Function at 0x1400597d4
Capabilities:
Get geographical location
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov rax, qword [0x1400d9180]
xor rax, rsp
mov qword [rbp + 8], rax
mov eax, dword [rbp + 0x88]
mov r11d, r9d
mov r9, qword [rbp + 0x80]
mov r10, r8
xor r15d, r15d
mov byte [rsp + 0x60], dl
mov r8d, r11d
mov rdx, r10
mov dword [rsp + 0x20], eax
mov r14, rcx
mov r12d, r15d
mov qword [rsp + 0x58], r15
movzx esi, r15w
call fcn.1400595b4
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14005a145
lea ecx, [r15 + 2]
lea rdx, [rbp - 0x30]
xor r8d, r8d
mov word [rbp - 0x30], cx
mov ecx, 0x1124
mov word [rbp - 0x2e], cx
mov rcx, rax
call fcn.14000adc8
mov rdi, rax
test rax, rax
jne 0x140059875
lea rdx, str.BtwProvisionedHidDevsCreateRegistryBc:_no_HID_SDP_record
jmp 0x14005a12e
mov edx, 0x206
mov rcx, rax
call fcn.140009c38
mov r11, rax
test rax, rax
je 0x14005a127
movzx eax, word [rax + 0xa]
mov edx, 0xf000
mov r8d, 0x6000
and ax, dx
cmp ax, r8w
jne 0x14005a127
mov rcx, qword [r11 + 0xc]
test rcx, rcx
je 0x14005a127
movzx eax, word [rcx + 0xa]
and ax, dx
cmp ax, r8w
jne 0x14005a127
mov rax, qword [rcx + 0xc]
test rax, rax
je 0x14005a127
mov r13, qword [rax]
test r13, r13
je 0x14005a127
movzx eax, word [r13 + 0xa]
mov ecx, 0x4000
and ax, dx
cmp ax, cx
jne 0x14005a127
mov ebx, 0x202
mov rcx, rdi
mov edx, ebx
call fcn.140009c38
test rax, rax
je 0x14005a127
mov edx, ebx
mov rcx, rdi
call fcn.140009c38
lea edx, [rbx + 2]
mov rcx, rdi
mov r15b, byte [rax + 0xc]
call fcn.140009c38
mov ebx, 1
test rax, rax
je 0x14005993a
cmp byte [rax + 0xc], r12b
je 0x14005993a
mov esi, ebx
mov edx, 0x205
mov rcx, rdi
call fcn.140009c38
mov ecx, 4
test rax, rax
je 0x14005995a
cmp byte [rax + 0xc], r12b
je 0x14005995a
or si, cx
mov edx, 0x20d
mov rcx, rdi
call fcn.140009c38
test rax, rax
je 0x140059976
cmp byte [rax + 0xc], r12b
je 0x140059976
or si, 2
mov edx, 0x208
mov rcx, rdi
call fcn.140009c38
test rax, rax
je 0x140059992
cmp byte [rax + 0xc], r12b
je 0x140059992
or si, 8
call fcn.1400596f4
lea r8, [rbp - 0x40]
lea rcx, str.D:_A_OICI_GA___SY__A_OICI_GA___BA__A_OICI_GA___CO__A_OICI_GA___IU_
xor r9d, r9d
mov edx, ebx
mov dword [rbp - 0x38], ebx
mov dword [rbp - 0x48], 0x18
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x1400599d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.BtwProvisionedHidDevsCreateRegistryBc:_ConvertStringSecurityDescriptorToSecurityDescriptorW_failed._err_d_n
mov r8d, eax
mov ecx, ebx
call fcn.140046d10
jmp 0x14005a138
and qword [rsp + 0x40], r12
mov rdx, qword [str.SoftwareWidcommBTConfigHID]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x48]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [rbp - 0x40]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r12d, r12d
je 0x140059a33
mov r8d, r12d
lea rdx, str.BtwProvisionedHidDevsCreateRegistryBc:_RegCreateKeyEx_failed._err_d_n
jmp 0x1400599ca
mov rdx, qword [str.t_n_f_]
mov rcx, qword [rsp + 0x58]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 6
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, qword [str.BtAttributes]
mov rcx, qword [rsp + 0x58]
mov r14d, 4
lea rax, [rsp + 0x50]
movzx r11d, si
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], r11d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, qword [str.Usage]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
movzx r11d, r15b
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], r11d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movzx r11d, byte [rsp + 0x60]
mov rdx, qword [str.MajorDeviceClass]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
and r11d, 0x1f
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x50], r11d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movzx r11d, word [r13 + 0xa]
mov rdx, qword [str.ReportDescriptor]
mov rcx, qword [rsp + 0x58]
lea rax, [r13 + 0xc]
mov esi, 0xfff
lea r9d, [r14 - 1]
and r11d, esi
xor r8d, r8d
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], r11d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [r14 + 2]
mov rcx, rdi
call fcn.140009c38
xor r15d, r15d
mov r13, rax
test rax, rax
je 0x140059eef
movzx ecx, word [rax + 0xa]
and cx, si
je 0x140059eef
movzx ecx, cx
mov eax, 0x38e38e39
imul ecx
mov esi, edx
sar esi, 1
mov eax, esi
shr eax, 0x1f
add esi, eax
mov dword [rbp - 0x6c], esi
lea rcx, [rsi + rsi*2]
add rcx, rcx
call fcn.14005c274
mov rcx, qword [r13 + 0xc]
mov qword [rbp - 0x60], rax
test esi, esi
je 0x140059c1c
lea r13, [rax + 2]
test rcx, rcx
je 0x140059c07
mov rax, qword [rcx]
movzx edx, word [rcx + 0xc]
mov word [r13 - 2], dx
test rax, rax
je 0x140059bfe
mov r14, qword [rax]
movzx ecx, word [rax + 0xc]
mov word [r13], cx
test r14, r14
je 0x140059bf5
movzx eax, word [r14 + 0xc]
movzx r8d, dx
movzx r9d, cx
lea rdx, str.BtwProvisionedHidDevsCreateRegistryBc:_Hid_Languages_service_record_lang_0x_x_encoding_0x_x_baseid_0x_x_n
mov ecx, 4
mov word [r13 + 2], ax
mov dword [rsp + 0x20], eax
call fcn.140046d10
mov rcx, qword [r14]
add r15d, ebx
add r13, 6
cmp r15d, esi
jb 0x140059b90
mov r14d, 4
jmp 0x140059c1c
lea rdx, str.BtwProvisionedHidDevsCreateRegistryBc:_bad_service_record_3_n
jmp 0x140059c0e
lea rdx, str.BtwProvisionedHidDevsCreateRegistryBc:_bad_service_record_2_n
jmp 0x140059c0e
lea rdx, str.BtwProvisionedHidDevsCreateRegistryBc:_bad_service_record_1_n
mov r14d, 4
mov ecx, r14d
call fcn.140046d10
mov edx, 0x207
mov rcx, rdi
call fcn.140009c38
xor r15d, r15d
test rax, rax
je 0x140059ee6
movzx ecx, word [rax + 0xa]
mov edx, 0xf000
and cx, dx
mov edx, 0x6000
cmp cx, dx
jne 0x140059ee6
mov r14, qword [rax + 0xc]
mov ecx, r15d
mov qword [rbp - 0x50], r14
mov dword [rsp + 0x7c], ecx
test esi, esi
je 0x140059eab
mov r15, qword [rbp - 0x60]
add r15, 2
test r14, r14
je 0x140059ecf
mov r13, qword [r14 + 0xc]
mov r9d, ecx
lea r8, str._04d
lea rcx, [rbp - 0x18]
mov edx, 0xa
call fcn.14005d88c
and qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x80]
lea rdx, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov r12d, eax
mov dword [rbp - 0x70], eax
test eax, eax
jne 0x140059ebc
movzx eax, word [r13 + 0xc]
mov rdx, qword [str.LangId]
lea ecx, [r12 + 4]
mov dword [rsp + 0x28], ecx
mov dword [rbp - 0x78], eax
mov r9d, ecx
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x78]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movzx r11d, word [r13 + 0xc]
lea esi, [r12 + 2]
mov word [r15 - 2], r11w
xor r13d, r13d
mov r12d, 0xfff
movzx edx, r13w
mov rcx, rdi
add dx, word [r15 + 2]
call fcn.140009c38
mov rdx, rax
mov qword [rbp - 0x58], rax
test rax, rax
je 0x140059e6e
movzx eax, word [rax + 0xa]
and ax, r12w
mov word [rsp + 0x60], ax
je 0x140059e6e
mov ecx, r13d
test r13d, r13d
je 0x140059d9f
dec ecx
je 0x140059d96
dec ecx
je 0x140059d8d
lea r9d, [r13 - 2]
lea r8, [0x1400c0618]
lea rcx, [rbp - 8]
mov edx, 0xa
call fcn.14005d88c
movzx eax, word [rsp + 0x60]
mov rdx, qword [rbp - 0x58]
lea r14, [rbp - 8]
jmp 0x140059da6
mov r14, qword [str.ProviderName]
jmp 0x140059da6
mov r14, qword [str.ServiceDescription]
jmp 0x140059da6
mov r14, qword [str.ServiceName]
cmp word [r15], 0x6a
jne 0x140059e24
movzx eax, ax
mov dword [rbp - 0x74], eax
add eax, eax
movsxd rcx, eax
mov dword [rsp + 0x60], eax
call fcn.14005c274
mov qword [rbp - 0x68], rax
test rax, rax
je 0x140059e73
mov ecx, dword [rsp + 0x60]
mov r8, qword [rbp - 0x58]
mov r9d, dword [rbp - 0x74]
mov dword [rsp + 0x28], ecx
add r8, 0xc
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rbp - 0x80]
mov r9d, 3
add eax, eax
xor r8d, r8d
mov rdx, r14
mov dword [rsp + 0x28], eax
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x68]
call fcn.14005c1e4
jmp 0x140059e73
mov ecx, 0x3f7
cmp word [r15], cx
jne 0x140059e57
lea rcx, [rdx + 0xc]
movzx eax, ax
mov r9d, 3
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x80]
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x140059e73
movzx r8d, word [r15]
lea rdx, str.BtwProvisionedHidDevsCreateRegistryBc:_unknown_encoding__d_n
mov ecx, 4
call fcn.140046d10
jmp 0x140059e73
cmp r13d, esi
ja 0x140059e7b
add r13d, ebx
jmp 0x140059d21
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rbp - 0x50]
mov ecx, dword [rsp + 0x7c]
mov r14, qword [r14]
mov r12d, dword [rbp - 0x70]
add ecx, ebx
add r15, 6
mov dword [rsp + 0x7c], ecx
mov qword [rbp - 0x50], r14
cmp ecx, dword [rbp - 0x6c]
jb 0x140059c6e
mov r14d, 4
mov rcx, qword [rbp - 0x60]
call fcn.14005c1e4
jmp 0x140059efe
lea rdx, str.BtwProvisionedHidDevsCreateRegistryBc:_RegCreateKeyEx_failed._err_d_n
mov r8d, eax
mov ecx, ebx
call fcn.140046d10
jmp 0x140059eab
lea rdx, str.BtwProvisionedHidDevsCreateRegistryBc:_bad_service_record_4_n
mov r14d, 4
mov ecx, r14d
call fcn.140046d10
jmp 0x140059eb1
lea rdx, str.BtwProvisionedHidDevsCreateRegistryBc:_HID_SDP_no_LanguageBaseID_n
jmp 0x140059edc
lea rdx, str.BtwProvisionedHidDevsCreateRegistryBc:_HID_SDP_no_Language_n
mov ecx, r14d
call fcn.140046d10
mov edx, 0x200
mov rcx, rdi
call fcn.140009c38
test rax, rax
je 0x140059f3f
movzx eax, word [rax + 0xc]
mov rdx, qword [str._b_v_f_]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov r13d, 0x201
mov rcx, rdi
mov edx, r13d
call fcn.140009c38
test rax, rax
je 0x140059f84
movzx eax, word [rax + 0xc]
mov rdx, qword [str.ParserVersion]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, 0x20c
mov rcx, rdi
call fcn.140009c38
test rax, rax
je 0x140059fc5
movzx eax, word [rax + 0xc]
mov rdx, qword [str.__v_f_]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, 0x203
mov rcx, rdi
mov edx, esi
call fcn.140009c38
test rax, rax
je 0x14005a008
movzx eax, byte [rax + 0xc]
mov rdx, qword [str.CountryCode]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdi, qword [rsp + 0x68]
mov eax, 0xfffe
lea rdx, [rbp - 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x74], eax
mov eax, 2
mov word [rbp - 0x30], ax
mov eax, 0x1200
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x70], ebx
mov word [rbp - 0x2e], ax
call fcn.14000adc8
mov rbx, rax
test rax, rax
jne 0x14005a058
lea rdx, str.BtwProvisionedHidDevsCreateRegistryBc:_Start_no_PnP_information_n
mov ecx, r14d
call fcn.140046d10
jmp 0x14005a0a1
mov edx, r13d
mov rcx, rax
call fcn.140009c38
test rax, rax
je 0x14005a070
movzx eax, word [rax + 0xc]
mov dword [rsp + 0x74], eax
mov edx, 0x202
mov rcx, rbx
call fcn.140009c38
test rax, rax
je 0x14005a08a
movzx eax, word [rax + 0xc]
mov dword [rsp + 0x78], eax
mov edx, esi
mov rcx, rbx
call fcn.140009c38
test rax, rax
je 0x14005a0a1
movzx eax, word [rax + 0xc]
mov dword [rsp + 0x70], eax
mov rdx, qword [str.P_v_f_]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x74]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, qword [str.ProductId]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x78]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, qword [str.p_v_f_]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x70]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdx, str.BtwProvisionedHidDevsCreateRegistryBc:_Success._n
mov ecx, r14d
call fcn.140046d10
jmp 0x14005a13d
lea rdx, str.BtwProvisionedHidDevsCreateRegistryBc:_bad_HID_SDP_record_n
mov ecx, 1
call fcn.140046d10
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
call fcn.14005c1e4
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14005a155
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r12d, r12d
je 0x14005a15f
call fcn.1400596f4
movzx eax, r12w
or eax, 0x80070000
test r12d, r12d
cmovle eax, r12d
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.14005ba20
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret