Function at 0x1400bdbf0
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x14035dc30]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, r8
mov rbx, rdx
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
mov rcx, qword [r8 + 8]
xor r15d, r15d
test rcx, rcx
je 0x1400bdc43
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 8], r15
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400bdc56
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x10], r15
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1400bdc69
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x18], r15
movzx edx, byte [0x1402bf900]
lea rcx, [rbp + 7]
call fcn.1400d31e0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], rax
lea rcx, [rbp + 0xf]
call fcn.1400d3680
cmp byte [rbp + 0x1f], 0
je 0x1400bdd5c
cmp byte [rbp + 0xf], 1
jne 0x1400bddef
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.1400d3220
mov r8d, dword [rbp - 0x39]
test r8d, r8d
je 0x1400bddef
mov rcx, qword [rbp - 0x31]
mov rax, qword [rcx]
lea rdx, [rbp - 0x79]
mov rax, qword [rax + 0x10]
call qword [case.0x1400ac8a1.0]
nop
lea rax, [rbp - 0x79]
cmp qword [rbp - 0x61], 0x10
cmovae rax, qword [rbp - 0x79]
mov qword [rsp + 0x28], rax
lea rax, str.Failed_to_impersonate_logged_on_user:__hs
mov qword [rsp + 0x20], rax
mov r9d, 0x1de
lea r8, str.XMLUpdater::v2::CUpdater::fill_proxy_data_for_specific_url
lea rdx, str.E:BT42dac55d_4355_4669_9ab8_31cc00ddc957WebAdvisor_XmlUpdater_srcXmlUpdaterxmlUpdater.cpp
mov ecx, 1
call fcn.1400bfe30
nop
mov rdx, qword [rbp - 0x61]
cmp rdx, 0x10
jb 0x1400bddef
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bddea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400be0e3
jmp 0x1400bddea
mov rcx, qword [rbp + 0x17]
mov rax, qword [rcx]
mov r8d, dword [rbp + 0xf]
lea rdx, [rbp - 0x79]
mov rax, qword [rax + 0x10]
call qword [case.0x1400ac8a1.0]
nop
lea rax, [rbp - 0x79]
cmp qword [rbp - 0x61], 0x10
cmovae rax, qword [rbp - 0x79]
mov qword [rsp + 0x28], rax
lea rax, str.Unable_to_determine_if_process_is_running_as_a_service:__hs
mov qword [rsp + 0x20], rax
mov r9d, 0x1e3
lea r8, str.XMLUpdater::v2::CUpdater::fill_proxy_data_for_specific_url
lea rdx, str.E:BT42dac55d_4355_4669_9ab8_31cc00ddc957WebAdvisor_XmlUpdater_srcXmlUpdaterxmlUpdater.cpp
mov ecx, 1
call fcn.1400bfe30
nop
mov rdx, qword [rbp - 0x61]
cmp rdx, 0x10
jb 0x1400bddef
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bddea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400be0dd
call fcn.140269844
lea rcx, [rbp - 0x19]
call qword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x1400bdebd
mov r14, qword [rbp - 9]
test r14, r14
je 0x1400bdf29
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400bde21
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x10], r15
mov rbx, 0xffffffffffffffff
test r14, r14
je 0x1400bde65
mov rsi, rbx
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x1400bde30
inc rsi
lea rdx, [rsi + rsi]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1400bdebd
mov r8, r14
mov rdx, rsi
mov rcx, rax
call fcn.140278ba4
test eax, eax
jne 0x1400bdebd
mov rsi, qword [rbp - 1]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1400bde7c
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x18], r15
test rsi, rsi
je 0x1400be0d6
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1400bde85
inc rbx
lea rdx, [rbx + rbx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x1400bdebd
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140278ba4
test eax, eax
je 0x1400be0d6
xor bl, bl
lea rcx, [rbp + 7]
call fcn.1400d31f0
nop
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x1400bdedc
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbp - 0x11], r15
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400bdeef
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbp - 9], r15
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x1400bdefe
call qword [sym.imp.KERNEL32.dll_GlobalFree]
movzx eax, bl
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140269300
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rax, qword [rbp - 0x11]
cmp dword [rbp - 0x19], 0
jne 0x1400bdf3c
test rax, rax
je 0x1400be0d6
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x35], xmm0
mov qword [rbp - 0x25], r15
test rax, rax
je 0x1400bdf5a
mov dword [rbp - 0x39], 2
mov qword [rbp - 0x31], rax
jmp 0x1400bdf68
mov dword [rbp - 0x39], 1
mov dword [rbp - 0x35], 3
mov dword [rbp - 0x1d], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, str.Temp
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rsi, rax
test rax, rax
je 0x1400bdebd
lea r12, vtable.XMLUpdater::v2::auto_proxy_info.0
mov qword [rbp - 0x59], r12
mov dword [rbp - 0x51], 1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x49], xmm0
lea r9, [rbp - 0x51]
lea r8, [rbp - 0x39]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test ebx, ebx
jne 0x1400be000
mov qword [rbp - 0x59], r12
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x1400bdfe8
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbp - 0x49], r15
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x1400bdebd
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1400bdebd
cmp dword [rbp - 0x51], 3
jne 0x1400be0b0
mov r14, qword [rbp - 0x49]
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400be021
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x10], r15
mov rbx, 0xffffffffffffffff
test r14, r14
je 0x1400be061
mov rsi, rbx
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x1400be030
inc rsi
lea rdx, [rsi + rsi]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1400be061
mov r8, r14
mov rdx, rsi
mov rcx, rax
call fcn.140278ba4
mov rsi, qword [rbp - 0x41]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1400be078
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x18], r15
test rsi, rsi
je 0x1400be0b0
nop dword [rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1400be080
inc rbx
lea rdx, [rbx + rbx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x1400be0b0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140278ba4
mov qword [rbp - 0x59], r12
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x1400be0c7
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbp - 0x49], r15
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x1400be0d6
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov bl, 1
jmp 0x1400bdebf
call fcn.140277ff8
int3
call fcn.140277ff8
int3