Function at 0x1400d9fd0
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x14039bc30]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, r8
mov rbx, rdx
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
mov rcx, qword [r8 + 8]
xor r15d, r15d
test rcx, rcx
je 0x1400da023
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 8], r15
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400da036
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x10], r15
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1400da049
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x18], r15
movzx edx, byte [0x1402f04e0]
lea rcx, [rbp + 7]
call fcn.1400ee520
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], rax
lea rcx, [rbp + 0xf]
call fcn.1400ee9c0
cmp byte [rbp + 0x1f], 0
je 0x1400da13c
cmp byte [rbp + 0xf], 1
jne 0x1400da1cf
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.1400ee560
mov r8d, dword [rbp - 0x39]
test r8d, r8d
je 0x1400da1cf
mov rcx, qword [rbp - 0x31]
mov rax, qword [rcx]
lea rdx, [rbp - 0x79]
mov rax, qword [rax + 0x10]
call qword [case.0x1400c6d28.0]
nop
lea rax, [rbp - 0x79]
cmp qword [rbp - 0x61], 0x10
cmovae rax, qword [rbp - 0x79]
mov qword [rsp + 0x28], rax
lea rax, str.Failed_to_impersonate_logged_on_user:__hs
mov qword [rsp + 0x20], rax
mov r9d, 0x1de
lea r8, str.XMLUpdater::v2::CUpdater::fill_proxy_data_for_specific_url
lea rdx, str.E:BT71e4c9fa_1978_4386_a3da_49ea31fa22b7WebAdvisor_XmlUpdater_srcXmlUpdaterxmlUpdater.cpp
mov ecx, 1
call fcn.1400da630
nop
mov rdx, qword [rbp - 0x61]
cmp rdx, 0x10
jb 0x1400da1cf
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400da1ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400da4c3
jmp 0x1400da1ca
mov rcx, qword [rbp + 0x17]
mov rax, qword [rcx]
mov r8d, dword [rbp + 0xf]
lea rdx, [rbp - 0x79]
mov rax, qword [rax + 0x10]
call qword [case.0x1400c6d28.0]
nop
lea rax, [rbp - 0x79]
cmp qword [rbp - 0x61], 0x10
cmovae rax, qword [rbp - 0x79]
mov qword [rsp + 0x28], rax
lea rax, str.Unable_to_determine_if_process_is_running_as_a_service:__hs
mov qword [rsp + 0x20], rax
mov r9d, 0x1e3
lea r8, str.XMLUpdater::v2::CUpdater::fill_proxy_data_for_specific_url
lea rdx, str.E:BT71e4c9fa_1978_4386_a3da_49ea31fa22b7WebAdvisor_XmlUpdater_srcXmlUpdaterxmlUpdater.cpp
mov ecx, 1
call fcn.1400da630
nop
mov rdx, qword [rbp - 0x61]
cmp rdx, 0x10
jb 0x1400da1cf
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400da1ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400da4bd
call fcn.14013afa0
lea rcx, [rbp - 0x19]
call qword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x1400da29d
mov r14, qword [rbp - 9]
test r14, r14
je 0x1400da309
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400da201
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x10], r15
mov rbx, 0xffffffffffffffff
test r14, r14
je 0x1400da245
mov rsi, rbx
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x1400da210
inc rsi
lea rdx, [rsi + rsi]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1400da29d
mov r8, r14
mov rdx, rsi
mov rcx, rax
call fcn.14014a108
test eax, eax
jne 0x1400da29d
mov rsi, qword [rbp - 1]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1400da25c
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x18], r15
test rsi, rsi
je 0x1400da4b6
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1400da265
inc rbx
lea rdx, [rbx + rbx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x1400da29d
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14014a108
test eax, eax
je 0x1400da4b6
xor bl, bl
lea rcx, [rbp + 7]
call fcn.1400ee530
nop
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x1400da2bc
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbp - 0x11], r15
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400da2cf
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbp - 9], r15
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x1400da2de
call qword [sym.imp.KERNEL32.dll_GlobalFree]
movzx eax, bl
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14013af80
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rax, qword [rbp - 0x11]
cmp dword [rbp - 0x19], 0
jne 0x1400da31c
test rax, rax
je 0x1400da4b6
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x35], xmm0
mov qword [rbp - 0x25], r15
test rax, rax
je 0x1400da33a
mov dword [rbp - 0x39], 2
mov qword [rbp - 0x31], rax
jmp 0x1400da348
mov dword [rbp - 0x39], 1
mov dword [rbp - 0x35], 3
mov dword [rbp - 0x1d], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, str.Temp
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rsi, rax
test rax, rax
je 0x1400da29d
lea r12, vtable.XMLUpdater::v2::auto_proxy_info.0
mov qword [rbp - 0x59], r12
mov dword [rbp - 0x51], 1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x49], xmm0
lea r9, [rbp - 0x51]
lea r8, [rbp - 0x39]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test ebx, ebx
jne 0x1400da3e0
mov qword [rbp - 0x59], r12
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x1400da3c8
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbp - 0x49], r15
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x1400da29d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1400da29d
cmp dword [rbp - 0x51], 3
jne 0x1400da490
mov r14, qword [rbp - 0x49]
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400da401
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x10], r15
mov rbx, 0xffffffffffffffff
test r14, r14
je 0x1400da441
mov rsi, rbx
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x1400da410
inc rsi
lea rdx, [rsi + rsi]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1400da441
mov r8, r14
mov rdx, rsi
mov rcx, rax
call fcn.14014a108
mov rsi, qword [rbp - 0x41]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1400da458
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x18], r15
test rsi, rsi
je 0x1400da490
nop dword [rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1400da460
inc rbx
lea rdx, [rbx + rbx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x1400da490
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14014a108
mov qword [rbp - 0x59], r12
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x1400da4a7
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbp - 0x49], r15
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x1400da4b6
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov bl, 1
jmp 0x1400da29f
call fcn.1401421d8
int3
call fcn.1401421d8
int3