Function at 0x6c642a20
Capabilities:
Get geographical location

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x208
mov rdi, qword [sym.imp.user32.dll_SendMessageW]
mov r12, rdx
mov r13, rcx
mov edx, 0x1004
mov rsi, r8
mov dword [rsp + 0x60], 7
xor r8d, r8d
mov rbx, r9
xor r9d, r9d
call rdi
mov rcx, r12
mov dword [rsp + 0x68], 0
lea r14, [rsp + 0x60]
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x84], 0
call qword [sym.imp.crypt32.dll_CertDuplicateCertificateContext]
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov qword [rsp + 0x88], rax
mov rbp, qword [sym.imp.crypt32.dll_CertGetNameStringW]
mov rcx, r12
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbp
mov dword [rsp + 0x44], eax
cmp eax, dword [rsi]
ja 0x6c642d60
mov rax, qword [rbx]
test rax, rax
je 0x6c642af9
mov edx, dword [rsp + 0x44]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], edx
mov edx, 4
call rbp
mov rax, qword [rbx]
mov r9, r14
xor r8d, r8d
mov edx, 0x104d
mov rcx, r13
mov qword [rsp + 0x78], rax
call rdi
mov dword [rsp + 0x60], 1
xor r9d, r9d
mov r8d, 1
mov rcx, r12
mov dword [rsp + 0x28], 0
mov edx, 4
mov qword [rsp + 0x20], 0
call rbp
mov dword [rsp + 0x44], eax
cmp eax, dword [rsi]
ja 0x6c642d10
mov rax, qword [rbx]
test rax, rax
je 0x6c642b7b
mov edx, dword [rsp + 0x44]
xor r9d, r9d
mov r8d, 1
mov rcx, r12
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], edx
mov edx, 4
call rbp
mov rax, qword [rbx]
mov dword [rsp + 0x68], 1
mov r9, r14
movsxd r8, dword [rsp + 0x64]
mov edx, 0x1074
mov rcx, r13
mov qword [rsp + 0x78], rax
call rdi
mov r9d, 0x50
mov edx, 0x1f
mov ecx, 0x800
lea r8, [rsp + 0xc0]
lea r15, [rsp + 0x50]
mov qword [rsp + 0x38], r8
lea rbp, [rsp + 0x160]
call qword [sym.imp.kernel32.dll_GetLocaleInfoW]
mov rax, qword [r12 + 0x18]
mov rdx, r15
lea rcx, [rax + 0x48]
call qword [sym.imp.kernel32.dll_FileTimeToSystemTime]
mov r8, qword [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x20], rbp
mov ecx, 0x800
mov dword [rsp + 0x28], 0x50
mov r9, r8
mov r8, r15
lea r15, [rsp + 0x44]
call qword [sym.imp.kernel32.dll_GetDateFormatW]
mov qword [rsp + 0x78], rbp
mov r9, r14
mov rcx, r13
movsxd r8, dword [rsp + 0x64]
mov edx, 0x1074
mov dword [rsp + 0x68], 2
call rdi
xor r8d, r8d
mov rbp, qword [sym.imp.crypt32.dll_CertGetCertificateContextProperty]
mov r9, r15
mov edx, 0xb
mov rcx, r12
call rbp
test eax, eax
je 0x6c642ce8
mov eax, dword [rsp + 0x44]
mov r8, qword [rbx]
cmp dword [rsi], eax
jb 0x6c642c90
test r8, r8
je 0x6c642c69
mov r9, r15
mov edx, 0xb
mov rcx, r12
call rbp
test eax, eax
je 0x6c642c80
mov rax, qword [rbx]
mov qword [rsp + 0x78], rax
movsxd r8, dword [rsp + 0x64]
mov r9, r14
mov rcx, r13
mov dword [rsp + 0x68], 3
mov edx, 0x1074
call rdi
nop
add rsp, 0x208
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x48]
jmp 0x6c642c49
mov r9, qword gs:[0x30]
mov rax, qword [r9 + 0x60]
mov qword [rsp + 0x38], r9
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
mov r9, qword [rsp + 0x38]
mov r8d, dword [rsp + 0x44]
xor edx, edx
mov rax, qword [r9 + 0x60]
add r8, r8
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x6c642c69
mov eax, dword [rsp + 0x44]
mov dword [rsi], eax
mov r8, qword [rbx]
jmp 0x6c642c30
mov rcx, qword [0x6c663008]
xor r9d, r9d
lea r8, [rsp + 0x48]
mov edx, 0x447
call qword [sym.imp.user32.dll_LoadStringW]
mov dword [rsp + 0x44], eax
jmp 0x6c642c29
mov r15, qword gs:[0x30]
mov rax, qword [r15 + 0x60]
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
mov r8d, dword [rsp + 0x44]
mov rax, qword [r15 + 0x60]
xor edx, edx
mov rcx, qword [rax + 0x30]
add r8, r8
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x6c642b7b
mov eax, dword [rsp + 0x44]
mov dword [rsi], eax
jmp 0x6c642b31
mov r15, qword gs:[0x30]
mov rax, qword [r15 + 0x60]
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
mov r8d, dword [rsp + 0x44]
mov rax, qword [r15 + 0x60]
xor edx, edx
mov rcx, qword [rax + 0x30]
add r8, r8
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x6c642af9
mov eax, dword [rsp + 0x44]
mov dword [rsi], eax
jmp 0x6c642abc