Function at 0x1400db564
Capabilities:
Get geographical location
Get system information on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1e8]
sub rsp, 0x2c0
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14014d030]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, rdx
xor edx, edx
mov r8d, 0x118
lea rcx, [rbp + 0x94]
call sub.msvcrt.dll_memset
xor r13d, r13d
mov dword [rbp + 0x58], r13d
xor edx, edx
lea r8d, [r13 + 0x2c]
lea rcx, [rbp + 0x5c]
call sub.msvcrt.dll_memset
mov qword [rbp - 0x60], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x5c], r13d
mov qword [rbp], r13
mov qword [rbp + 8], r13
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
mov esi, r13d
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], r13
mov r15d, r13d
mov dword [rsp + 0x54], r13d
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r13
mov r12d, r13d
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
mov dword [rbp + 0x90], 0x11c
lea rcx, [rbp + 0x90]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
mov ebx, eax
lea r14d, [r13 + 1]
test eax, eax
jns 0x1400db677
bts ebx, 0x1c
jmp 0x1400dc000
movzx eax, word [rbp + 0x1a8]
mov qword [rbp + 0x30], rax
movzx ecx, byte [rbp + 0x1aa]
sub ecx, r14d
je 0x1400db6ad
sub ecx, r14d
je 0x1400db6a5
cmp ecx, r14d
je 0x1400db69d
mov r14d, r13d
jmp 0x1400db6b3
mov r14d, 7
jmp 0x1400db6b3
mov r14d, 0xa
jmp 0x1400db6b3
mov r14d, 6
lea rcx, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [0x140128698]
lea rdx, str.SOFTWAREMicrosoftSQMClientWindowsCommonDatapoints
mov rbx, 0xffffffff80000002
mov rcx, rbx
call fcn.1400d756c
mov dword [rbp - 0x2c], eax
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [0x140128710]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, rbx
call fcn.1400d756c
mov dword [rsp + 0x4c], eax
call fcn.1400d7648
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.InstallDate
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov rcx, rbx
call fcn.1400d756c
test eax, eax
je 0x1400db757
cdqe
movabs rcx, 0x2b6109100
add rax, rcx
imul rcx, rax, 0x989680
mov rax, rcx
sar rax, 0x20
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x44], eax
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1400db793
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rcx, qword [rbp - 0x60]
cmp rcx, rbx
jbe 0x1400db793
sub rcx, rbx
movabs rax, 0xe5109ec205d7bea7
mul rcx
shr rdx, 0x1d
mov qword [rsp + 0x40], rdx
mov eax, edx
mov dword [rsp + 0x5c], edx
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.9292
lea rdx, str.SOFTWAREMicrosoftSQMClientWindowsCommonDatapoints
mov rcx, 0xffffffff80000002
call fcn.1400d756c
mov dword [rbp - 0x38], eax
mov ebx, 1
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [0x14011a1b8]
lea r8, str.svcVersion
lea rdx, str.SOFTWAREMicrosoftInternet_Explorer
mov rcx, 0xffffffff80000002
call fcn.1400d772c
test eax, eax
js 0x1400db852
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea r9, [0x14011a1b8]
lea r8, str.svcUpdateVersion
lea rdx, str.SOFTWAREMicrosoftInternet_Explorer
mov rcx, 0xffffffff80000002
call fcn.1400d772c
test eax, eax
js 0x1400db852
mov r9, qword [rbp - 0x10]
mov r8, qword [rbp]
lea rdx, str._s__s
lea rcx, [rbp - 0x80]
call fcn.1400d9360
mov rsi, qword [rbp - 0x80]
test eax, eax
jns 0x1400db856
test rsi, rsi
je 0x1400db852
mov word [rsi], r13w
mov dword [rbp - 0x74], r13d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], r13d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, str.Unknown
lea r8, str.EditionID
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.1400d772c
test eax, eax
jns 0x1400db8a1
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x1400db89c
mov word [rax], r13w
mov dword [rsp + 0x6c], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.9197
lea rdx, str.SOFTWAREMicrosoftSQMClientWindowsCommonDatapoints
mov rcx, 0xffffffff80000002
call fcn.1400d756c
mov dword [rbp - 0x34], eax
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [0x14012896c]
lea rdx, str.SOFTWAREMicrosoftSQMClientWindowsCommonDatapoints
mov rcx, 0xffffffff80000002
call fcn.1400d756c
mov dword [rbp - 0x30], eax
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.12729
lea rdx, str.SOFTWAREMicrosoftSQMClientWindowsCommonDatapoints
mov rcx, 0xffffffff80000002
call fcn.1400d756c
mov dword [rbp - 0x58], eax
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.12730
lea rdx, str.SOFTWAREMicrosoftSQMClientWindowsCommonDatapoints
mov rcx, 0xffffffff80000002
call fcn.1400d756c
mov dword [rbp - 0x54], eax
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.12736
lea rdx, str.SOFTWAREMicrosoftSQMClientWindowsCommonDatapoints
mov rcx, 0xffffffff80000002
call fcn.1400d756c
mov dword [rbp - 0x28], eax
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.12737
lea rdx, str.SOFTWAREMicrosoftSQMClientWindowsCommonDatapoints
mov rcx, 0xffffffff80000002
call fcn.1400d756c
mov dword [rbp - 0x50], eax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [0x14011a1b8]
lea r8, str.12738
lea rdx, str.SOFTWAREMicrosoftSQMClientWindowsCommonDatapoints
mov rcx, 0xffffffff80000002
call fcn.1400d772c
test eax, eax
jns 0x1400db9c6
mov rax, qword [rbp - 0x70]
test rax, rax
je 0x1400db9c2
mov word [rax], r13w
mov dword [rbp - 0x64], r13d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [0x14011a1b8]
lea r8, str.CurrentType
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call fcn.1400d772c
test eax, eax
js 0x1400dba11
mov rcx, qword [rbp + 0x10]
call fcn.1400d961c
test rax, rax
cmovne r15d, ebx
mov dword [rsp + 0x54], r15d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.12675
lea rdx, str.SOFTWAREMicrosoftSQMClientWindowsCommonDatapoints
mov r15, 0xffffffff80000002
mov rcx, r15
call fcn.1400d756c
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.12676
lea rdx, str.SOFTWAREMicrosoftSQMClientWindowsCommonDatapoints
mov rcx, r15
call fcn.1400d756c
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.12677
lea rdx, str.SOFTWAREMicrosoftSQMClientWindowsCommonDatapoints
mov rcx, r15
call fcn.1400d756c
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.12678
lea rdx, str.SOFTWAREMicrosoftSQMClientWindowsCommonDatapoints
mov rcx, r15
call fcn.1400d756c
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r9, [0x14011a1b8]
lea r8, str.BuildLabEx
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov rcx, r15
call fcn.1400d772c
test eax, eax
js 0x1400dbb2b
mov rbx, qword [rbp - 0x20]
mov rdx, rbx
lea rcx, [rbp + 0x20]
call fcn.1400d8f6c
test eax, eax
js 0x1400dbb26
mov qword [rsp + 0x20], rbx
mov r9d, dword [rbp + 0x98]
mov r8d, dword [rbp + 0x94]
lea rdx, str._d._d._s
lea rcx, [rsp + 0x70]
call fcn.1400d9360
mov r12, qword [rsp + 0x70]
test eax, eax
jns 0x1400dbb1f
test r12, r12
je 0x1400dbb26
mov word [r12], r13w
jmp 0x1400dbb26
mov ebx, 1
jmp 0x1400dbb30
mov ebx, 1
mov dword [rsp + 0x7c], r13d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
lea r9, [0x14011a1b8]
lea r8, str.UpdateID
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionFlightingBuild
mov rcx, r15
call fcn.1400d772c
mov r15, qword [rbp - 0x48]
test eax, eax
jns 0x1400dbb75
test r15, r15
je 0x1400dbb6f
mov word [r15], r13w
mov dword [rbp - 0x3c], r13d
jmp 0x1400dbb79
mov r13d, dword [rbp - 0x3c]
mov r8d, dword [rbp + 0x94]
lea rdx, str.vermaj
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, dword [rbp + 0x98]
lea rdx, str.vermin
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, dword [rbp + 0x9c]
lea rdx, str.verbld
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, dword [rsp + 0x4c]
lea rdx, str.vercsdbld
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, dword [rsp + 0x4c]
lea rdx, str.verqfe
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, dword [rsp + 0x4c]
lea rdx, str.csdbld
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
movzx r8d, word [rbp + 0x1a4]
lea rdx, str.versp
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
movzx r8d, word [rbp + 0x58]
lea rdx, str.arch
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov r8d, eax
lea rdx, str.lcid
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov r8d, eax
lea rdx, str.geoid
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, r14d
lea rdx, [0x140128ba0]
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
xor r14d, r14d
test eax, eax
js 0x1400dbffa
mov r8d, r14d
cmp dword [rbp - 0x2c], r14d
seta r8b
lea rdx, str.domain
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8, qword [rbp + 0x30]
lea rdx, str.prodsuite
mov rcx, rdi
call fcn.1400d6a20
mov ebx, eax
test eax, eax
js 0x1400dbffa
movzx r8d, byte [rbp + 0x1aa]
lea rdx, str.ntprodtype
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, dword [rbp + 0xa0]
lea rdx, str.platid
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x1400dbd81
mov r8, rax
lea rdx, [0x140128bf8]
mov rcx, rdi
call fcn.1400d6a20
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov eax, dword [rsp + 0x5c]
test eax, eax
je 0x1400dbda5
mov r8d, eax
lea rdx, str.tmsi
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, dword [rbp - 0x38]
lea rdx, str.osinsty
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
test rsi, rsi
je 0x1400dbdea
cmp dword [rbp - 0x74], r14d
jbe 0x1400dbdea
lea rcx, [rdi + 8]
mov r8, rsi
lea rdx, str.iever
call fcn.1400db078
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, dword [rbp - 0x34]
lea rdx, str.portos
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, dword [rbp - 0x30]
lea rdx, [0x140128c40]
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, dword [rbp - 0x58]
lea rdx, str.svolsz
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, dword [rbp - 0x54]
lea rdx, str.wimbt
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, dword [rbp - 0x28]
lea rdx, str.blddt
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, dword [rbp - 0x50]
lea rdx, str.bldtm
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov rax, qword [rbp - 0x70]
test rax, rax
je 0x1400dbec4
cmp dword [rbp - 0x64], r14d
jbe 0x1400dbec4
lea rcx, [rdi + 8]
mov r8, rax
lea rdx, str.bldbrch
call fcn.1400db078
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, dword [rsp + 0x54]
lea rdx, str.bldchk
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov eax, dword [rsp + 0x40]
mov esi, dword [rsp + 0x58]
mov r14d, dword [rsp + 0x48]
test eax, eax
jne 0x1400dbf03
test esi, esi
jne 0x1400dbf03
test r14d, r14d
jne 0x1400dbf03
cmp dword [rsp + 0x50], r14d
jbe 0x1400dbf75
mov r8d, eax
lea rdx, str.wpvermaj
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, esi
lea rdx, str.wpvermin
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, r14d
lea rdx, str.wpbuildmaj
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8d, dword [rsp + 0x50]
lea rdx, str.wpbuildmin
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dbffa
add rdi, 8
lea r8, str.windows
lea rdx, [0x140128d08]
mov rcx, rdi
call fcn.1400db078
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov r8, r12
lea rdx, str.osver
mov rcx, rdi
call fcn.1400db078
mov ebx, eax
test eax, eax
js 0x1400dbffa
test r15, r15
je 0x1400dbfcf
test r13d, r13d
je 0x1400dbfcf
mov r8, r15
lea rdx, str.buildflightid
mov rcx, rdi
call fcn.1400db078
mov ebx, eax
test eax, eax
js 0x1400dbffa
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x1400dbff8
cmp dword [rsp + 0x6c], 0
jbe 0x1400dbff8
mov r8, rax
lea rdx, str.edition
mov rcx, rdi
call fcn.1400db078
mov ebx, eax
test eax, eax
js 0x1400dbffa
xor ebx, ebx
mov r14d, 1
mov edx, r14d
lea rcx, [rbp + 0x38]
call fcn.1400d9748
nop
mov edx, r14d
lea rcx, [rsp + 0x60]
call fcn.1400d9748
nop
mov edx, r14d
lea rcx, [rbp - 0x48]
call fcn.1400d9748
nop
mov edx, r14d
lea rcx, [rsp + 0x70]
call fcn.1400d9748
nop
mov edx, r14d
lea rcx, [rbp + 0x20]
call fcn.1400d9748
nop
mov edx, r14d
lea rcx, [rbp - 0x20]
call fcn.1400d9748
nop
mov edx, r14d
lea rcx, [rbp + 0x10]
call fcn.1400d9748
nop
mov edx, r14d
lea rcx, [rbp - 0x70]
call fcn.1400d9748
nop
mov edx, r14d
lea rcx, [rbp - 0x80]
call fcn.1400d9748
nop
mov edx, r14d
lea rcx, [rbp - 0x10]
call fcn.1400d9748
nop
mov edx, r14d
lea rcx, [rbp]
call fcn.1400d9748
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140106ed0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret