Function at 0x14000d9e0
Capabilities:
Check os version
Get geographical location

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x178]
sub rsp, 0x250
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140298ad8]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov r12, rcx
xor edx, edx
mov r8d, 0x11c
lea rcx, [rbp - 0x30]
call fcn.1401b26a0
mov dword [rbp - 0x30], 0x11c
xor r8d, r8d
lea rdx, [0x14024561c]
mov rcx, r12
call fcn.1400016b0
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor esi, esi
test eax, eax
je 0x14000dccb
call fcn.14002d140
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14000da7f
mov ecx, 0x80004005
call fcn.140001910
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
call fcn.14002d140
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x14000dab0
mov ecx, 0x80004005
call fcn.140001910
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
mov r8d, 8
lea rdx, str._OSInfo
lea rcx, [rsp + 0x28]
call fcn.1400016b0
mov r8d, dword [rbp - 0x2c]
lea rdx, str._MajorVersion____d_
lea rcx, [rsp + 0x20]
call fcn.140005d60
mov rdx, qword [rsp + 0x20]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.140004e90
mov r8d, dword [rbp - 0x28]
lea rdx, str._MinorVersion____d_
lea rcx, [rsp + 0x20]
call fcn.140005d60
mov rdx, qword [rsp + 0x20]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.140004e90
mov r8d, dword [rbp - 0x24]
lea rdx, str._BuildNumber____d_
lea rcx, [rsp + 0x20]
call fcn.140005d60
mov rdx, qword [rsp + 0x20]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.140004e90
mov r8d, dword [rbp - 0x20]
lea rdx, str._PlatformId____d_
lea rcx, [rsp + 0x20]
call fcn.140005d60
mov rdx, qword [rsp + 0x20]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.140004e90
lea r8, [rbp - 0x1c]
lea rdx, str._CSDVersion____s_
lea rcx, [rsp + 0x20]
call fcn.140005d60
mov rdx, qword [rsp + 0x20]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.140004e90
movzx r8d, word [rbp + 0xe4]
lea rdx, str._ServicePackMajor____d_
lea rcx, [rsp + 0x20]
call fcn.140005d60
mov rdx, qword [rsp + 0x20]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.140004e90
movzx r8d, word [rbp + 0xe6]
lea rdx, str._ServicePackMinor____d_
lea rcx, [rsp + 0x20]
call fcn.140005d60
mov rdx, qword [rsp + 0x20]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.140004e90
movzx r8d, word [rbp + 0xe8]
lea rdx, str._SuiteFlags____x_
lea rcx, [rsp + 0x20]
call fcn.140005d60
mov rdx, qword [rsp + 0x20]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.140004e90
lea rdx, [rsp + 0x60]
call fcn.14000d360
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.140004e90
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000dc5b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, [0x140247548]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x70]
call fcn.140004dc0
nop
mov rdx, rax
mov rcx, r12
call fcn.1400017a0
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000dc98
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000dcb2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000dccb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, str.LocalUserDefault
mov qword [rbp - 0x80], rax
lea rax, str.LocalSystemDefault
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x48], 0x400
mov dword [rsp + 0x4c], 0x800
lea rax, str.IDefaultAnsiCodepage
mov qword [rbp - 0x70], rax
lea rax, str.IDefaultCodepage
mov qword [rbp - 0x68], rax
lea rax, str.IDefaultLanguage
mov qword [rbp - 0x60], rax
lea rax, str.IDefaultCountry
mov qword [rbp - 0x58], rax
lea rax, str.ILanguage
mov qword [rbp - 0x50], rax
lea rax, str.ICountry
mov qword [rbp - 0x48], rax
mov dword [rbp + 0xf0], 0x1004
mov dword [rbp + 0xf4], SafeArrayGetDim
mov dword [rbp + 0xf8], 9
mov dword [rbp + 0xfc], 0xa
mov dword [rbp + 0x100], 1
mov dword [rbp + 0x104], 5
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str._LocaleInfo_
mov rcx, r12
call fcn.140004e90
mov r13, rsi
nop word [rax + rax]
mov rbx, qword [rbp + r13*8 - 0x80]
call fcn.14002d140
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
je 0x14000e197
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
test rbx, rbx
je 0x14000ddfc
test rbx, 0xffffffffffff0000
jne 0x14000ddeb
movzx ebx, bx
mov ecx, ebx
call fcn.14003e9c8
test rax, rax
je 0x14000de0f
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140005050
jmp 0x14000de0f
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000ddf0
jmp 0x14000ddfe
mov eax, esi
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.1400016b0
nop
lea r8, [rsp + 0x38]
lea rdx, [0x14024768c]
lea rcx, [rsp + 0x50]
call fcn.140004c10
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
mov rcx, r12
call fcn.140004e90
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000de4f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15, rsi
mov rbx, qword [rbp + r15*8 - 0x70]
call fcn.14002d140
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
je 0x14000e18c
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
test rbx, rbx
je 0x14000debd
test rbx, 0xffffffffffff0000
jne 0x14000dead
movzx ebx, bx
mov ecx, ebx
call fcn.14003e9c8
test rax, rax
je 0x14000ded0
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140005050
jmp 0x14000ded0
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000deb1
jmp 0x14000debf
mov eax, esi
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400016b0
nop
call fcn.14002d140
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
je 0x14000e181
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
lea rdx, [0x14024717c]
lea rcx, [rsp + 0x58]
call fcn.140004c10
nop
lea r8, [0x140247694]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140004dc0
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
mov rcx, r12
call fcn.140004e90
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000df4d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000df66
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r9d, 0x1c
lea r8, [rbp + 0x108]
mov edx, dword [rbp + r15*4 + 0xf0]
mov ecx, dword [rsp + r13*4 + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x14000e08b
cdqe
cmp rax, 0x1c
ja 0x14000e08b
lea rax, [rbp + 0x108]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14000dfa5
test edi, edi
jne 0x14000e008
mov rax, qword [rsp + 0x30]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], edi
je 0x14000e08b
cmp dword [rdx + 0x10], edi
jge 0x14000dfe1
cmp dword [rax - 0xc], edi
jl 0x14000e149
mov dword [rax - 0x10], esi
mov word [rax], si
jmp 0x14000e08b
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000dff1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
jmp 0x14000e08b
mov rbx, qword [rsp + 0x30]
mov r14d, dword [rbx - 0x10]
lea rsi, [rbp + 0x108]
sub rsi, rbx
sar rsi, 1
test edi, edi
js 0x14000e15f
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14000e048
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140001650
mov rbx, qword [rsp + 0x30]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp rsi, r14
lea r14, [rax + rax]
mov r9, r14
ja 0x14000e06c
lea r8, [rbx + rsi*2]
call fcn.1401aefb8
jmp 0x14000e078
lea r8, [rbp + 0x108]
call fcn.1401aef30
cmp edi, dword [rbx - 0xc]
jg 0x14000e154
mov dword [rbx - 0x10], edi
xor esi, esi
mov word [r14 + rbx], si
lea r8, [0x14024769c]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.140004dc0
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
mov rcx, r12
call fcn.140004e90
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000e0cc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000e0e6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000e0ff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc r15
cmp r15, 6
jl 0x14000de52
mov r8d, 3
lea rdx, [0x140247548]
mov rcx, r12
call fcn.140004e90
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000e13b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc r13
cmp r13, 2
jge 0x14000e16a
jmp 0x14000dd90
mov ecx, 0x80070057
call fcn.140001910
int3
mov ecx, 0x80070057
call fcn.140001910
int3
mov ecx, 0x80070057
call fcn.140001910
nop
mov r8d, SafeArrayGetDim
lea rdx, str.__LocaleInfo__n
mov rcx, r12
call fcn.140004e90
jmp 0x14000e1a2
mov ecx, 0x80004005
call fcn.140001910
nop
mov ecx, 0x80004005
call fcn.140001910
nop
mov ecx, 0x80004005
call fcn.140001910
int3
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1401aef10
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret