Function at 0x1800224f0
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x11a8
call fcn.18002c7f0
sub rsp, rax
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x180066180]
xor rax, rbp
mov qword [rbp + 0x1160], rax
mov rdi, r8
mov qword [rbp + 0x10], r8
mov r13, rdx
mov qword [rbp + 0x18], rdx
mov r12, rcx
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x38], r9
xor r15d, r15d
mov word [rbp], r15w
lea rdx, [rbp + 0x160]
call fcn.180022360
test eax, eax
js 0x180022a85
lea rdx, [rbp]
lea rcx, [rbp + 0x160]
call fcn.1800221c0
test eax, eax
jne 0x180022583
mov eax, 0x80020009
jmp 0x180022a85
movabs rbx, 0x100002600
nop dword [rax]
mov rcx, qword [r12]
movzx eax, byte [rcx]
cmp al, 0x20
ja 0x1800225ad
bt rbx, rax
jae 0x1800225ad
call qword [sym.imp.USER32.dll_CharNextA]
mov qword [r12], rax
jmp 0x180022590
lea rdx, [rbp + 0x160]
mov rcx, r12
call fcn.180022360
test eax, eax
js 0x180022a85
movzx eax, word [rbp]
cmp eax, 8
je 0x180022a22
cmp eax, 0x11
je 0x1800228ca
cmp eax, 0x13
je 0x180022772
cmp eax, 0x4008
jne 0x180022a70
lea rcx, [rbp + 0x160]
or rsi, 0xffffffffffffffff
mov rax, rsi
nop dword [rax]
inc rax
cmp byte [rcx + rax], r15b
jne 0x180022600
add eax, 2
mov qword [rbp + 0x50], r15
movsxd rcx, eax
test eax, eax
je 0x18002264a
xor edx, edx
mov rax, rsi
div rcx
cmp rax, 1
jb 0x180022640
cmp rcx, 0x100
jbe 0x18002264a
mov rdx, rcx
lea rcx, [rbp + 0x50]
call fcn.180025a00
mov rbx, qword [rbp + 0x50]
jmp 0x180022652
mov ecx, 0x80070216
call fcn.180002bd0
lea rbx, [rbp + 0x58]
mov qword [rbp + 0x50], rbx
mov r14, qword [rbp + 0x10]
jmp 0x18002266f
test rbx, rbx
je 0x180022752
lea rdi, [rbp + 0x160]
cmp byte [rbp + 0x160], 0
je 0x1800226e3
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharNextA]
movzx ecx, byte [rdi]
cmp cl, 0x5c
jne 0x1800226ba
cmp byte [rax], 0x30
jne 0x1800226ba
mov byte [rbx], 0
inc rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextA]
mov rdi, rax
jmp 0x1800226de
mov byte [rbx], cl
movzx ecx, byte [rdi]
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x1800226d8
inc rbx
inc rdi
movzx eax, byte [rdi]
test al, al
je 0x1800226e3
mov byte [rbx], al
inc rbx
inc rdi
cmp byte [rdi], 0
jne 0x180022690
mov word [rbx], 0
mov eax, r15d
mov rbx, qword [rbp + 0x50]
test rbx, rbx
setne al
test eax, eax
jne 0x1800226fe
lea edi, [rax + 0xd]
jmp 0x180022757
mov r9d, r15d
mov r8, rbx
nop word [rax + rax]
mov rcx, rsi
inc rcx
cmp byte [r8 + rcx], 0
jne 0x180022713
inc ecx
mov eax, ecx
add r8, rax
add r9d, ecx
cmp ecx, 1
jne 0x180022710
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rbx
lea r9d, [rcx + 6]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [r13]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
mov rbx, qword [rbp + 0x50]
jmp 0x180022757
mov edi, 0xe
lea rax, [rbp + 0x58]
cmp rbx, rax
je 0x180022a63
lea rcx, [rbp + 0x50]
call fcn.1800259f0
jmp 0x180022a63
mov rbx, r15
mov qword [rbp + 0x18], rbx
lea rcx, [rbp + 0x160]
or rsi, 0xffffffffffffffff
mov rax, rsi
inc rax
cmp byte [rcx + rax], 0
jne 0x180022787
inc eax
movsxd r14, eax
add r14, r14
mov eax, 0x80000000
add rax, r14
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x1800228a1
cmp r14d, 0x400
jg 0x1800227ec
movsxd rdi, r14d
mov rcx, rdi
call fcn.180020ce0
test al, al
je 0x1800227ec
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x1800227d9
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.18002c7f0
sub rsp, rax
lea rcx, [rsp + 0x30]
jmp 0x180022819
movsxd rdi, r14d
sub rsi, rdi
cmp rsi, 0x10
jb 0x180022896
lea rcx, [rdi + 0x10]
call fcn.18002accc
test rax, rax
jne 0x18002280f
mov rcx, r15
jmp 0x180022819
mov qword [rax], r15
mov rbx, rax
lea rcx, [rax + 0x10]
shr rdi, 1
mov r9d, 3
mov r8d, edi
lea rdx, [rbp + 0x160]
call fcn.180020d70
test rax, rax
je 0x1800228a1
lea r9, [rbp]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov eax, dword [rbp]
mov dword [rbp + 8], eax
mov dword [rsp + 0x28], 4
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rbp + 0x10]
mov rcx, qword [r13]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
test rbx, rbx
je 0x180022a63
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.180029a40
test rbx, rbx
jne 0x180022881
jmp 0x180022a63
mov ecx, 0x80070216
call fcn.180002bd0
nop
test rbx, rbx
je 0x1800228c0
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.180029a40
test rbx, rbx
jne 0x1800228b0
mov eax, 0x8007000e
jmp 0x180022a85
lea rax, [rbp + 0x160]
or rsi, 0xffffffffffffffff
mov rbx, rsi
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], r15b
jne 0x1800228e0
mov dword [rbp + 8], ebx
test bl, 1
jne 0x180022984
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
movsxd r14, eax
mov dword [rbp], r14d
mov qword [rbp + 0x50], r15
mov rcx, r14
test eax, eax
je 0x180022941
xor edx, edx
mov rax, rsi
div rcx
cmp rax, 1
jb 0x180022937
cmp rcx, 0x100
jbe 0x180022941
mov rdx, rcx
lea rcx, [rbp + 0x50]
call fcn.180025a00
mov rcx, qword [rbp + 0x50]
jmp 0x180022949
mov ecx, 0x80070216
call fcn.180002bd0
lea rcx, [rbp + 0x58]
mov qword [rbp + 0x50], rcx
jmp 0x18002296d
test rcx, rcx
jne 0x18002298e
lea rax, [rbp + 0x58]
test rax, rax
je 0x180022984
lea rcx, [rbp + 0x50]
call fcn.1800259f0
mov eax, 0x80004005
jmp 0x180022a85
movsxd r8, r14d
xor edx, edx
call fcn.18002c930
mov edi, r15d
mov rsi, r15
movsxd r13, ebx
test ebx, ebx
jle 0x1800229e3
mov eax, edi
cdq
sub eax, edx
sar eax, 1
movsxd rbx, eax
add rbx, qword [rbp + 0x50]
movzx ecx, byte [rbp + rsi + 0x160]
call fcn.1800222d0
movzx edx, al
mov ecx, edi
and ecx, 1
shl ecx, 2
mov eax, 4
sub eax, ecx
movzx ecx, al
shl dl, cl
or byte [rbx], dl
inc edi
inc rsi
cmp rsi, r13
jl 0x1800229a5
mov dword [rsp + 0x28], r14d
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x18]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
lea rax, [rbp + 0x58]
cmp qword [rbp + 0x50], rax
je 0x180022a63
lea rcx, [rbp + 0x50]
call fcn.1800259f0
jmp 0x180022a63
lea rax, [rbp + 0x160]
or rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp byte [rax + rsi], r15b
jne 0x180022a30
inc esi
mov dword [rsp + 0x28], esi
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r13]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
test edi, edi
je 0x180022a70
mov ecx, edi
call fcn.180020e70
jmp 0x180022a85
mov rdx, qword [rbp + 0x38]
mov rcx, r12
call fcn.180022360
test eax, eax
cmovs r15d, eax
mov eax, r15d
mov rcx, qword [rbp + 0x1160]
xor rcx, rbp
call fcn.1800289d0
lea rsp, [rbp + 0x1178]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret