Function at 0x18000cca0
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub rsp, 0x248
mov rax, qword [0x180028020]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp qword [0x18002aa90], 0
jne 0x18000cfe2
mov qword [rsp + 0x240], rdi
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.180010bb0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18000cd48
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.18001a434
test eax, eax
jne 0x18000cd48
xor eax, eax
lea rdi, [rsp + 0x20]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str.winhttp.dll]
mov qword [rdi - 2], rax
mov rax, qword [0x1800236f0]
mov qword [rdi + 6], rax
mov rax, qword [0x1800236f8]
mov qword [rdi + 0xe], rax
movzx eax, word [0x180023700]
mov word [rdi + 0x16], ax
jmp 0x18000cd62
lea rdx, str.C:WindowsSystem32winhttp.dll
nop
movzx eax, word [rdi + rdx]
add rdi, 2
mov word [rsp + rdi + 0x1e], ax
test ax, ax
jne 0x18000cd50
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, qword [rsp + 0x240]
mov qword [0x18002aa90], rax
test rax, rax
jne 0x18000cd8a
or ecx, 0xffffffff
call fcn.18000f730
int3
lea rdx, str.WinHttpOpen
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002aa90]
lea rdx, str.WinHttpSetTimeouts
mov qword [0x18002aa98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002aa90]
lea rdx, str.WinHttpConnect
mov qword [0x18002aaa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002aa90]
lea rdx, str.WinHttpOpenRequest
mov qword [0x18002aaa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002aa90]
lea rdx, str.WinHttpCrackUrl
mov qword [0x18002aab0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002aa90]
lea rdx, str.WinHttpSetOption
mov qword [0x18002aab8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002aa90]
lea rdx, str.WinHttpAddRequestHeaders
mov qword [0x18002aac0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002aa90]
lea rdx, str.WinHttpSendRequest
mov qword [0x18002aac8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002aa90]
lea rdx, str.WinHttpReceiveResponse
mov qword [0x18002aad0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002aa90]
lea rdx, str.WinHttpQueryDataAvailable
mov qword [0x18002aad8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002aa90]
lea rdx, str.WinHttpWriteData
mov qword [0x18002aae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002aa90]
lea rdx, str.WinHttpReadData
mov qword [0x18002aae8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002aa90]
lea rdx, str.WinHttpQueryHeaders
mov qword [0x18002aaf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002aa90]
lea rdx, str.WinHttpCloseHandle
mov qword [0x18002aaf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002aa90]
lea rdx, str.WinHttpGetProxyForUrl
mov qword [0x18002ab00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002aa90]
lea rdx, str.WinHttpGetIEProxyConfigForCurrentUser
mov qword [0x18002ab08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x18002aa98], 0
mov qword [0x18002aa80], rax
je 0x18000cfd9
cmp qword [0x18002aaa8], 0
je 0x18000cfd9
cmp qword [0x18002aab0], 0
je 0x18000cfd9
cmp qword [0x18002aab8], 0
je 0x18000cfd9
cmp qword [0x18002aac0], 0
je 0x18000cfd9
cmp qword [0x18002aac8], 0
je 0x18000cfd9
cmp qword [0x18002ab00], 0
je 0x18000cfd9
cmp qword [0x18002aad0], 0
je 0x18000cfd9
cmp qword [0x18002aad8], 0
je 0x18000cfd9
cmp qword [0x18002aae0], 0
je 0x18000cfd9
cmp qword [0x18002aae8], 0
je 0x18000cfd9
cmp qword [0x18002aaf0], 0
je 0x18000cfd9
cmp qword [0x18002aaf8], 0
je 0x18000cfd9
cmp qword [0x18002aaa0], 0
je 0x18000cfd9
cmp qword [0x18002ab08], 0
je 0x18000cfd9
test rax, rax
jne 0x18000cfe2
or ecx, 0xffffffff
call fcn.18000f730
int3
lea rax, [0x18002ab10]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18000e750
add rsp, 0x248
ret