Function at 0x180017290
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
push rbp
sub rsp, 0x68
mov qword [rax + 0x10], rsi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x20], r12
lea rcx, [rax - 0x48]
mov qword [rax - 0x30], r14
mov rbx, rdx
call fcn.180015ed0
test eax, eax
je 0x1800172c8
mov qword [rsp + 0x30], 0
jmp 0x18001731a
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18001731a
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
lea rdx, [rsp + 0x90]
mov ecx, 0xf003f
mov qword [rsp + 0x90], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov rdx, qword [rsp + 0x90]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x1002
xor ebp, ebp
xor esi, esi
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
xor r12d, r12d
mov r14, rax
mov dword [rsp + 0x90], r12d
test rax, rax
je 0x180017351
mov r12d, 0x1000
mov word [rax + 0x1000], si
mov dword [rsp + 0x90], r12d
mov rax, qword [0x18002a8f0]
test rax, rax
jne 0x180017394
mov rax, qword [0x18002a8b8]
test rax, rax
jne 0x18001737d
lea rcx, str.wininet
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18002a8b8], rax
lea rdx, str.InternetSetOptionA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002a8f0], rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x5f]
call rax
mov rax, qword [0x18002a8f0]
test rax, rax
jne 0x1800173e5
mov rax, qword [0x18002a8b8]
test rax, rax
jne 0x1800173ce
lea rcx, str.wininet
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18002a8b8], rax
lea rdx, str.InternetSetOptionA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002a8f0], rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x27]
call rax
mov rax, qword [0x18002a8f0]
test rax, rax
jne 0x180017436
mov rax, qword [0x18002a8b8]
test rax, rax
jne 0x18001741f
lea rcx, str.wininet
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18002a8b8], rax
lea rdx, str.InternetSetOptionA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002a8f0], rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x25]
call rax
mov rax, qword [0x18002a8d8]
test rax, rax
jne 0x180017487
mov rax, qword [0x18002a8b8]
test rax, rax
jne 0x180017470
lea rcx, str.wininet
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18002a8b8], rax
lea rdx, str.InternetOpenA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002a8d8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call rax
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1800174b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1800176ae
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x40], r15
call fcn.180017b80
mov r15, rax
test rax, rax
jne 0x1800174d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180017661
mov qword [rsp + 0x50], r13
nop dword [rax + rax]
mov rax, qword [0x18002a8e8]
test rax, rax
jne 0x180017523
mov rax, qword [0x18002a8b8]
test rax, rax
jne 0x18001750c
lea rcx, str.wininet
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18002a8b8], rax
lea rdx, str.InternetReadFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002a8e8], rax
lea r9, [rsp + 0x98]
mov r8d, r12d
mov rdx, r14
mov rcx, r15
call rax
test eax, eax
je 0x180017607
movsxd r12, dword [rsp + 0x98]
test r12d, r12d
je 0x1800175f2
lea eax, [rsi + 2]
movsxd rcx, eax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
xor r13d, r13d
mov rdi, rax
test rax, rax
je 0x180017572
movsxd rdx, esi
mov r13d, esi
mov word [rdx + rax], 0
movsxd r8, esi
mov rdx, rbp
mov rcx, rax
call fcn.18001ca04
lea ebx, [r12 + rsi]
test rbp, rbp
je 0x180017592
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
lea eax, [rbx + 2]
movsxd rcx, eax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
xor esi, esi
mov rbp, rax
test rax, rax
je 0x1800175d3
movsxd rax, ebx
mov esi, ebx
movsxd rbx, r13d
mov rdx, rdi
mov rcx, rbp
mov r8, rbx
mov word [rax + rbp], 0
call fcn.18001ca04
lea rcx, [rbx + rbp]
mov r8, r12
mov rdx, r14
call fcn.18001ca04
mov r12d, dword [rsp + 0x90]
test rdi, rdi
je 0x1800174e0
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
jmp 0x1800174e0
mov rcx, qword [rsp + 0x80]
mov r8d, esi
mov rdx, rbp
call fcn.180017720
jmp 0x18001760d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13, qword [rsp + 0x50]
mov ebx, eax
mov rax, qword [0x18002a8f8]
test rax, rax
jne 0x180017657
mov rax, qword [0x18002a8b8]
test rax, rax
jne 0x180017640
lea rcx, str.wininet
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18002a8b8], rax
lea rdx, str.InternetCloseHandle
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002a8f8], rax
mov rcx, r15
call rax
mov rdi, qword [rsp + 0x38]
mov rax, qword [0x18002a8f8]
mov r15, qword [rsp + 0x40]
test rax, rax
jne 0x1800176a9
mov rax, qword [0x18002a8b8]
test rax, rax
jne 0x180017692
lea rcx, str.wininet
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18002a8b8], rax
lea rdx, str.InternetCloseHandle
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002a8f8], rax
mov rcx, rdi
call rax
cmp qword [rsp + 0x30], 0
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x88]
je 0x1800176e8
xor edx, edx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x1800176f6
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov r14, qword [rsp + 0x48]
test rbp, rbp
je 0x180017709
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, ebx
add rsp, 0x68
pop rbp
pop rbx
ret