Function at 0x140011c04
Capabilities:
Query or enumerate registry value
Read http header
Receive http response

Disassembly:
mov rax, rsp
push rbp
push r12
push r14
lea rbp, [rax - 0x1c8]
sub rsp, 0x2b0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14002d670]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rsi, rcx
xor r14d, r14d
mov edi, r14d
mov dword [rsp + 0x48], r14d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea ebx, [r14 + 2]
mov r9d, ebx
lea r8, str.ETag
mov rdx, qword [rcx + 0x20]
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov r12d, 0x80070000
test eax, eax
je 0x140011c93
movzx edi, ax
or edi, r12d
test eax, eax
cmovle edi, eax
mov eax, dword [rsp + 0x48]
add eax, 0x1e
test edi, edi
js 0x140011cab
mov ecx, 0x800700ea
cmp eax, 0x208
cmovae edi, ecx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], r14
test edi, edi
js 0x140011d1f
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.14000f4e4
mov edi, eax
test eax, eax
js 0x140011d1f
mov ecx, dword [rsp + 0x60]
mov dword [rsp + 0x48], ecx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r14
mov r9d, ebx
lea r8, str.ETag
mov rdx, qword [rsi + 0x20]
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
je 0x140011d1f
movzx edi, ax
or edi, r12d
test eax, eax
cmovle edi, eax
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x58], 4
test edi, edi
jns 0x140011d3e
lea rdx, str.Failed_to_get_E_Tag
mov ecx, edi
call fcn.140008768
mov ebx, r14d
test edi, edi
cmovns ebx, edi
lea rdx, [rbp - 0x70]
cmovs rdx, r14
test ebx, ebx
js 0x140011f39
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
or r8d, 0xffffffff
mov rcx, qword [rsi + 0x88]
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x140011d98
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, r12d
test eax, eax
cmovle ecx, eax
mov ebx, 0x80004005
test ecx, ecx
cmovs ebx, ecx
test ebx, ebx
js 0x140011f39
mov rcx, rsi
call fcn.140012628
mov ebx, eax
test eax, eax
js 0x140011f39
xor edx, edx
mov rcx, qword [rsi + 0x88]
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x140011de0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, r12d
test eax, eax
cmovle ecx, eax
mov ebx, 0x80004005
test ecx, ecx
cmovs ebx, ecx
test ebx, ebx
js 0x140011f39
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x20000013
mov rcx, qword [rsi + 0x88]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x140011e30
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, r12d
test eax, eax
cmovle ecx, eax
mov ebx, 0x80004005
test ecx, ecx
cmovs ebx, ecx
test ebx, ebx
js 0x140011f39
mov edi, 0xc8
cmp dword [rsp + 0x40], edi
jne 0x140011f15
movdqa xmm0, xmmword [0x1400241f0]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], r14b
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.1400118cc
mov ebx, eax
test eax, eax
js 0x140011f09
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rdx, qword [rsp + 0x70]
mov rcx, rsi
call fcn.140012354
mov ebx, eax
test eax, eax
js 0x140011f09
lea rdx, str.Saving_settings_cache_to_registry
mov ecx, eax
call fcn.140008980
mov rcx, rsi
call fcn.140012fdc
mov ebx, eax
test eax, eax
js 0x140011f09
cmp dword [rsp + 0x40], edi
je 0x140011eba
cmp dword [rsp + 0x40], 0x130
jne 0x140011f09
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
lea r8, [rsi + 0x90]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.140011f68
mov ebx, eax
test eax, eax
js 0x140011ef2
mov rdx, qword [rsp + 0x48]
mov rcx, rsi
call fcn.140012228
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop
lea rcx, [rsp + 0x70]
call fcn.1400094e4
jmp 0x140011f39
cmp dword [rsp + 0x40], 0x130
jne 0x140011f34
lea rdx, str.ETag_not_modified
mov ecx, ebx
call fcn.140008980
mov ebx, 1
jmp 0x140011f39
mov ebx, 0x80004005
mov eax, ebx
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140018830
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rbp
ret