Function at 0x140001956
Capabilities:
Get geographical location
Get hostname
Query or enumerate registry value

Disassembly:
push rbp
mov eax, 0x20f0
call fcn.140008640
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x206c], 0x10
mov dword [rbp + 0x2068], 0x104
mov dword [rbp - 0x44], 0x2000
lea rax, [rbp + 0x206c]
mov rdx, rax
lea rax, [0x14001d060]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetComputerNameA]
call rax
lea rax, [rbp + 0x2060]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rdx, rax
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
mov rax, qword [rbp + 0x2060]
lea rdx, [rbp + 0x2068]
mov qword [rsp + 0x28], rdx
lea rdx, [0x14001d080]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.ProductName
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov dword [rbp + 0x1fc0], 0x94
lea rax, [rbp + 0x1fc0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetVersionExA]
call rax
mov edx, dword [rbp + 0x1fcc]
mov eax, dword [rbp + 0x1fc8]
mov ecx, dword [rbp + 0x1fc4]
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], eax
mov r9d, ecx
lea r8, str._lu._lu._lu
mov edx, 0x104
lea rax, [0x14001d1a0]
mov rcx, rax
call dbg.snprintf
mov rax, qword [rbp + 0x2060]
lea rdx, [rbp + 0x2068]
mov qword [rsp + 0x28], rdx
lea rdx, [0x14001d2c0]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.RegisteredOwner
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov rax, qword [rbp + 0x2060]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rdx, [rbp - 0x44]
lea rax, [rbp - 0x40]
mov r8, rdx
mov rdx, rax
lea rax, str._json.gp_ip
mov rcx, rax
call dbg.sendHttpRequest
lea rax, [rbp - 0x40]
mov rcx, rax
call dbg.cJSON_Parse
mov qword [0x14001d3c8], rax
mov rax, qword [0x14001d3c8]
lea rdx, str.geoplugin_request
mov rcx, rax
call dbg.cJSON_GetObjectItem
mov qword [0x14001d3d0], rax
mov rax, qword [0x14001d3c8]
lea rdx, str.geoplugin_city
mov rcx, rax
call dbg.cJSON_GetObjectItem
mov qword [0x14001d3d8], rax
mov rax, qword [0x14001d3c8]
lea rdx, str.geoplugin_region
mov rcx, rax
call dbg.cJSON_GetObjectItem
mov qword [0x14001d3e0], rax
mov rax, qword [0x14001d3c8]
lea rdx, str.geoplugin_regionCode
mov rcx, rax
call dbg.cJSON_GetObjectItem
mov qword [0x14001d3e8], rax
mov rax, qword [0x14001d3c8]
lea rdx, str.geoplugin_regionName
mov rcx, rax
call dbg.cJSON_GetObjectItem
mov qword [0x14001d3f0], rax
mov rax, qword [0x14001d3c8]
lea rdx, str.geoplugin_countryCode
mov rcx, rax
call dbg.cJSON_GetObjectItem
mov qword [0x14001d3f8], rax
mov rax, qword [0x14001d3c8]
lea rdx, str.geoplugin_countryName
mov rcx, rax
call dbg.cJSON_GetObjectItem
mov qword [0x14001d400], rax
mov rax, qword [0x14001d3c8]
lea rdx, str.geoplugin_continentCode
mov rcx, rax
call dbg.cJSON_GetObjectItem
mov qword [0x14001d408], rax
mov rax, qword [0x14001d3c8]
lea rdx, str.geoplugin_continentName
mov rcx, rax
call dbg.cJSON_GetObjectItem
mov qword [0x14001d410], rax
mov rax, qword [0x14001d3c8]
lea rdx, str.geoplugin_latitude
mov rcx, rax
call dbg.cJSON_GetObjectItem
mov qword [0x14001d418], rax
mov rax, qword [0x14001d3c8]
lea rdx, str.geoplugin_longitude
mov rcx, rax
call dbg.cJSON_GetObjectItem
mov qword [0x14001d420], rax
mov rax, qword [0x14001d3c8]
lea rdx, str.geoplugin_locationAccuracyRadius
mov rcx, rax
call dbg.cJSON_GetObjectItem
mov qword [0x14001d428], rax
mov rax, qword [0x14001d3c8]
lea rdx, str.geoplugin_timezone
mov rcx, rax
call dbg.cJSON_GetObjectItem
mov qword [0x14001d430], rax
mov rax, qword [0x14001d3c8]
lea rdx, str.geoplugin_currencyCode
mov rcx, rax
call dbg.cJSON_GetObjectItem
mov qword [0x14001d438], rax
nop
add rsp, 0x20f0
pop rbp
ret