Function at 0x140017e80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x14008f060]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rbx, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140017ec7
lea r9, str.Start
xor edx, edx
lea r8, str.NeedLaunchFUB
call fcn.140003290
mov qword [rsp + 0x2e8], rsi
mov rcx, rbx
mov qword [rsp + 0x2f0], rdi
call fcn.140018900
mov rcx, qword [rbx + 8]
test al, al
je 0x140017f03
test rcx, rcx
je 0x140018325
lea r9, str.True
lea r8, str.IsADESv1China
jmp 0x140018300
test rcx, rcx
je 0x140017f1d
lea r9, str.False
xor edx, edx
lea r8, str.IsADESv1China
call fcn.140003290
lea r8, [rsp + 0x40]
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareOEMADESV2_
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, rbx
call fcn.140018c70
xor edx, edx
lea rcx, [rbp + 0xc0]
mov r8d, pe_nt_image_headers64
call fcn.140039940
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea r8, [0x14007dc0c]
lea rax, [rbp + 0xc0]
mov dword [rsp + 0x48], pe_nt_image_headers64
mov qword [rsp + 0x28], rax
xor esi, esi
mov r9d, 0xffff
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
cmp byte [rbp + 0xc0], 0x2d
jne 0x140017fd7
cmp byte [rbp + 0xc1], 0x31
jne 0x140017fd7
cmp byte [rbp + 0xc2], sil
jne 0x140017fd7
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400183b0
lea r9, [0x14007dc10]
lea r8, str.NeedLaunchFUB__FUB
jmp 0x14001838b
mov rcx, rbx
call fcn.140018f80
mov rcx, qword [rbx + 8]
test al, al
jne 0x140018003
test rcx, rcx
je 0x140018325
lea r9, str.False
lea r8, str.IsConsensus
jmp 0x140018300
test rcx, rcx
je 0x14001801d
lea r9, str.True
xor edx, edx
lea r8, str.IsConsensus
call fcn.140003290
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, pe_nt_image_headers64
call fcn.140039940
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rax
lea r8, [0x14007dc40]
lea rax, [rbp - 0x40]
mov dword [rsp + 0x4c], pe_nt_image_headers64
mov qword [rsp + 0x28], rax
mov r9d, 0xffff
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
cmp byte [rbp - 0x40], 0x2d
jne 0x1400180a5
cmp byte [rbp - 0x3f], 0x31
jne 0x1400180a5
cmp byte [rbp - 0x3e], sil
jne 0x1400180a5
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400183b0
lea r9, [0x14007dc10]
lea r8, str.NeedLaunchFUB__Time
jmp 0x14001838b
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x14007a778]
lea rcx, [rbp - 0x40]
call fcn.140038f78
mov rdi, rax
test rax, rax
jne 0x1400180e1
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400183b0
lea r8, str.NeedLaunchFUB__Time_format
jmp 0x140018384
xor eax, eax
mov qword [rsp + 0x50], rsi
xorps xmm1, xmm1
mov qword [rbp - 0x58], rax
xorps xmm0, xmm0
mov word [rbp - 0x50], ax
xor ecx, ecx
mov dword [rbp - 0x60], eax
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
movups xmmword [rbp - 0x80], xmm1
movups xmmword [rbp - 0x70], xmm1
call fcn.14004abf0
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x78], rax
lea rcx, [rbp - 0x80]
call fcn.14004c088
test eax, eax
je 0x14001814a
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140018325
lea r9, str.Failed
lea r8, str.NeedLaunchFUB__Convert_current_Time
jmp 0x140018300
mov eax, dword [rdi]
lea rcx, [rbp - 0x58]
mov dword [rbp - 0x58], eax
call fcn.14004c578
mov dword [rsp + 0x64], eax
cmp eax, 0x76c
jg 0x14001817c
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400183b0
lea r8, str.NeedLaunchFUB__Time___year_format
jmp 0x140018384
sub eax, 0x76c
mov qword [rbp - 0x56], rsi
mov dword [rsp + 0x64], eax
lea rcx, [rbp - 0x58]
movzx eax, word [rdi + 5]
mov word [rbp - 0x58], ax
call fcn.14004c578
mov dword [rsp + 0x60], eax
dec eax
cmp eax, 0xb
ja 0x140018374
mov dword [rsp + 0x60], eax
lea rcx, [rbp - 0x58]
movzx eax, word [rdi + 8]
mov word [rbp - 0x58], ax
mov qword [rbp - 0x56], rsi
call fcn.14004c578
mov dword [rsp + 0x5c], eax
dec eax
cmp eax, 0x1e
ja 0x140018362
movzx eax, word [rdi + 0xb]
lea rcx, [rbp - 0x58]
mov word [rbp - 0x58], ax
mov qword [rbp - 0x56], rsi
call fcn.14004c578
mov dword [rsp + 0x58], eax
cmp eax, 0x18
ja 0x140018350
movzx eax, word [rdi + 0xe]
lea rcx, [rbp - 0x58]
mov word [rbp - 0x58], ax
mov qword [rbp - 0x56], rsi
call fcn.14004c578
mov dword [rsp + 0x54], eax
cmp eax, 0x3c
ja 0x14001833e
movzx eax, word [rdi + 0x11]
lea rcx, [rbp - 0x58]
mov word [rbp - 0x58], ax
mov qword [rbp - 0x56], rsi
call fcn.14004c578
mov dword [rsp + 0x50], eax
cmp eax, 0x3c
ja 0x14001832c
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x70], 1
call fcn.14004c448
mov rcx, qword [rbx + 8]
mov rsi, rax
test rcx, rcx
je 0x14001826a
lea r9, str.30_days
xor edx, edx
lea r8, str.NeedLaunchFUB__Criteria_:
call fcn.140003290
mov ecx, dword [rbp - 0x6c]
cmp ecx, dword [rsp + 0x64]
jg 0x140018293
jne 0x14001827e
mov eax, dword [rsp + 0x60]
cmp dword [rbp - 0x70], eax
jg 0x140018293
mov rcx, qword [rbx + 8]
xor dil, dil
test rcx, rcx
je 0x1400182b4
lea r9, [0x14007df8c]
jmp 0x1400182a6
mov rcx, qword [rbx + 8]
mov dil, 1
test rcx, rcx
je 0x1400182b4
lea r9, [0x14007df48]
lea r8, str.NeedLaunchFUB__Cross_1_Month
xor edx, edx
call fcn.140003290
mov rax, qword [rsp + 0x78]
sub rax, rsi
cmp rax, 0x278d00
jl 0x1400182e9
test dil, dil
je 0x1400182e9
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400183b0
lea r9, [0x14007df48]
lea r8, str.NeedLaunchFUB__Last_update_time_over_1_Month
jmp 0x14001838b
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140018325
lea r9, [0x14007df8c]
lea r8, str.NeedLaunchFUB__Last_update_time_over_1_Month
xor edx, edx
call fcn.140003290
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140018325
lea r9, [0x14007a9b8]
xor edx, edx
lea r8, str.NeedLaunchFUB
call fcn.140003290
xor al, al
jmp 0x1400183b2
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400183b0
lea r8, str.NeedLaunchFUB__Time___second_format
jmp 0x140018384
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400183b0
lea r8, str.NeedLaunchFUB__Time___minute_format
jmp 0x140018384
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400183b0
lea r8, str.NeedLaunchFUB__Time___hour_format
jmp 0x140018384
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400183b0
lea r8, str.NeedLaunchFUB__Time___day_format
jmp 0x140018384
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400183b0
lea r8, str.NeedLaunchFUB__Time___month_format
lea r9, str.Not_correct
xor edx, edx
call fcn.140003290
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400183b0
lea r9, [0x14007a9b8]
xor edx, edx
lea r8, str.NeedLaunchFUB
call fcn.140003290
mov al, 1
mov rdi, qword [rsp + 0x2f0]
mov rsi, qword [rsp + 0x2e8]
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140036cc0
mov rbx, qword [rsp + 0x2f8]
add rsp, 0x2d0
pop rbp
ret