mov r12, qword [rsp + 0x30]
cmp bp, 1
jne 0x1400229e5
xor ebp, ebp
mov ebx, 0
mov esi, 0
mov r8d, 0
cmp r14, r12
jne 0x1400228a1
jmp 0x140022975
mov eax, esi
and eax, 0x1f
movzx edx, byte [rbx + 1]
and edx, 0x3f
cmp sil, 0xdf
jbe 0x14002299e
movzx esi, byte [rbx + 2]
shl edx, 6
and esi, 0x3f
or esi, edx
cmp cl, 0xf0
jb 0x1400229b0
movzx ecx, byte [rbx + 3]
add rbx, 4
and eax, 7
shl eax, 0x12
shl esi, 6
and ecx, 0x3f
or ecx, esi
or ecx, eax
mov esi, ecx
cmp esi, 0xffff
ja 0x1400229c1
xor eax, eax
jmp 0x140022894
mov r8, r13
sub r8, rbx
add r8, 3
mov rcx, 0xffffffffffffffff
cmovb r8, rcx
shr r8, 2
movzx ecx, bp
cmp ax, 1
sbb r8, 0xffffffffffffffff
add r8, rcx
mov edi, eax
inc r8
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x30]
mov rdx, r14
call fcn.14006ab80
mov r15, qword [rsp + 0x38]
jmp 0x1400228a1
add rbx, 2
shl eax, 6
or eax, edx
mov esi, eax
xor eax, eax
jmp 0x140022894
add rbx, 3
shl eax, 0xc
or esi, eax
cmp esi, 0xffff
jbe 0x140022945
lea ecx, [rsi + 0xff0000]
shr ecx, 0xa
or ecx, 0xd800
and esi, 0x3ff
or esi, 0xdc00
mov eax, esi
mov esi, ecx
jmp 0x140022894
add r14, r14
test r14, r14
js 0x140022b23
je 0x140022a12
movzx eax, byte [0x140090df8]
xor ecx, ecx
mov rdx, r14
call fcn.14004a280
test rax, rax
je 0x140022b32
mov rbx, rax
jmp 0x140022a17
mov ebx, 1
mov rcx, rbx
mov rdx, r15
mov r8, r14
call fcn.1400684b0
test r12, r12
je 0x140022a3c
mov rcx, qword [0x140090d88]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, qword [rsp + 0x48]
mov r15, qword [rax]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, qword [rsp + 0x50]
call fcn.1400205e0
mov rdi, qword [rsp + 0x38]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
mov rcx, r15
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.advapi32.dll_RegSetValueExW]
mov esi, eax
cmp qword [rsp + 0x30], 0
je 0x140022a99
mov rcx, qword [0x140090d88]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
test r14, r14
je 0x140022ab0
mov rcx, qword [0x140090d88]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, rsi
shl rcx, 0x20
or rcx, 2
xor eax, eax
test esi, esi
cmovne rax, rcx
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rbx, 3
shl eax, 0xc
or esi, eax
cmp esi, 0xffff
jbe 0x1400227f5
lea r8d, [rsi + 0xff0000]
shr r8d, 0xa
or r8d, 0xd800
and esi, 0x3ff
or esi, 0xdc00
mov eax, 1
mov edi, esi
mov esi, r8d
jmp 0x1400227f9
mov ecx, 2
mov rdx, r14
call fcn.140069052
call fcn.1400064f0
xor ecx, ecx
mov rdx, r14
call fcn.140069052
mov ecx, 1
mov rdx, r14
call fcn.140069052
int3