Function at 0x14006fabc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14009e140]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r13, rdx
mov r15, rcx
lea rsi, str.P5_n_
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x14006fb36
test byte [rcx + 0x1c], 4
je 0x14006fb2d
cmp byte [rcx + 0x19], 5
jb 0x14006fb2d
mov edx, 0x16
lea r12, [0x140008e78]
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.14000ffa8
jmp 0x14006fb3d
lea r12, [0x140008e78]
jmp 0x14006fb3d
lea r12, [0x140008e78]
and dword [rsp + 0x34], 0
and dword [rsp + 0x30], 0
lea r8, [r15 + 0x2c]
lea rdx, [0x14000c9a0]
mov rcx, r13
call fcn.14007b6d4
mov ebx, eax
test eax, eax
je 0x14006fb9d
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x14006feef
test byte [rcx + 0x1c], 4
je 0x14006feef
cmp byte [rcx + 0x19], 2
jb 0x14006feef
mov edx, 0x17
mov r9d, eax
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.1400100e0
jmp 0x14006feef
cmp dword [r15 + 0x2c], 0
jne 0x14006fc3c
lea r8, [r15 + 0x28]
lea rdx, [0x14000c9b8]
mov rcx, r13
call fcn.14007b6d4
mov ebx, eax
test eax, eax
je 0x14006fbfe
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x14006feef
test byte [rcx + 0x1c], 4
je 0x14006feef
cmp byte [rcx + 0x19], 2
jb 0x14006feef
mov edx, 0x18
mov r9d, eax
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.1400100e0
jmp 0x14006feef
cmp dword [r15 + 0x28], 0
jne 0x14006fdb4
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x14006fc32
test byte [rcx + 0x1c], 4
je 0x14006fc32
cmp byte [rcx + 0x19], 2
jb 0x14006fc32
mov edx, 0x19
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.14000ffa8
mov ebx, 0x3f1
jmp 0x14006feef
xor r14d, r14d
mov word [rsp + 0x60], r14w
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x62]
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x3c]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, [0x14000c9d0]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, r14d
je 0x14006fcc1
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x14006feef
test byte [rcx + 0x1c], 4
je 0x14006feef
cmp byte [rcx + 0x19], 2
jb 0x14006feef
lea edx, [r14 + 0x1a]
mov r9d, eax
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.1400100e0
jmp 0x14006feef
cmp dword [rsp + 0x38], 1
jne 0x14006fec1
cmp dword [rsp + 0x3c], 0x100
ja 0x14006fec1
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, [0x14000c9d0]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, r14d
je 0x14006fd4a
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x14006feef
test byte [rcx + 0x1c], 4
je 0x14006feef
cmp byte [rcx + 0x19], 2
jb 0x14006feef
mov edx, 0x1c
mov r9d, eax
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.1400100e0
jmp 0x14006feef
lea rdx, [rsp + 0x60]
mov rcx, qword [0x1400a4100]
call fcn.14006c29c
cmp rax, r14
jne 0x14006fda5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x14006feef
test byte [rcx + 0x1c], 4
je 0x14006feef
cmp byte [rcx + 0x19], 2
jb 0x14006feef
mov edx, 0x1d
mov r9d, eax
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.1400100e0
jmp 0x14006feef
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.14003ac68
jmp 0x14006fdb7
xor r14d, r14d
lea r8, [rsp + 0x34]
lea rdx, [0x14000c970]
mov rcx, r13
call fcn.14007b6d4
mov ebx, eax
cmp eax, r14d
je 0x14006fe0f
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x14006feef
test byte [rcx + 0x1c], 4
je 0x14006feef
cmp byte [rcx + 0x19], 2
jb 0x14006feef
mov edx, 0x1f
mov r9d, eax
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.1400100e0
jmp 0x14006feef
lea r8, [rsp + 0x30]
lea rdx, [0x14000c988]
mov rcx, r13
call fcn.14007b6d4
mov ebx, eax
cmp eax, r14d
je 0x14006fe67
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x14006feef
test byte [rcx + 0x1c], 4
je 0x14006feef
cmp byte [rcx + 0x19], 2
jb 0x14006feef
mov edx, 0x20
mov r9d, eax
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.1400100e0
jmp 0x14006feef
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x44], eax
lea rcx, [r15 + 0x30]
mov rax, qword [rsp + 0x40]
mov qword [rcx], rax
call fcn.14006f5fc
cmp eax, r14d
jne 0x14006feef
mov ebx, 0x57
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x14006feef
test byte [rcx + 0x1c], 4
je 0x14006feef
cmp byte [rcx + 0x19], 2
jb 0x14006feef
lea edx, [rbx - 0x36]
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.14000ffa8
jmp 0x14006feef
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x14006feea
test byte [rcx + 0x1c], 4
je 0x14006feea
cmp byte [rcx + 0x19], 2
jb 0x14006feea
mov edx, 0x1b
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.14000ffa8
mov ebx, 0x3f1
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14008c5b0
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rsi
ret