Function at 0x140017a80
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x6b0]
sub rsp, 0x7b0
mov rax, qword [0x14008f060]
xor rax, rsp
mov qword [rbp + 0x6a0], rax
xorps xmm0, xmm0
movsxd r8, edx
xor eax, eax
shl r8, 5
mov qword [rbp + 0x64], rax
lea rdx, str.Start____s
mov dword [rbp + 0x6c], eax
mov rbx, rcx
lea rax, str.Unknow
mov dword [rbp - 0x10], 0x30
add r8, rax
lea rcx, [rbp - 0x10]
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
call fcn.140006be0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140017b19
lea r9, [rbp - 0x10]
xor edx, edx
lea r8, str.SendDeviceRequest
call fcn.140003290
xor edx, edx
mov dword [rbp + 0x70], 0x30
mov r8d, 0x204
lea rcx, [rbp + 0x74]
call fcn.140039940
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], 0x104
xor edi, edi
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
mov qword [rsp + 0x50], rdi
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSetupState
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140017c1d
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140017b8d
lea r9, str.Registry_found
xor edx, edx
lea r8, str.IsAuditMode
call fcn.140003290
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.ImageState
lea rax, [rbp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140017c12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140017bd7
lea r9, [rbp + 0x70]
xor edx, edx
lea r8, str.IsAuditMode__ImageState
call fcn.140003290
lea rdx, str.IMAGE_STATE_COMPLETE
mov rax, 0xffffffffffffffff
lea r8, [rbp + 0x70]
nop dword [rax]
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r8 + rax*2 + 2]
jne 0x140017c12
add rax, 2
cmp rax, 0x15
je 0x140017c5f
movzx ecx, word [rdx + rax*2]
cmp cx, word [r8 + rax*2]
je 0x140017bf0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140017c3b
lea r9, [0x14007a9b8]
xor edx, edx
lea r8, str.SendDeviceRequest
call fcn.140003290
mov rcx, qword [rbp + 0x6a0]
xor rcx, rsp
call fcn.140036cc0
lea r11, [rsp + 0x7b0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.140017e80
test al, al
je 0x140017c1d
xor edx, edx
mov dword [rbp + 0x70], 0x30
mov r8d, 0x204
lea rcx, [rbp + 0x74]
call fcn.140039940
xor edx, edx
mov dword [rbp + 0x280], 0x30
mov r8d, 0x204
lea rcx, [rbp + 0x284]
call fcn.140039940
xor edx, edx
mov dword [rbp + 0x490], 0x30
mov r8d, 0x204
lea rcx, [rbp + 0x494]
call fcn.140039940
mov r8d, 0x104
lea rdx, [rbp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea r9, str.FUB.exe
lea r8, [rbp + 0x70]
lea rdx, str._s_s
lea rcx, [rbp + 0x280]
call fcn.140006c40
lea r9, str.DataUpdate.exe
lea r8, [rbp + 0x70]
lea rdx, str._s_s
lea rcx, [rbp + 0x490]
call fcn.140006c40
mov rcx, qword [rbx + 8]
xorps xmm0, xmm0
xor eax, eax
mov dword [rbp - 0x80], 0x68
mov qword [rsp + 0x68], rax
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rsp + 0x58], xmm0
test rcx, rcx
je 0x140017d6e
lea r9, str.FUB.exe
xor edx, edx
lea r8, str.Create_Process
call fcn.140003290
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x280]
lea rax, [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rbx + 8]
test eax, eax
je 0x140017df6
test rcx, rcx
je 0x140017dce
lea r9, str.Successful
xor edx, edx
lea r8, str.Create_Process:_FUB.exe
call fcn.140003290
mov rcx, qword [rsp + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140017e10
test rcx, rcx
je 0x140017e10
lea r9, str.Failed
xor edx, edx
lea r8, str.Create_Process:_FUB.exe
call fcn.140003290
mov rcx, rbx
call fcn.140018f80
mov rcx, qword [rbx + 8]
test al, al
jne 0x140017e43
test rcx, rcx
je 0x140017c3b
lea r9, str.False
xor edx, edx
lea r8, str.IsConsensus
call fcn.140003290
jmp 0x140017c1d
test rcx, rcx
je 0x140017e5d
lea r9, str.True
xor edx, edx
lea r8, str.IsConsensus
call fcn.140003290
mov ecx, 0x1b58
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140019120
jmp 0x140017c1d