Function at 0x140064f00
Capabilities:
Get geographical location
Get local ipv4 addresses
Identify system language via api

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x1403e3c28]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, qword [0x140400430]
mov r15d, r9d
mov r14, r8
mov ebp, edx
mov ebx, ecx
cmp ecx, 0x6f70656e
jne 0x140064f45
xor esi, esi
test rdi, rdi
setne sil
mov eax, esi
jmp 0x140065280
cmp ebx, 0x76657273
jne 0x140064f57
mov eax, 0x59783491
jmp 0x140065280
test rdi, rdi
jne 0x140064f68
mov rax, 0xffffffffffffffff
jmp 0x140065280
cmp ebx, 0x61646472
jne 0x140064f7a
call fcn.14006e0b0
jmp 0x140065280
cmp ebx, 0x6166666e
jne 0x140064f8a
mov eax, dword [rdi + 0x48]
jmp 0x140065280
cmp ebx, 0x62626e64
jne 0x140064f9c
mov eax, 1
jmp 0x140065280
cmp ebx, 0x636f6e6e
jne 0x140064fba
cmp dword [rdi + 0x38], 1
mov eax, 0x2d647363
mov ecx, 0x2b6f6e6c
cmove eax, ecx
jmp 0x140065280
cmp ebx, 0x65746872
je 0x140064fce
cmp ebx, 0x6d616378
jne 0x1400650d5
test r14, r14
je 0x1400650d5
mov edx, r15d
mov rcx, r14
call fcn.140063da0
mov rdi, qword [0x140400430]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 1
xor edx, edx
xor ecx, ecx
xor esi, esi
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x140064f5c
mov r9, qword [rdi + 8]
mov edx, 0x6e636f6e
mov r8d, dword [rdi]
mov ecx, dword [rsp + 0x30]
call fcn.14003f0f0
mov rbx, rax
test rax, rax
jne 0x14006503c
lea eax, [rsi - 2]
jmp 0x140065280
lea rax, [rsp + 0x30]
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x1400650b5
mov r9, rbx
nop dword [rax]
cmp dword [r9 + 0x64], 6
je 0x14006506e
cmp dword [r9 + 0x64], 0x47
jne 0x140065091
cmp dword [r9 + 0x58], 6
jne 0x140065091
test ebp, ebp
je 0x1400650a0
mov rax, qword [r9 + 0x18]
test rax, rax
je 0x140065091
test byte [rax + 4], 1
jne 0x1400650a0
mov rax, qword [rax + 8]
test rax, rax
jne 0x140065082
mov r9, qword [r9 + 8]
test r9, r9
jne 0x140065060
lea esi, [r9 - 3]
jmp 0x1400650ba
lea r8, [r9 + 0x50]
mov edx, r15d
mov r9d, dword [r9 + 0x58]
mov rcx, r14
call fcn.140063dc0
jmp 0x1400650ba
mov esi, 0xfffffffc
mov r9, qword [rdi + 8]
mov edx, 0x6e636f6e
mov r8d, dword [rdi]
mov rcx, rbx
call fcn.14003f110
mov eax, esi
jmp 0x140065280
cmp ebx, 0x6f6e6c6e
jne 0x1400650ee
xor esi, esi
cmp dword [rdi + 0x38], 1
sete sil
mov eax, esi
jmp 0x140065280
cmp ebx, 0x74797065
jne 0x140065100
mov eax, 4
jmp 0x140065280
cmp ebx, 0x75706e70
jne 0x140065148
cmp qword [rdi + 0x40], 0
je 0x14006526c
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x73746174
call fcn.140080b00
test al, 8
je 0x14006526c
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x65787470
call fcn.140080b00
jmp 0x140065280
cmp ebx, 0x6c6f636c
jne 0x140065163
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ecx, ax
call fcn.1400652a0
jmp 0x140065280
cmp ebx, 0x6c6f636e
jne 0x14006526c
mov ecx, reloc.WS2_32.dll_recv
mov ebx, 0x5a5a
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140065190
mov eax, 0x7a7a5a5a
jmp 0x140065280
mov edx, 8
lea rcx, [rsp + 0x38]
call fcn.140063da0
xor esi, esi
lea r8, [rsp + 0x38]
mov ecx, edi
mov word [rsp + 0x20], si
lea r9d, [rsi + 8]
lea edx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_GetGeoInfoA]
test eax, eax
jle 0x140065211
lea rcx, [rsp + 0x38]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], sil
jne 0x1400651d0
cmp rax, 2
jne 0x140065211
lea rdx, [0x140299e88]
lea rcx, [rsp + 0x38]
call fcn.140063e10
test eax, eax
je 0x140065211
mov rax, qword [rsp + 0x38]
test al, al
je 0x14006520e
movzx ebx, al
movzx eax, byte [rsp + 0x39]
shl bx, 8
or bx, ax
jmp 0x140065211
movzx ebx, si
movzx eax, bx
shr ax, 8
cmp al, 0x61
jb 0x140065236
movzx eax, bx
shr ax, 8
cmp al, 0x7a
ja 0x140065236
movzx eax, bx
shr ax, 8
movzx ecx, al
and ecx, 0xffffffdf
jmp 0x14006523c
movzx ecx, bx
shr ecx, 8
cmp bl, 0x61
jb 0x14006524e
cmp bl, 0x7a
ja 0x14006524e
movzx edx, bl
and edx, 0xffffffdf
jmp 0x140065254
movzx eax, bx
movzx edx, al
mov eax, 0x100
movzx ecx, cx
imul ecx, eax
add cx, dx
movzx eax, cx
add eax, 0x7a7a0000
jmp 0x140065280
mov r9, r14
mov dword [rsp + 0x20], r15d
mov r8d, ebp
mov edx, ebx
xor ecx, ecx
call fcn.14006e400
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401f11e0
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret