Function at 0x18001f9b0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
push rbp
sub rsp, 0x68
mov qword [rax + 0x10], rsi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x20], r12
lea rcx, [rax - 0x48]
mov qword [rax - 0x30], r14
mov rbx, rdx
call fcn.18001e4c0
test eax, eax
je 0x18001f9e8
mov qword [rsp + 0x30], 0
jmp 0x18001fa3a
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18001fa3a
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
lea rdx, [rsp + 0x90]
mov ecx, 0xf003f
mov qword [rsp + 0x90], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov rdx, qword [rsp + 0x90]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x1002
xor ebp, ebp
xor esi, esi
call fcn.1800251fc
xor r12d, r12d
mov r14, rax
mov dword [rsp + 0x90], r12d
test rax, rax
je 0x18001fa70
mov r12d, 0x1000
mov word [rax + 0x1000], si
mov dword [rsp + 0x90], r12d
mov rax, qword [0x180037bc8]
test rax, rax
jne 0x18001fab3
mov rax, qword [0x180037b90]
test rax, rax
jne 0x18001fa9c
lea rcx, str.wininet
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x180037b90], rax
lea rdx, str.InternetSetOptionA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180037bc8], rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x5f]
call rax
mov rax, qword [0x180037bc8]
test rax, rax
jne 0x18001fb04
mov rax, qword [0x180037b90]
test rax, rax
jne 0x18001faed
lea rcx, str.wininet
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x180037b90], rax
lea rdx, str.InternetSetOptionA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180037bc8], rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x27]
call rax
mov rax, qword [0x180037bc8]
test rax, rax
jne 0x18001fb55
mov rax, qword [0x180037b90]
test rax, rax
jne 0x18001fb3e
lea rcx, str.wininet
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x180037b90], rax
lea rdx, str.InternetSetOptionA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180037bc8], rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x25]
call rax
mov rax, qword [0x180037bb0]
test rax, rax
jne 0x18001fba6
mov rax, qword [0x180037b90]
test rax, rax
jne 0x18001fb8f
lea rcx, str.wininet
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x180037b90], rax
lea rdx, str.InternetOpenA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180037bb0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call rax
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18001fbd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x18001fdca
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x40], r15
call fcn.180020280
mov r15, rax
test rax, rax
jne 0x18001fbf5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x18001fd7d
mov qword [rsp + 0x50], r13
nop word [rax + rax]
mov rax, qword [0x180037bc0]
test rax, rax
jne 0x18001fc43
mov rax, qword [0x180037b90]
test rax, rax
jne 0x18001fc2c
lea rcx, str.wininet
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x180037b90], rax
lea rdx, str.InternetReadFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180037bc0], rax
lea r9, [rsp + 0x98]
mov r8d, r12d
mov rdx, r14
mov rcx, r15
call rax
test eax, eax
je 0x18001fd23
movsxd r12, dword [rsp + 0x98]
test r12d, r12d
je 0x18001fd0e
lea eax, [rsi + 2]
movsxd rcx, eax
call fcn.1800251fc
xor r13d, r13d
mov rdi, rax
test rax, rax
je 0x18001fc91
movsxd rdx, esi
mov r13d, esi
mov word [rdx + rax], 0
movsxd r8, esi
mov rdx, rbp
mov rcx, rax
call fcn.18002525c
lea ebx, [r12 + rsi]
test rbp, rbp
je 0x18001fcb0
mov rcx, rbp
call sub.KERNEL32.dll_LocalFree
lea eax, [rbx + 2]
movsxd rcx, eax
call fcn.1800251fc
xor esi, esi
mov rbp, rax
test rax, rax
je 0x18001fcf0
movsxd rax, ebx
mov esi, ebx
movsxd rbx, r13d
mov rdx, rdi
mov rcx, rbp
mov r8, rbx
mov word [rax + rbp], 0
call fcn.18002525c
lea rcx, [rbx + rbp]
mov r8, r12
mov rdx, r14
call fcn.18002525c
mov r12d, dword [rsp + 0x90]
test rdi, rdi
je 0x18001fc00
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
jmp 0x18001fc00
mov rcx, qword [rsp + 0x80]
mov r8d, esi
mov rdx, rbp
call fcn.18001fe30
jmp 0x18001fd29
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13, qword [rsp + 0x50]
mov ebx, eax
mov rax, qword [0x180037bd0]
test rax, rax
jne 0x18001fd73
mov rax, qword [0x180037b90]
test rax, rax
jne 0x18001fd5c
lea rcx, str.wininet
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x180037b90], rax
lea rdx, str.InternetCloseHandle
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180037bd0], rax
mov rcx, r15
call rax
mov rdi, qword [rsp + 0x38]
mov rax, qword [0x180037bd0]
mov r15, qword [rsp + 0x40]
test rax, rax
jne 0x18001fdc5
mov rax, qword [0x180037b90]
test rax, rax
jne 0x18001fdae
lea rcx, str.wininet
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x180037b90], rax
lea rdx, str.InternetCloseHandle
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180037bd0], rax
mov rcx, rdi
call rax
cmp qword [rsp + 0x30], 0
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x88]
je 0x18001fe04
xor edx, edx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x18001fe11
mov rcx, r14
call sub.KERNEL32.dll_LocalFree
mov r14, qword [rsp + 0x48]
test rbp, rbp
je 0x18001fe23
mov rcx, rbp
call sub.KERNEL32.dll_LocalFree
mov eax, ebx
add rsp, 0x68
pop rbp
pop rbx
ret