Function at 0x1400251df
Capabilities:
Initialize winhttp library
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x228
movaps xmmword [rsp + 0x210], xmm6
mov qword [rsp + 0x100], rdx
mov qword [rsp + 0x158], rcx
mov qword [rsp + 0x128], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
lea rcx, [rsp + 0xe0]
movaps xmmword [rcx], xmm0
and qword [rcx + 0x10], 0
call sub.winhttp.dll_WinHttpGetDefaultProxyConfiguration
test eax, eax
je 0x140025c7a
mov rdx, qword [rsp + 0xe8]
test rdx, rdx
je 0x140025ca0
lea rsi, [rsp + 0xc0]
mov rcx, rsi
call fcn.1400b2b4e
mov rax, qword [rsi]
test rax, rax
je 0x140025cd0
movups xmm0, xmmword [rsp + 0xc8]
lea rdx, [rsp + 0x1e0]
mov qword [rdx], rax
movups xmmword [rdx + 8], xmm0
lea rcx, [rsp + 0x128]
call fcn.140004118
xorps xmm0, xmm0
lea rcx, [rsp + 0x90]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call sub.winhttp.dll_WinHttpGetIEProxyConfigForCurrentUser
test eax, eax
je 0x140025c8d
mov rdx, qword [rsp + 0xa0]
test rdx, rdx
je 0x140025d36
lea rsi, [rsp + 0xe0]
mov rcx, rsi
call fcn.1400b2b4e
mov rax, qword [rsi]
test rax, rax
je 0x140025d66
movups xmm0, xmmword [rsp + 0xe8]
lea rdx, [rsp + 0x1f8]
mov qword [rdx], rax
movups xmmword [rdx + 8], xmm0
lea rcx, [rsp + 0x128]
call fcn.140004118
lea rax, [rsp + 0x170]
mov qword [rax], 8
xorps xmm6, xmm6
movups xmmword [rax + 8], xmm6
mov qword [rsp + 0x90], 0xffffffff80000001
mov qword [rsp + 0x98], 0xffffffff80000002
and qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 2
mov rax, qword [rsp + 0x100]
mov rcx, qword [rax]
mov qword [rsp + 0x108], rcx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x160], rax
mov eax, 2
xor ecx, ecx
cmp rax, rcx
jne 0x140025371
xor eax, eax
jmp 0x14002538a
lea rax, [rcx + 1]
mov qword [rsp + 0xa0], rax
mov eax, 1
mov rsi, qword [rsp + rcx*8 + 0x90]
test rax, rax
je 0x140025918
mov ecx, 0x3c
call fcn.1400867e0
mov rdi, rax
mov qword [rsp + 0x168], rdx
movups xmm0, xmmword [str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x140112750]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x140112760]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x14011276c]
movups xmmword [rax + 0x2c], xmm0
and qword [rsp + 0xd8], 0
mov ecx, 0xc
call fcn.1400867e0
mov r14, rax
mov r15, rdx
movabs rax, 0x72655379786f7250
mov qword [r14], rax
mov dword [r14 + 8], 0x726576
mov ecx, 0xe
call fcn.1400867e0
mov r13, rax
mov rbx, rdx
movabs rax, 0x666e6f436f747541
mov qword [r13], rax
movabs rax, 0x4c52556769666e
mov qword [r13 + 6], rax
mov dword [rsp + 0x44], 0x800
mov ecx, 0x800
xor edx, edx
call fcn.14005a675
mov rbp, rax
mov r12, rdx
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
lea rsi, [rsp + 0x44]
je 0x140025492
mov rcx, rbp
mov rdx, r12
call fcn.14005a6df
mov rcx, r13
mov rdx, rbx
call fcn.14005a6df
mov rcx, r14
mov rdx, r15
jmp 0x1400257ba
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], r15
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rbp
and qword [rsp + 0x20], 0
xor edx, edx
mov r8, r14
mov r9d, 2
call sub.ADVAPI32.dll_RegGetValueA
test eax, eax
jne 0x140025541
mov r8d, dword [rsp + 0x44]
test r8, r8
mov r15, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x78]
je 0x140025471
dec r8
lea rbx, [rsp + 0xc0]
mov rcx, rbx
mov rdx, rbp
call fcn.14005a9d4
lea r12, [rsp + 0x48]
mov rcx, r12
mov rdx, rbx
call fcn.140024a23
mov rcx, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xc8]
call fcn.140024a14
lea rcx, [rsp + 0x170]
mov rdx, r12
call fcn.140004118
mov dword [rsp + 0x44], 0x800
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rbp
and qword [rsp + 0x20], 0
xor edx, edx
mov r8, r13
mov r9d, 2
call sub.ADVAPI32.dll_RegGetValueA
test eax, eax
jne 0x140025792
mov r8d, dword [rsp + 0x44]
test r8, r8
mov r15, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x78]
je 0x140025471
dec r8
lea rsi, [rsp + 0x48]
mov rcx, rsi
mov rdx, rbp
call fcn.14005a9d4
lea rcx, [rsp + 0x198]
mov rdx, rsi
call fcn.140024a23
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
call fcn.140024a14
lea rcx, [rsp + 0x1b0]
mov rdx, qword [rsp + 0x108]
mov r8, qword [rsp + 0x160]
call fcn.14005ad4a
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x118], rax
mov r12, qword [rsp + 0x1a8]
movaps xmmword [rsp + 0x140], xmm6
and qword [rsp + 0x150], 0
and dword [rsp + 0x20], 0
lea rcx, [0x140128ea4]
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.winhttp.dll_WinHttpOpen
test rax, rax
mov rbx, rbp
mov qword [rsp + 0x120], rbp
je 0x1400257f7
mov r15, rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r12
mov rcx, rsi
call fcn.1400b2964
mov qword [rsp + 0xc0], rax
lea rsi, [0x14012e9b0]
test rax, rax
je 0x140025696
mov rsi, qword [rax + 0x10]
lea rcx, [rsp + 0xc0]
call fcn.1400b28d1
movabs rax, 0x300000003
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rsi
and qword [rsp + 0x58], 0
movabs rax, 0x100000000
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x1b0]
call fcn.1400b2964
mov qword [rsp + 0xc0], rax
lea rsi, [0x14012e9b0]
test rax, rax
je 0x1400256f1
mov rsi, qword [rax + 0x10]
lea rcx, [rsp + 0xc0]
call fcn.1400b28d1
mov rcx, r15
mov rdx, rsi
lea r8, [rsp + 0x48]
lea r9, [rsp + 0x140]
call sub.winhttp.dll_WinHttpGetProxyForUrl
test eax, eax
je 0x1400257e4
mov rcx, r15
call sub.winhttp.dll_WinHttpCloseHandle
test eax, eax
je 0x1400257e4
mov rdx, qword [rsp + 0x148]
test rdx, rdx
je 0x140025857
lea rcx, [rsp + 0xe0]
call fcn.1400b2b4e
mov rax, qword [rsp + 0xe0]
test rax, rax
je 0x140025889
movups xmm0, xmmword [rsp + 0xe8]
mov qword [rsp + 0x1c8], rax
movups xmmword [rsp + 0x1d0], xmm0
lea rcx, [rsp + 0x170]
lea rdx, [rsp + 0x1c8]
call fcn.140004118
mov rbp, qword [rsp + 0x120]
mov rcx, rbp
mov rdx, qword [rsp + 0x78]
call fcn.14005a6df
mov rcx, r13
mov rdx, qword [rsp + 0x80]
call fcn.14005a6df
mov rcx, r14
mov rdx, qword [rsp + 0x88]
call fcn.14005a6df
mov rcx, rdi
mov rdx, qword [rsp + 0x168]
call fcn.14005a6df
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xa8]
jmp 0x140025368
call fcn.1400b2c11
xor ecx, ecx
mov edx, eax
call fcn.14002606e
jmp 0x1400258eb
lea rax, [0x140112730]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 1
lea rax, [0x14012e9b0]
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x60], xmm6
mov rcx, rsi
call fcn.14000f201
mov rsi, rax
mov rcx, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
call fcn.14005a6df
mov rcx, qword [rsp + 0x1b0]
mov rdx, qword [rsp + 0x1b8]
call fcn.14005a6df
jmp 0x1400258ee
lea rax, [0x140112718]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 1
lea rax, [0x14012e9b0]
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x60], xmm6
lea rcx, [rsp + 0x48]
call fcn.14000f201
jmp 0x1400258eb
lea rax, [rsp + 0x43]
mov qword [rsp + 0x188], rax
lea rax, [0x14005ae5b]
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x20], 1
mov r8d, 1
lea r12, [rsp + 0x48]
mov rcx, r12
lea rdx, [0x14012ea50]
lea r9, [rsp + 0x188]
call fcn.140001ad1
lea rsi, [rsp + 0xc0]
mov rcx, rsi
mov rdx, r12
call fcn.140001916
mov rcx, rsi
call fcn.14005b4b9
mov rsi, rax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov r15, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x120]
jmp 0x140025471
mov rdi, qword [rsp + 0x170]
mov rsi, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x180]
mov rax, qword [rsp + 0x100]
mov rdx, qword [rax + 8]
mov rcx, qword [rsp + 0x108]
call fcn.14005a6df
test rdi, rdi
je 0x140025992
imul r13, rbx, 0x18
lea r15, [rsp + 0x128]
mov rcx, r15
mov rdx, rbx
call fcn.14000a879
mov r14, qword [r15]
mov r12, qword [r15 + 0x10]
imul rcx, r12, 0x18
add rcx, r14
mov rdx, rdi
mov r8, r13
call sub.msvcrt.dll_memcpy
add r12, rbx
mov qword [r15 + 0x10], r12
mov rcx, rdi
mov rdx, rsi
call fcn.14008ee01
jmp 0x1400259aa
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov r14, qword [rsp + 0x128]
mov r12, qword [rsp + 0x138]
imul rbp, r12, 0x18
lea rdi, str.http:__
lea rsi, [rsp + 0x48]
lea rbx, [rsp + 0xc0]
lea r15, [rsp + 0x90]
mov r13, r14
test rbp, rbp
je 0x140025a83
mov qword [rsp + 0xe0], r13
mov rcx, qword [r13]
mov rdx, qword [r13 + 0x10]
mov r9d, 7
mov r8, rdi
call fcn.14007c9b0
test al, al
jne 0x140025a76
lea rax, [rsp + 0xe0]
mov qword [rsp + 0xc0], rax
lea rax, [0x140024a6e]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x20], 1
mov r8d, 1
mov rcx, rsi
lea rdx, str.http:__
mov r9, rbx
call fcn.140001ad1
mov rcx, r15
mov rdx, rsi
call fcn.140001916
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
call fcn.14005a6df
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xa0]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rsp + 0x90]
movups xmmword [rax], xmm0
add r13, 0x18
add rbp, 0xffffffffffffffe8
jmp 0x1400259cd
call fcn.1400aabc4
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
lea rcx, [0x14012b3b0]
mov qword [rsp + 0x48], rcx
and qword [rsp + 0x50], 0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rdx
lea rdi, [rsp + 0x90]
mov qword [rdi], rsi
lea rcx, [r14 - 0x18]
xor ebx, ebx
xor esi, esi
cmp r12, rsi
je 0x140025af5
lea r15, [rcx + 0x18]
mov rdx, qword [rcx + 0x18]
mov r8, qword [rcx + 0x28]
mov rcx, rdi
call fcn.14002611a
inc rsi
mov rcx, r15
test al, al
jne 0x140025abf
mov rcx, qword [r15]
mov rdx, qword [r15 + 8]
call fcn.14005a6df
mov ebx, 1
jmp 0x140025af8
mov rsi, r12
imul rax, rsi, 0x18
add r14, rax
mov rdi, r12
sub rdi, rsi
lea rsi, [rsp + 0x90]
sub rdi, 1
jb 0x140025b53
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
mov rcx, rsi
call fcn.14002611a
test al, al
je 0x140025b3e
imul rax, rbx, 0xffffffffffffffe8
mov rcx, qword [r14 + 0x10]
mov qword [r14 + rax + 0x10], rcx
movups xmm0, xmmword [r14]
movups xmmword [r14 + rax], xmm0
jmp 0x140025b4d
inc rbx
mov rcx, qword [r14]
mov rdx, qword [r14 + 8]
call fcn.14005a6df
add r14, 0x18
jmp 0x140025b0d
sub r12, rbx
mov qword [rsp + 0x138], r12
mov rax, qword [rsp + 0x158]
mov qword [rax + 0x10], r12
movdqu xmm0, xmmword [rsp + 0x128]
movdqu xmmword [rax], xmm0
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140025c5e
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x140025c53
add rdx, rcx
inc rdx
movdqa xmm0, xmmword [rcx]
pmovmskb r8d, xmm0
not r8d
lea rsi, [rsp + 0xa8]
mov qword [rsi - 0x18], rcx
add rcx, 0x10
mov qword [rsi - 0x10], rcx
mov qword [rsi - 8], rdx
mov word [rsi], r8w
mov qword [rsi + 8], rax
mov edi, 1
test rdi, rdi
je 0x140025c49
mov rcx, rsi
call fcn.140001bab
cmp rax, 1
je 0x140025c16
mov rax, qword [rsp + 0x98]
movdqa xmm0, xmmword [rax]
pmovmskb ecx, xmm0
not ecx
mov word [rsp + 0xa8], cx
add qword [rsp + 0x90], 0xfffffffffffffe80
add rax, 0x10
mov qword [rsp + 0x98], rax
jmp 0x140025bd4
neg rdx
imul rax, rdx, 0x18
mov rdx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xb0]
dec rdi
mov qword [rsp + 0xb0], rdi
mov rcx, qword [rdx + rax - 0x18]
mov rdx, qword [rdx + rax - 0x10]
call fcn.14005a6df
jmp 0x140025bcf
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov r8d, 0x18
call fcn.1400045e5
movaps xmm6, xmmword [rsp + 0x210]
add rsp, 0x228
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400b2c11
xor ecx, ecx
mov edx, eax
call fcn.14002606e
jmp 0x140025d29
call fcn.1400b2c11
xor ecx, ecx
mov edx, eax
call fcn.14002606e
jmp 0x140025dbf
lea rax, [0x140112718]
lea rcx, [rsp + 0x48]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, [0x14012e9b0]
mov qword [rcx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
call fcn.14000f201
jmp 0x140025d29
lea rax, [rsp + 0x43]
lea r9, [rsp + 0x140]
mov qword [r9], rax
lea rax, [0x14005ae5b]
mov qword [r9 + 8], rax
mov qword [rsp + 0x20], 1
lea rdx, [0x14012ea50]
lea rsi, [rsp + 0x48]
mov r8d, 1
mov rcx, rsi
call fcn.140001ad1
lea rdi, [rsp + 0x90]
mov rcx, rdi
mov rdx, rsi
call fcn.140001916
mov rcx, rdi
call fcn.14005b4b9
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx]
jmp 0x14002528f
lea rax, [0x140112718]
lea rcx, [rsp + 0x48]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, [0x14012e9b0]
mov qword [rcx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
call fcn.14000f201
jmp 0x140025dbf
lea rax, [rsp + 0x43]
lea r9, [rsp + 0x140]
mov qword [r9], rax
lea rax, [0x14005ae5b]
mov qword [r9 + 8], rax
mov qword [rsp + 0x20], 1
lea rdx, [0x14012ea50]
lea rsi, [rsp + 0x48]
mov r8d, 1
mov rcx, rsi
call fcn.140001ad1
lea rdi, [rsp + 0xc0]
mov rcx, rdi
mov rdx, rsi
call fcn.140001916
mov rcx, rdi
call fcn.14005b4b9
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx]
jmp 0x1400252ff