Function at 0x1000656b8
Capabilities:
Check os version
Get geographical location
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
mov eax, 0x2530
call fcn.1000801f0
sub rsp, rax
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x2520], rax
lea rsi, [rcx + 0x28]
xor ebp, ebp
mov ebx, 0x80004005
cmp qword [rsi], rbp
je 0x1000656fc
xor eax, eax
jmp 0x100065a5c
lea rax, [rsp + 0x270]
cmp rax, rbp
je 0x100065a5a
mov r12d, 0x105
lea rdx, [rsp + 0x60]
xor ecx, ecx
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, ebp
je 0x100065a5a
lea rax, [rsp + 0x60]
cmp rax, rbp
je 0x100065741
lea rcx, [rsp + 0x60]
call fcn.100054858
jmp 0x100065744
mov rax, rbp
lea rdx, [rsp + 0x270]
mov r8, r12
mov rcx, rax
call fcn.100052ef0
cmp eax, ebp
jl 0x100065a5a
lea rcx, [0x10002d6a0]
mov qword [rsp + 0x50], rbp
mov word [rsp + 0x40], bp
mov word [rsp + 0x14d0], bp
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
cmp rax, rbp
je 0x1000657e1
lea rcx, [rsp + 0x60]
mov bl, bpl
mov dword [rsp + 0x60], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, 1
jne 0x1000657b4
cmp dword [rsp + 0x70], 2
jne 0x1000657b1
cmp dword [rsp + 0x64], 6
mov bl, al
jae 0x1000657b4
mov bl, bpl
neg bl
lea r8, [rsp + 0x14d0]
mov r9d, 0x824
sbb edx, edx
mov rcx, rdi
and edx, 2
add edx, 0x1269
call qword [sym.imp.USER32.dll_LoadStringW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, 0x1048
cmp bp, word [rsp + 0x14d0]
je 0x100065808
lea rcx, [rsp + 0x14d0]
mov edx, 0x5b
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbp
je 0x10006581f
lea r8, [0x100024a20]
lea rcx, [rsp + 0x14d0]
mov rdx, rdi
call fcn.100039e6c
lea rdx, [rsp + 0x40]
lea rcx, [0x100025e10]
call fcn.10005795c
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
movzx ecx, word [rsp + 0x40]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x270]
lea rcx, [rsp + 0x480]
lea r9, [rsp + 0x14d0]
lea r8, [0x10002d6c0]
mov rdx, rdi
mov qword [rsp + 0x20], rax
call fcn.10003a0f0
mov ecx, 0x10
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
cmp eax, 0xffffffff
je 0x1000658af
lea r8, [0x10002d710]
lea rcx, [rsp + 0x60]
mov r9d, eax
mov rdx, r12
call fcn.10003a080
cmp eax, ebp
jl 0x1000658af
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x480]
mov rdx, rdi
call fcn.100039fb0
lea rax, [rsp + 0x50]
lea rdx, [0x100026cd0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r12d, 4
cmp eax, ebp
jne 0x100065a05
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, [0x10002d728]
xor r8d, r8d
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], 0x20a
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x10006598c
cmp dword [rsp + 0x40], 1
jne 0x10006598c
lea rcx, [rsp + 0x60]
jmp 0x100065977
cmp word [rbx], 0x2d
jne 0x10006593e
add rbx, 2
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wtol]
cmp eax, ebp
jbe 0x100065975
lea r8, [0x10002d748]
lea rcx, [rsp + 0x480]
mov rdx, rdi
call fcn.100039fb0
lea rcx, [rsp + 0x480]
mov r8, rbx
mov rdx, rdi
call fcn.100039fb0
xor ecx, ecx
lea rdx, [0x1000261f8]
call qword [sym.imp.msvcrt.dll_wcstok]
mov rbx, rax
cmp rax, rbp
jne 0x100065934
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
lea rdx, [0x10002d758]
xor r8d, r8d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x1000659fa
cmp dword [rsp + 0x40], r12d
jne 0x1000659fa
mov eax, dword [rsp + 0x48]
lea r9, [rsp + 0x480]
lea r8, [0x10002d768]
lea rcx, [rsp + 0x480]
mov rdx, rdi
mov dword [rsp + 0x20], eax
call fcn.10003a0f0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [0x10002d788]
lea rcx, [rsp + 0x480]
mov rdx, rdi
call fcn.100039fb0
lea rdx, [rsp + 0x480]
mov rcx, rsi
call fcn.100052cbc
cmp eax, ebp
mov ebx, eax
jl 0x100065a46
mov r8, qword [rsi]
lea rdx, [0x10002d7b0]
mov ecx, r12d
call fcn.1000527f4
jmp 0x100065a5a
lea rdx, [0x10002d7d8]
mov r8d, eax
mov ecx, 2
call fcn.1000527f4
mov eax, ebx
mov rcx, qword [rsp + 0x2520]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x2530]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret