Function at 0x140118b30
Capabilities:
Check os version
Get proxy

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3c8
movdqa xmmword [rsp + 0x3b0], xmm8
movdqa xmmword [rsp + 0x3a0], xmm7
movdqa xmmword [rsp + 0x390], xmm6
mov r13, rcx
mov r15, qword [rcx + 0x198]
test r15, r15
je 0x140118dc6
mov rcx, r13
call fcn.140003450
cmp dword [r13 + 0x60], 2
je 0x140118b8b
mov rcx, qword [r13 + 0x68]
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov rdi, qword [r13 + 0xb0]
mov rsi, qword [r13 + 0xb8]
test rsi, rsi
je 0x140118bc4
mov rbx, rdi
nop word cs:[rax + rax]
mov rcx, rbx
call fcn.14011faf0
add rbx, 0x88
dec rsi
jne 0x140118bb0
cmp qword [r13 + 0xa8], 0
je 0x140118be0
mov rcx, qword [0x1402a52c8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov bpl, 1
mov r12, r15
mov r14b, 1
mov sil, 1
cmp qword [r13 + 0x70], 0
jne 0x140118c2f
mov rdi, qword [r13 + 0x78]
mov rbx, qword [r13 + 0x80]
mov rax, qword [rbx]
test rax, rax
je 0x140118c0b
mov rcx, rdi
call rax
cmp qword [rbx + 8], 0
je 0x140118c2f
cmp qword [rbx + 0x10], 0x11
jb 0x140118c1d
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1402a52c8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
test sil, sil
je 0x140118cac
mov qword [rsp + 0x38], r12
mov r12, r15
mov rax, r13
mov r13d, ebp
mov ebp, r14d
cmc
mov rax, qword [r13 + 0xb8]
mov qword [rsp + 0x360], rax
movdqu xmm0, xmmword [r13 + 0xa8]
movdqa xmmword [rsp + 0x350], xmm0
cmp byte [r13 + 0x1b4], 0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x340], r15
je 0x14011b36c
mov qword [rsp + 0x60], 0
lea rdx, [0x140287262]
lea rcx, [rsp + 0xf0]
mov r8d, 0x3b
call fcn.14011d4b0
mov rdi, qword [rsp + 0xf8]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov ebx, eax
cmp qword [rsp + 0xf0], 0
je 0x140118e6f
mov rcx, qword [0x1402a52c8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
test ebx, ebx
je 0x140118eae
movzx eax, byte [0x1402a5340]
mov edx, 0x10
xor ecx, ecx
call fcn.1401af7e0
test rax, rax
je 0x14011d354
mov rdi, rax
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
mov qword [rdi], 0
mov dword [rdi + 8], eax
jmp 0x140118f6d
mov r14, qword [rsp + 0x60]
lea r8, [0x14028729d]
lea rcx, [rsp + 0xf0]
mov rdx, r14
call fcn.14011d7d0
mov edi, dword [rsp + 0xf0]
cmp edi, 6
jne 0x140118ee7
mov rsi, qword [rsp + 0xf8]
mov ebx, dword [rsp + 0x100]
jmp 0x140118f3f
mov esi, dword [rsp + 0xf4]
mov rax, qword [rsp + 0xf8]
mov ecx, dword [rsp + 0x100]
mov rdx, qword [rsp + 0x104]
mov qword [rsp + 0x74], rdx
mov edx, dword [rsp + 0x10c]
mov dword [rsp + 0x7c], edx
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x64], esi
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], ecx
lea rcx, [rsp + 0x60]
call fcn.14011deb0
test edi, edi
je 0x14011a257
xor esi, esi
mov ebx, 0x8007000d
movzx eax, byte [0x1402a5340]
mov edx, 0x10
xor ecx, ecx
call fcn.1401af7e0
test rax, rax
je 0x14011d354
mov rdi, rax
mov qword [rax], rsi
mov dword [rdi + 8], ebx
mov rcx, r14
call qword [sym.imp.advapi32.dll_RegCloseKey]
lea rbx, [0x1402872d8]
mov rax, qword [rbx]
test rax, rax
je 0x140118f81
mov rcx, rdi
call rax
movabs r15, 0x8000000000000000
cmp qword [rbx + 8], 0
je 0x140118faf
cmp qword [rbx + 0x10], 0x11
jb 0x140118f9d
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1402a52c8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
lea r8, [0x1402872a8]
lea rcx, [rsp + 0xf0]
mov rdx, r14
call fcn.14011d7d0
mov eax, dword [rsp + 0xf0]
cmp eax, 6
jne 0x14011a480
mov rdi, qword [rsp + 0xf8]
mov ebx, dword [rsp + 0x100]
jmp 0x14011d0aa
mov ecx, dword [rsp + 0xf4]
mov r15, qword [rsp + 0xf8]
mov edx, dword [rsp + 0x100]
mov r8, qword [rsp + 0x104]
mov qword [rsp + 0x74], r8
mov r8d, dword [rsp + 0x10c]
mov dword [rsp + 0x7c], r8d
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], ecx
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], edx
cmp eax, 2
jne 0x14011d099
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rax, r15
neg rax
jo 0x14011d0aa
cmp esi, 1
jne 0x14011d2cb
mov rcx, r14
call qword [sym.imp.advapi32.dll_RegCloseKey]
movabs rax, 0x8000000000000001
cmp r15, rax
jne 0x140118faf
jmp 0x140118f74
lea rcx, [rsp + 0x60]
call fcn.14011deb0
mov ebx, 0x8007000d
xor edi, edi
movzx eax, byte [0x1402a5340]
mov edx, 0x10
xor ecx, ecx
call fcn.1401af7e0
test rax, rax
je 0x14011d354
mov qword [rax], rdi
mov rdi, rax
invalid
jmp 0x140118f61
test r15, r15
je 0x14011d2e2
mov rcx, qword [0x1402a52c8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, r14
call qword [sym.imp.advapi32.dll_RegCloseKey]
adc eax, 0xc2d75