Function at 0x14007c400
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x1401b4a98]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, r8
mov rbx, rdx
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
mov rcx, qword [r8 + 8]
xor r15d, r15d
test rcx, rcx
je 0x14007c453
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 8], r15
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14007c466
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x10], r15
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x14007c479
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x18], r15
movzx edx, byte [0x14014d920]
lea rcx, [rbp + 7]
call fcn.1400971d0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], rax
lea rcx, [rbp + 0xf]
call fcn.1400976a0
cmp byte [rbp + 0x1f], 0
je 0x14007c56c
cmp byte [rbp + 0xf], 1
jne 0x14007c5ff
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.140097210
mov r8d, dword [rbp - 0x39]
test r8d, r8d
je 0x14007c5ff
mov rcx, qword [rbp - 0x31]
mov rax, qword [rcx]
lea rdx, [rbp - 0x79]
mov rax, qword [rax + 0x10]
call qword [case.0x14000cca5.0]
nop
lea rax, [rbp - 0x79]
cmp qword [rbp - 0x61], 0x10
cmovae rax, qword [rbp - 0x79]
mov qword [rsp + 0x28], rax
lea rax, str.Failed_to_impersonate_logged_on_user:__hs
mov qword [rsp + 0x20], rax
mov r9d, 0x1de
lea r8, str.XMLUpdater::v2::CUpdater::fill_proxy_data_for_specific_url
lea rdx, str.E:BT5141214d_e130_48fa_889d_d54b39cac869xmlupdater_srcXmlUpdaterxmlUpdater.cpp
mov ecx, 1
call fcn.14007d3e0
nop
mov rdx, qword [rbp - 0x61]
cmp rdx, 0x10
jb 0x14007c5ff
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c5fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007c8f3
jmp 0x14007c5fa
mov rcx, qword [rbp + 0x17]
mov rax, qword [rcx]
mov r8d, dword [rbp + 0xf]
lea rdx, [rbp - 0x79]
mov rax, qword [rax + 0x10]
call qword [case.0x14000cca5.0]
nop
lea rax, [rbp - 0x79]
cmp qword [rbp - 0x61], 0x10
cmovae rax, qword [rbp - 0x79]
mov qword [rsp + 0x28], rax
lea rax, str.Unable_to_determine_if_process_is_running_as_a_service:__hs
mov qword [rsp + 0x20], rax
mov r9d, 0x1e3
lea r8, str.XMLUpdater::v2::CUpdater::fill_proxy_data_for_specific_url
lea rdx, str.E:BT5141214d_e130_48fa_889d_d54b39cac869xmlupdater_srcXmlUpdaterxmlUpdater.cpp
mov ecx, 1
call fcn.14007d3e0
nop
mov rdx, qword [rbp - 0x61]
cmp rdx, 0x10
jb 0x14007c5ff
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c5fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007c8ed
call fcn.140074f80
lea rcx, [rbp - 0x19]
call qword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x14007c6cd
mov r14, qword [rbp - 9]
test r14, r14
je 0x14007c739
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14007c631
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x10], r15
mov rbx, 0xffffffffffffffff
test r14, r14
je 0x14007c675
mov rsi, rbx
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x14007c640
inc rsi
lea rdx, [rsi + rsi]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rdi + 0x10], rax
test rax, rax
je 0x14007c6cd
mov r8, r14
mov rdx, rsi
mov rcx, rax
call fcn.14010c3b4
test eax, eax
jne 0x14007c6cd
mov rsi, qword [rbp - 1]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x14007c68c
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x18], r15
test rsi, rsi
je 0x14007c8e6
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x14007c695
inc rbx
lea rdx, [rbx + rbx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x14007c6cd
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14010c3b4
test eax, eax
je 0x14007c8e6
xor bl, bl
lea rcx, [rbp + 7]
call fcn.1400971e0
nop
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x14007c6ec
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbp - 0x11], r15
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x14007c6ff
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbp - 9], r15
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x14007c70e
call qword [sym.imp.KERNEL32.dll_GlobalFree]
movzx eax, bl
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400fb890
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rax, qword [rbp - 0x11]
cmp dword [rbp - 0x19], 0
jne 0x14007c74c
test rax, rax
je 0x14007c8e6
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x35], xmm0
mov qword [rbp - 0x25], r15
test rax, rax
je 0x14007c76a
mov dword [rbp - 0x39], 2
mov qword [rbp - 0x31], rax
jmp 0x14007c778
mov dword [rbp - 0x39], 1
mov dword [rbp - 0x35], 3
mov dword [rbp - 0x1d], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, str.Temp
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rsi, rax
test rax, rax
je 0x14007c6cd
lea r12, vtable.XMLUpdater::v2::auto_proxy_info.0
mov qword [rbp - 0x59], r12
mov dword [rbp - 0x51], 1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x49], xmm0
lea r9, [rbp - 0x51]
lea r8, [rbp - 0x39]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test ebx, ebx
jne 0x14007c810
mov qword [rbp - 0x59], r12
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x14007c7f8
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbp - 0x49], r15
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x14007c6cd
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14007c6cd
cmp dword [rbp - 0x51], 3
jne 0x14007c8c0
mov r14, qword [rbp - 0x49]
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14007c831
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x10], r15
mov rbx, 0xffffffffffffffff
test r14, r14
je 0x14007c871
mov rsi, rbx
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x14007c840
inc rsi
lea rdx, [rsi + rsi]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rdi + 0x10], rax
test rax, rax
je 0x14007c871
mov r8, r14
mov rdx, rsi
mov rcx, rax
call fcn.14010c3b4
mov rsi, qword [rbp - 0x41]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x14007c888
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rdi + 0x18], r15
test rsi, rsi
je 0x14007c8c0
nop dword [rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x14007c890
inc rbx
lea rdx, [rbx + rbx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x14007c8c0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14010c3b4
mov qword [rbp - 0x59], r12
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x14007c8d7
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbp - 0x49], r15
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x14007c8e6
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov bl, 1
jmp 0x14007c6cf
call fcn.140103230
int3
call fcn.140103230
int3