Function at 0x180006020
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf0
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov r12, r8
movsxd r14, r9d
mov r15d, edx
mov ebx, ecx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0xa0
call sub.ntdll.dll_memset
movzx edi, word [rbp + 0x7f]
lea rcx, [rsp + 0x30]
xor edx, edx
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNELBASE.dll_NlsValidateLocale]
nop dword [rax + rax]
xor r13d, r13d
test r14d, r14d
js 0x1800062d8
test r12, r12
jne 0x18000609c
test r14d, r14d
jg 0x1800062d8
test rax, rax
je 0x1800062d8
cmp ebx, 0xffffffff
je 0x1800062e9
mov ecx, ebx
call fcn.180005fac
mov rsi, rax
test rax, rax
je 0x1800062d8
mov eax, r15d
sub eax, 1
je 0x180006277
sub eax, 5
je 0x180006148
sub eax, 1
je 0x180006100
cmp eax, 6
je 0x1800060f2
mov r9d, r14d
mov r8, r12
mov edx, r15d
mov rcx, rsi
call fcn.18000631c
jmp 0x1800062eb
mov ecx, dword [rsi + 0x38]
mov r8d, 3
jmp 0x180006282
test di, di
jne 0x180006114
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetUserDefaultLangID]
nop dword [rax + rax]
movzx edi, ax
movzx ecx, di
mov edx, 0x400
mov dword [rsp + 0x30], ecx
mov r8d, ecx
cmp di, dx
jae 0x180006131
or ecx, edx
mov dword [rsp + 0x30], ecx
mov r8d, ecx
test r8d, r8d
je 0x1800062e9
mov edx, 0x10
lea r8d, [rdx - 8]
jmp 0x180006287
test di, di
jne 0x18000615c
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetUserDefaultLangID]
nop dword [rax + rax]
movzx edi, ax
mov ebx, 0x50
movzx ecx, di
mov r9d, ebx
mov dword [rsp + 0x30], ecx
lea r8, [rsp + 0x40]
lea r15d, [rbx + 9]
mov edx, r15d
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
nop dword [rax + rax]
test eax, eax
jne 0x1800061bb
mov ecx, 0x3ff
movzx eax, di
and ax, cx
lea edx, [rcx + 1]
or ax, dx
cmp ax, di
je 0x1800061bb
movzx ecx, ax
lea r8, [rsp + 0x40]
mov r9d, ebx
mov dword [rsp + 0x30], ecx
mov edx, r15d
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
nop dword [rax + rax]
cmp word [rsp + 0x40], r13w
je 0x1800062e9
mov rcx, rbx
lea rax, [rsp + 0x40]
cmp word [rax], r13w
je 0x1800061df
add rax, 2
sub rcx, 1
jne 0x1800061cf
test rcx, rcx
je 0x1800061ec
mov rax, rbx
sub rax, rcx
jmp 0x1800061ef
mov rax, r13
test rcx, rcx
je 0x1800062b6
mov rcx, rbx
lea rdx, [rsp + 0x40]
lea rdx, [rdx + rax*2]
sub rcx, rax
je 0x18000623e
lea r8, [rax + 0x7fffffae]
add r8, rcx
lea rax, [0x180086688]
sub rax, rdx
test r8, r8
je 0x18000623e
movzx r9d, word [rax + rdx]
test r9w, r9w
je 0x18000623e
mov word [rdx], r9w
dec r8
add rdx, 2
sub rcx, 1
jne 0x18000621d
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
mov word [rax], r13w
je 0x1800062b6
lea r8, [rsi + 0x3c]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.18000b638
test eax, eax
js 0x1800062b6
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll__wcslwr]
nop dword [rax + rax]
jmp 0x18000629a
cmp dword [rsi + 0x34], 0x10
jne 0x1800062e9
mov ecx, dword [rsi]
xor r8d, r8d
mov edx, 0xa
mov ebx, 0x50
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], ebx
call fcn.1800580c4
lea rcx, [rsp + 0x40]
call fcn.18000865c
movsxd rbx, eax
mov rcx, rbx
inc ebx
test r14d, r14d
je 0x1800062d4
cmp r14d, ebx
jge 0x1800062bd
mov ecx, 0x7a
jmp 0x1800062dd
mov r9, rcx
lea r8, [rsp + 0x40]
mov rcx, r12
mov rdx, r14
call fcn.180007094
test eax, eax
js 0x1800062e9
mov eax, ebx
jmp 0x1800062eb
mov ecx, 0x57
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.180024680
mov rbx, qword [rsp + 0x138]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret