Function at 0x1400326fc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r13
push r14
lea rbp, [rax - 0x2448]
mov eax, 0x2530
call fcn.140045d00
sub rsp, rax
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rbp + 0x2420], rax
lea rdi, [rcx + 0x28]
xor esi, esi
mov ebx, 0x80004005
cmp qword [rdi], rsi
je 0x14003274c
xor eax, eax
jmp 0x140032ad3
lea rcx, [rbp + 0x170]
call fcn.14001add0
test eax, eax
je 0x140032ad1
lea rcx, str.wmploc.dll
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
mov word [rbp + 0x13d0], si
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1400327bc
mov r9d, 0x824
lea r8, [rbp + 0x13d0]
mov edx, 0x126b
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
mov r14d, 0x1048
cmp si, word [rbp + 0x13d0]
je 0x1400327e8
mov edx, 0x5b
lea rcx, [rbp + 0x13d0]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x1400327fe
lea r8, str.https:__go.microsoft.com_fwlink__LinkId52492sv2
mov rdx, r14
lea rcx, [rbp + 0x13d0]
call fcn.140010c20
lea rcx, [rsp + 0x40]
call fcn.14001c278
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
nop dword [rax + rax]
movzx ecx, word [rsp + 0x40]
lea r9, [rbp + 0x13d0]
mov dword [rsp + 0x30], eax
lea r8, str._sversion_slocale_xuserlocale_x
mov dword [rsp + 0x28], ecx
lea rax, [rbp + 0x170]
lea rcx, [rbp + 0x380]
mov qword [rsp + 0x20], rax
mov rdx, r14
call fcn.140010c94
mov ecx, 0x10
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
nop dword [rax + rax]
or r13, 0xffffffffffffffff
cmp eax, r13d
je 0x140032895
mov r9d, eax
lea r8, str.geoid_x
mov edx, 0x105
lea rcx, [rsp + 0x60]
call fcn.140010e44
test eax, eax
js 0x140032895
lea r8, [rsp + 0x60]
mov rdx, r14
lea rcx, [rbp + 0x380]
call fcn.140010b58
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerServices
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140032a0e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x40], 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.TestParameter
mov dword [rsp + 0x44], 0x20a
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140032985
cmp dword [rsp + 0x40], 1
jne 0x140032985
lea rcx, [rsp + 0x60]
jmp 0x140032967
cmp word [rbx], 0x2d
jne 0x14003292a
add rbx, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtol]
nop dword [rax + rax]
test eax, eax
je 0x140032965
lea r8, [0x14004eed8]
mov rdx, r14
lea rcx, [rbp + 0x380]
call fcn.140010b58
mov r8, rbx
lea rcx, [rbp + 0x380]
mov rdx, r14
call fcn.140010b58
xor ecx, ecx
xor r8d, r8d
lea rdx, [0x14004eed4]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcstok]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140032920
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x40], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Partner
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x44], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400329fd
cmp dword [rsp + 0x40], 4
jne 0x1400329fd
mov eax, dword [rsp + 0x48]
lea r9, [rbp + 0x380]
lea r8, str._spartner_lu
mov dword [rsp + 0x20], eax
mov rdx, r14
lea rcx, [rbp + 0x380]
call fcn.140010c94
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea r8, str.parchx64archx64
mov rdx, r14
lea rcx, [rbp + 0x380]
call fcn.140010b58
test rdi, rdi
je 0x140032ab8
mov rcx, qword [rdi]
test rcx, rcx
je 0x140032a3d
call fcn.140001454
mov qword [rdi], rsi
lea rax, [rbp + 0x380]
mov rbx, r13
inc rbx
cmp word [rax + rbx*2], si
jne 0x140032a47
inc rbx
mov eax, 2
mul rbx
cmovo rax, r13
mov rcx, rax
call fcn.1400014a0
mov qword [rdi], rax
test rax, rax
jne 0x140032a76
mov ebx, 0x8007000e
jmp 0x140032abd
lea r8, [rbp + 0x380]
mov rdx, rbx
mov rcx, rax
call fcn.140010dd0
mov ebx, eax
test eax, eax
jns 0x140032a9e
mov rcx, qword [rdi]
test rcx, rcx
je 0x140032a9e
call fcn.140001454
mov qword [rdi], rsi
test ebx, ebx
js 0x140032abd
mov r8, qword [rdi]
lea rdx, str.__Services_information_URL_is_:__S._r_n
mov ecx, 4
call fcn.140019b1c
jmp 0x140032ad1
mov ebx, 0x80004003
mov r8d, ebx
lea rdx, str.__Could_not_retrieve_service_information_URL:_0x_x._r_n
mov ecx, 2
call fcn.140019b1c
mov eax, ebx
mov rcx, qword [rbp + 0x2420]
xor rcx, rsp
call fcn.1400017f0
lea r11, [rsp + 0x2530]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret