Function at 0x435d48
Capabilities:
Get geographical location
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0x90
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp + 0x5c], eax
mov eax, dword [ebp + 0x78]
mov ecx, dword [ebp + 0x68]
push ebx
mov ebx, dword [ebp + 0x70]
push esi
push dword [ebp + 0x7c]
xor esi, esi
push eax
push dword [ebp + 0x74]
mov dword [ebp + 0xc], ecx
push ecx
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x28], esi
mov dword [ebp + 0x2c], esi
call fcn.004354c5
xor ebx, ebx
add esp, 0x10
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x436464
push edi
push ebx
lea ecx, [ebp + 0x30]
push ecx
push eax
mov word [ebp + 0x30], 2
mov word [ebp + 0x32], 0x1124
call fcn.00409587
mov edi, eax
add esp, 0xc
cmp edi, ebx
mov dword [ebp + 0x1c], edi
jne 0x435dc1
push str.BtwProvisionedHidDevsCreateRegistryBc:_no_HID_SDP_record
jmp 0x43644e
push 0x206
push edi
call fcn.00408791
cmp eax, ebx
pop ecx
pop ecx
je 0x436449
mov dx, word [eax + 6]
mov ecx, 0xf000
and dx, cx
cmp dx, 0x6000
jne 0x436449
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x436449
mov dx, word [eax + 6]
and dx, cx
cmp dx, 0x6000
jne 0x436449
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x436449
mov eax, dword [eax]
cmp eax, ebx
mov dword [ebp + 0x20], eax
je 0x436449
mov ax, word [eax + 6]
and ax, cx
cmp ax, 0x4000
jne 0x436449
mov esi, 0x202
push esi
push edi
call fcn.00408791
test eax, eax
pop ecx
pop ecx
je 0x436449
push esi
push edi
call fcn.00408791
mov al, byte [eax + 8]
push 0x204
push edi
mov byte [ebp + 0x1b], al
call fcn.00408791
xor esi, esi
add esp, 0x10
inc esi
cmp eax, ebx
je 0x435e73
cmp byte [eax + 8], bl
je 0x435e73
mov dword [ebp + 0x2c], esi
push 0x205
push edi
call fcn.00408791
cmp eax, ebx
pop ecx
pop ecx
je 0x435e8d
cmp byte [eax + 8], bl
je 0x435e8d
or dword [ebp + 0x2c], 4
push 0x20d
push edi
call fcn.00408791
cmp eax, ebx
pop ecx
pop ecx
je 0x435ea7
cmp byte [eax + 8], bl
je 0x435ea7
or dword [ebp + 0x2c], 2
push 0x208
push edi
call fcn.00408791
cmp eax, ebx
pop ecx
pop ecx
je 0x435ec1
cmp byte [eax + 8], bl
je 0x435ec1
or dword [ebp + 0x2c], 8
call fcn.00435589
push ebx
lea eax, [ebp - 0x2c]
push eax
push esi
push str.D:_A_OICI_GA___SY__A_OICI_GA___BA__A_OICI_GA___CO__A_OICI_GA___IU_
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x30], 0xc
call fcn.004657a8
test eax, eax
jne 0x435efe
call dword [0x467358]
push eax
push str.BtwProvisionedHidDevsCreateRegistryBc:_ConvertStringSecurityDescriptorToSecurityDescriptorW_failed._err_d_n
push esi
call fcn.004295b9
add esp, 0xc
jmp 0x436457
push ebx
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x20006
push ebx
push ebx
push ebx
push dword [0x498a8c]
push reloc.WS2_32.dll_bind
call dword [0x4670a4]
push dword [ebp - 0x2c]
mov dword [ebp + 0x14], eax
call dword [0x4671bc]
cmp dword [ebp + 0x14], ebx
je 0x435f3b
push dword [ebp + 0x14]
push str.BtwProvisionedHidDevsCreateRegistryBc:_RegCreateKeyEx_failed._err_d_n
jmp 0x435ef0
mov esi, dword [0x467054]
push 6
push dword [ebp + 0xc]
push 3
push ebx
push dword [0x498b20]
push dword [ebp + 0x28]
call esi
movzx eax, word [ebp + 0x2c]
push 4
pop edi
push edi
mov dword [ebp + 0x24], eax
lea eax, [ebp + 0x24]
push eax
push edi
push ebx
push dword [0x498b1c]
push dword [ebp + 0x28]
call esi
movzx eax, byte [ebp + 0x1b]
push edi
mov dword [ebp + 0x24], eax
lea eax, [ebp + 0x24]
push eax
push edi
push ebx
push dword [0x498b18]
push dword [ebp + 0x28]
call esi
movzx eax, byte [ebp + 0x6c]
and eax, 0x1f
push edi
mov dword [ebp + 0x24], eax
lea eax, [ebp + 0x24]
push eax
push edi
push ebx
push dword [0x498b14]
push dword [ebp + 0x28]
call esi
mov ecx, dword [ebp + 0x20]
movzx eax, word [ecx + 6]
and eax, 0xfff
push eax
add ecx, 8
push ecx
push 3
push ebx
push dword [0x498b10]
mov dword [ebp + 0x24], eax
push dword [ebp + 0x28]
call esi
push 6
push dword [ebp + 0x1c]
call fcn.00408791
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x4362b8
mov ax, word [edi + 6]
and ax, 0xfff
movzx eax, ax
cmp ax, bx
je 0x4362b8
movzx eax, ax
cdq
push 9
pop ecx
idiv ecx
mov dword [ebp + 4], eax
imul eax, eax, 6
push eax
call fcn.00439dca
cmp dword [ebp + 4], ebx
mov dword [ebp + 0xc], eax
mov eax, dword [edi + 8]
pop ecx
mov dword [ebp + 0x2c], ebx
jbe 0x436092
mov edi, dword [ebp + 0xc]
add edi, 2
cmp eax, ebx
je 0x436076
mov cx, word [eax + 8]
mov eax, dword [eax]
cmp eax, ebx
mov word [edi - 2], cx
je 0x43607d
mov cx, word [eax + 8]
mov eax, dword [eax]
cmp eax, ebx
mov word [edi], cx
mov dword [ebp + 0x20], eax
je 0x436084
movzx eax, word [eax + 8]
mov word [edi + 2], ax
movzx eax, ax
push eax
movzx eax, cx
push eax
movzx eax, word [edi - 2]
push eax
push str.BtwProvisionedHidDevsCreateRegistryBc:_Hid_Languages_service_record_lang_0x_x_encoding_0x_x_baseid_0x_x_n
push 4
call fcn.004295b9
mov eax, dword [ebp + 0x20]
mov eax, dword [eax]
add esp, 0x14
inc dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x2c]
add edi, 6
cmp ecx, dword [ebp + 4]
jb 0x43601b
jmp 0x436092
push str.BtwProvisionedHidDevsCreateRegistryBc:_bad_service_record_1_n
jmp 0x436089
push str.BtwProvisionedHidDevsCreateRegistryBc:_bad_service_record_2_n
jmp 0x436089
push str.BtwProvisionedHidDevsCreateRegistryBc:_bad_service_record_3_n
push 4
call fcn.004295b9
pop ecx
pop ecx
push 0x207
push dword [ebp + 0x1c]
call fcn.00408791
cmp eax, ebx
pop ecx
pop ecx
je 0x4362a0
mov cx, word [eax + 6]
and cx, 0xf000
cmp cx, 0x6000
jne 0x4362a0
cmp dword [ebp + 4], ebx
mov eax, dword [eax + 8]
mov dword [ebp + 0x2c], ebx
mov dword [ebp - 8], eax
jbe 0x4362ae
mov eax, dword [ebp + 0xc]
mov dword [ebp], eax
cmp dword [ebp - 8], ebx
je 0x436285
push dword [ebp + 0x2c]
mov eax, dword [ebp - 8]
mov edi, dword [eax + 8]
push str._04d
lea eax, [ebp + 0x50]
push 0xa
push eax
call fcn.0043ce7f
add esp, 0x10
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [ebp + 0x50]
push eax
push dword [ebp + 0x28]
call dword [0x4670a4]
cmp eax, ebx
mov dword [ebp + 0x14], eax
jne 0x43628c
movzx eax, word [edi + 8]
push 4
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push 4
push ebx
push dword [0x498b0c]
push dword [ebp - 4]
call esi
mov eax, dword [ebp]
mov cx, word [edi + 8]
mov word [eax], cx
movzx eax, word [eax + 4]
mov dword [ebp + 0x10], ebx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp + 0x10]
add eax, ecx
push eax
push dword [ebp + 0x1c]
call fcn.00408791
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x436251
mov ax, word [edi + 6]
and ax, 0xfff
movzx eax, ax
cmp ax, bx
mov dword [ebp + 0x20], eax
je 0x436251
mov eax, dword [ebp + 0x10]
sub eax, ebx
je 0x4361bd
dec eax
je 0x4361b6
dec eax
je 0x4361af
mov eax, dword [ebp + 0x10]
add eax, 0xfffffffe
push eax
push 0x48d9b0
lea eax, [ebp + 0x44]
push 0xa
push eax
call fcn.0043ce7f
add esp, 0x10
lea eax, [ebp + 0x44]
jmp 0x4361c2
mov eax, dword [str.ProviderName]
jmp 0x4361c2
mov eax, dword [str.ServiceDescription]
jmp 0x4361c2
mov eax, dword [str.ServiceName]
mov dword [ebp + 8], eax
mov eax, dword [ebp]
movzx eax, word [eax + 2]
cmp ax, 0x6a
jne 0x436220
movzx eax, word [ebp + 0x20]
mov dword [ebp - 0x24], eax
add eax, eax
push eax
call fcn.00439dca
cmp eax, ebx
pop ecx
mov dword [ebp + 0x20], eax
je 0x436257
mov eax, dword [ebp - 0x24]
lea ecx, [eax + eax]
push ecx
push dword [ebp + 0x20]
add edi, 8
push eax
push edi
push ebx
push 0xfde9
call dword [0x467120]
add eax, eax
push eax
push dword [ebp + 0x20]
push 3
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call esi
push dword [ebp + 0x20]
call fcn.00439c78
pop ecx
jmp 0x436257
cmp ax, 0x3f7
jne 0x43623c
movzx eax, word [ebp + 0x20]
push eax
add edi, 8
push edi
push 3
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call esi
jmp 0x436257
movzx eax, ax
push eax
push str.BtwProvisionedHidDevsCreateRegistryBc:_unknown_encoding__d_n
push 4
call fcn.004295b9
add esp, 0xc
jmp 0x436257
cmp dword [ebp + 0x10], 2
ja 0x43625f
inc dword [ebp + 0x10]
jmp 0x43614f
push dword [ebp - 4]
call dword [0x467004]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc dword [ebp + 0x2c]
add dword [ebp], 6
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x2c]
cmp eax, dword [ebp + 4]
jb 0x4360d5
jmp 0x4362ae
push str.BtwProvisionedHidDevsCreateRegistryBc:_bad_service_record_4_n
jmp 0x4362a5
push dword [ebp + 0x14]
push str.BtwProvisionedHidDevsCreateRegistryBc:_RegCreateKeyEx_failed._err_d_n
push 1
call fcn.004295b9
add esp, 0xc
jmp 0x4362ae
push str.BtwProvisionedHidDevsCreateRegistryBc:_HID_SDP_no_LanguageBaseID_n
push 4
call fcn.004295b9
pop ecx
pop ecx
push dword [ebp + 0xc]
call fcn.00439c78
jmp 0x4362c5
push str.BtwProvisionedHidDevsCreateRegistryBc:_HID_SDP_no_Language_n
push 4
call fcn.004295b9
pop ecx
pop ecx
push 0x200
push dword [ebp + 0x1c]
call fcn.00408791
cmp eax, ebx
pop ecx
pop ecx
push 4
pop edi
je 0x4362f5
movzx eax, word [eax + 8]
push edi
mov dword [ebp + 0x24], eax
lea eax, [ebp + 0x24]
push eax
push edi
push ebx
push dword [0x498afc]
push dword [ebp + 0x28]
call esi
push 0x201
push dword [ebp + 0x1c]
call fcn.00408791
cmp eax, ebx
pop ecx
pop ecx
je 0x436321
movzx eax, word [eax + 8]
push edi
mov dword [ebp + 0x24], eax
lea eax, [ebp + 0x24]
push eax
push edi
push ebx
push dword [0x498af8]
push dword [ebp + 0x28]
call esi
push 0x20c
push dword [ebp + 0x1c]
call fcn.00408791
cmp eax, ebx
pop ecx
pop ecx
je 0x43634d
movzx eax, word [eax + 8]
push edi
mov dword [ebp + 0x24], eax
lea eax, [ebp + 0x24]
push eax
push edi
push ebx
push dword [0x498af4]
push dword [ebp + 0x28]
call esi
push 0x203
push dword [ebp + 0x1c]
call fcn.00408791
cmp eax, ebx
pop ecx
pop ecx
je 0x436379
movzx eax, byte [eax + 8]
push edi
mov dword [ebp + 0x24], eax
lea eax, [ebp + 0x24]
push eax
push edi
push ebx
push dword [0x498af0]
push dword [ebp + 0x28]
call esi
mov eax, 0xfffe
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
push ebx
lea eax, [ebp + 0x30]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 1
mov word [ebp + 0x30], 2
mov word [ebp + 0x32], 0x1200
call fcn.00409587
add esp, 0xc
cmp eax, ebx
mov dword [ebp + 0x1c], eax
jne 0x4363bd
push str.BtwProvisionedHidDevsCreateRegistryBc:_Start_no_PnP_information_n
push edi
call fcn.004295b9
pop ecx
pop ecx
jmp 0x43640b
push 0x201
push dword [ebp + 0x1c]
call fcn.00408791
cmp eax, ebx
pop ecx
pop ecx
je 0x4363d7
movzx eax, word [eax + 8]
mov dword [ebp - 0x10], eax
push 0x202
push dword [ebp + 0x1c]
call fcn.00408791
cmp eax, ebx
pop ecx
pop ecx
je 0x4363f1
movzx eax, word [eax + 8]
mov dword [ebp - 0xc], eax
push 0x203
push dword [ebp + 0x1c]
call fcn.00408791
cmp eax, ebx
pop ecx
pop ecx
je 0x43640b
movzx eax, word [eax + 8]
mov dword [ebp - 0x18], eax
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
push dword [0x498aec]
push dword [ebp + 0x28]
call esi
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
push dword [0x498ae8]
push dword [ebp + 0x28]
call esi
push edi
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push dword [0x498ae4]
push dword [ebp + 0x28]
call esi
push str.BtwProvisionedHidDevsCreateRegistryBc:_Success._n
push edi
jmp 0x436450
push str.BtwProvisionedHidDevsCreateRegistryBc:_bad_HID_SDP_record_n
push 1
call fcn.004295b9
pop ecx
pop ecx
push dword [ebp - 0x14]
call fcn.00439c78
mov esi, dword [ebp + 0x14]
pop ecx
pop edi
cmp dword [ebp + 0x28], ebx
je 0x436472
push dword [ebp + 0x28]
call dword [0x467004]
cmp esi, ebx
je 0x43648b
call fcn.00435589
cmp esi, ebx
jle 0x43648b
and esi, 0xffff
or esi, 0x80070000
mov ecx, dword [ebp + 0x5c]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004369c2
add ebp, 0x60
leave
ret