Function at 0x140018900
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
lea rbp, [r11 - 0x398]
sub rsp, 0x488
mov rax, qword [0x14008f060]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov qword [r11 + 0x10], rbx
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov qword [r11 + 0x20], r14
test rcx, rcx
je 0x14001894d
lea r9, str.Start
xor edx, edx
lea r8, str.IsADESv1China
call fcn.140003290
xor edx, edx
mov dword [rsp + 0x50], 0x30
mov r8d, 0x204
lea rcx, [rsp + 0x54]
call fcn.140039940
lea rax, [rsp + 0x38]
mov dword [rsp + 0x40], 0x104
xor r14d, r14d
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
mov qword [rsp + 0x38], r14
xor r8d, r8d
lea rdx, str.SoftwareOEMADES
mov rcx, 0xffffffff80000002
xor sil, sil
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140018c18
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400189c7
lea r9, str.Registry_found
xor edx, edx
lea r8, str.IsADESv1China__SoftwareOEMADES
call fcn.140003290
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.Country
lea rax, [rsp + 0x50]
mov qword [rsp + 0x480], r15
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbx + 8]
test eax, eax
jne 0x140018be8
test rcx, rcx
je 0x140018a1f
lea r9, [rsp + 0x50]
xor edx, edx
lea r8, str.IsADESv1China__Country
call fcn.140003290
movzx ecx, word [rsp + 0x50]
mov r15d, 0x31
movzx eax, word [rsp + 0x52]
cmp r15w, cx
jne 0x140018a3f
cmp r14w, ax
je 0x140018c02
mov edx, 0x2d
cmp dx, cx
jne 0x140018c05
cmp r15w, ax
jne 0x140018c05
cmp r14w, word [rsp + 0x54]
jne 0x140018c05
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x4b0], rdi
test rcx, rcx
je 0x140018a89
lea r9, str.Start
xor edx, edx
lea r8, str.IsADESv2China
call fcn.140003290
xor edx, edx
mov dword [rbp + 0x160], 0x30
mov r8d, 0x204
lea rcx, [rbp + 0x164]
call fcn.140039940
lea rax, [rsp + 0x30]
mov dword [rsp + 0x44], 0x104
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
lea rdx, str.SoftwareOEMADESV2
mov rcx, 0xffffffff80000002
xor dil, dil
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140018b88
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140018b04
lea r9, str.Registry_found
xor edx, edx
lea r8, str.IsADESv2China__SoftwareOEMADESV2
call fcn.140003290
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rdx, str.Country
lea rax, [rbp + 0x160]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140018b7d
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140018b54
lea r9, [rbp + 0x160]
xor edx, edx
lea r8, str.IsADESv2China__Country
call fcn.140003290
movzx eax, word [rbp + 0x160]
mov ecx, r15d
sub ecx, eax
jne 0x140018b6f
movzx eax, word [rbp + 0x162]
movzx ecx, r14w
sub ecx, eax
test ecx, ecx
movzx edi, dil
mov eax, 1
cmove edi, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140018baa
lea r9, [0x14007a9b8]
xor edx, edx
lea r8, str.IsADESv2China
call fcn.140003290
mov rcx, qword [rbx + 8]
test dil, dil
mov rdi, qword [rsp + 0x4b0]
je 0x140018bcc
test rcx, rcx
je 0x140018c02
lea r9, str.True
lea r8, str.IsADESv2China
jmp 0x140018bfb
test rcx, rcx
je 0x140018c05
lea r9, str.False
xor edx, edx
lea r8, str.IsADESv2China
call fcn.140003290
jmp 0x140018c05
test rcx, rcx
je 0x140018c02
lea r9, str.Invalid
lea r8, str.IsADESv1China__Country
xor edx, edx
call fcn.140003290
mov sil, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15, qword [rsp + 0x480]
mov rcx, qword [rbx + 8]
mov r14, qword [rsp + 0x4b8]
mov rbx, qword [rsp + 0x4a8]
test rcx, rcx
je 0x140018c46
lea r9, [0x14007a9b8]
xor edx, edx
lea r8, str.IsADESv1China
call fcn.140003290
movzx eax, sil
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.140036cc0
add rsp, 0x488
pop rsi
pop rbp
ret