Function at 0x1400117c4
Capabilities:
Query or enumerate registry value
Read http header
Receive http response

Disassembly:
mov rax, rsp
push rbp
push r12
push r14
lea rbp, [rax - 0x1c8]
sub rsp, 0x2b0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14002a370]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rsi, rcx
xor r14d, r14d
mov edi, r14d
mov dword [rsp + 0x48], r14d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea ebx, [r14 + 2]
mov r9d, ebx
lea r8, str.ETag
mov rdx, qword [rcx + 0x20]
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov r12d, 0x80070000
test eax, eax
je 0x140011853
movzx edi, ax
or edi, r12d
test eax, eax
cmovle edi, eax
mov eax, dword [rsp + 0x48]
add eax, 0x1e
test edi, edi
js 0x14001186b
mov ecx, 0x800700ea
cmp eax, 0x208
cmovae edi, ecx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], r14
test edi, edi
js 0x1400118df
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.14000f264
mov edi, eax
test eax, eax
js 0x1400118df
mov ecx, dword [rsp + 0x60]
mov dword [rsp + 0x48], ecx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r14
mov r9d, ebx
lea r8, str.ETag
mov rdx, qword [rsi + 0x20]
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
je 0x1400118df
movzx edi, ax
or edi, r12d
test eax, eax
cmovle edi, eax
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x58], 4
test edi, edi
jns 0x1400118fe
lea rdx, str.Failed_to_get_E_Tag
mov ecx, edi
call fcn.1400088b0
mov ebx, r14d
test edi, edi
cmovns ebx, edi
lea rdx, [rbp - 0x70]
cmovs rdx, r14
test ebx, ebx
js 0x140011af9
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
or r8d, 0xffffffff
mov rcx, qword [rsi + 0x88]
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x140011958
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, r12d
test eax, eax
cmovle ecx, eax
mov ebx, 0x80004005
test ecx, ecx
cmovs ebx, ecx
test ebx, ebx
js 0x140011af9
mov rcx, rsi
call fcn.1400122a8
mov ebx, eax
test eax, eax
js 0x140011af9
xor edx, edx
mov rcx, qword [rsi + 0x88]
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x1400119a0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, r12d
test eax, eax
cmovle ecx, eax
mov ebx, 0x80004005
test ecx, ecx
cmovs ebx, ecx
test ebx, ebx
js 0x140011af9
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x20000013
mov rcx, qword [rsi + 0x88]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x1400119f0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, r12d
test eax, eax
cmovle ecx, eax
mov ebx, 0x80004005
test ecx, ecx
cmovs ebx, ecx
test ebx, ebx
js 0x140011af9
mov edi, 0xc8
cmp dword [rsp + 0x40], edi
jne 0x140011ad5
movdqa xmm0, xmmword [0x140022b90]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], r14b
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.14001148c
mov ebx, eax
test eax, eax
js 0x140011ac9
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rdx, qword [rsp + 0x70]
mov rcx, rsi
call fcn.140011f14
mov ebx, eax
test eax, eax
js 0x140011ac9
lea rdx, str.Saving_settings_cache_to_registry
mov ecx, eax
call fcn.140008ad0
mov rcx, rsi
call fcn.140012c5c
mov ebx, eax
test eax, eax
js 0x140011ac9
cmp dword [rsp + 0x40], edi
je 0x140011a7a
cmp dword [rsp + 0x40], 0x130
jne 0x140011ac9
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
lea r8, [rsi + 0x90]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.140011b28
mov ebx, eax
test eax, eax
js 0x140011ab2
mov rdx, qword [rsp + 0x48]
mov rcx, rsi
call fcn.140011de8
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop
lea rcx, [rsp + 0x70]
call fcn.1400097d4
jmp 0x140011af9
cmp dword [rsp + 0x40], 0x130
jne 0x140011af4
lea rdx, str.ETag_not_modified
mov ecx, ebx
call fcn.140008ad0
mov ebx, 1
jmp 0x140011af9
mov ebx, 0x80004005
mov eax, ebx
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140018010
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rbp
ret