Function at 0x180030230
Capabilities:
Get geographical location
Move file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x1801eef68]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov r14d, r9d
mov dword [rsp + 0x38], r9d
mov rsi, r8
mov r15, rdx
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x48], rcx
mov r12, qword [rbp + 0x350]
xor r10d, r10d
mov r13d, r10d
mov dword [rsp + 0x40], r10d
movdqa xmm0, xmmword [0x1801e4850]
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], r10b
movdqa xmm1, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], r10b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r10
lea edi, [r9 - 0xb]
lea rcx, [0x180000000]
cmp r9d, edi
jbe 0x1800304d3
lea ebx, [r9 - 0xbd]
cmp ebx, 0x21
ja case.default.0x1800302f3
movzx eax, byte [rcx + rbx + 0x30b6c]
mov ecx, dword [rcx + rax*4 + 0x30b3c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov r8d, 3
lea rdx, [0x1801dd956]
lea rcx, [rbp + 0x38]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov dword [rbp + 0x3e], 0x72006f
xor r10d, r10d
mov word [rbp + 0x42], r10w
jmp case.0x1800302f3.11
mov r8, r12
mov edx, 0x58
lea rcx, [rbp - 0x60]
call fcn.18000cd80
test al, al
je 0x180030a6f
jmp 0x1800304b9
mov eax, dword [0x1801dd97a]
mov dword [rbp - 0x1e], eax
movzx eax, byte [0x1801dd97e]
mov byte [rbp - 0x1a], al
jmp case.0x1800302f3.11
mov r8d, 5
lea rdx, [0x1801dd9d2]
lea rcx, [rbp + 0x42]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov dword [rbp + 0x4c], 0x63006e
jmp 0x1800304b9
mov dword [rbp - 0x18], 0x756d6544
mov byte [rbp - 0x14], 0
jmp case.0x1800302f3.11
mov word [rbp + 0x50], r10w
mov r8d, 1
lea rdx, [0x1801dda1a]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x1800304b9
mov word [rbp - 0x19], 0x43
jmp case.0x1800302f3.11
mov r8, qword [r12]
mov rax, qword [r8 + 0x2d0]
mov rdx, qword [rax + 0x70]
mov r9, qword [r8 + 0x358]
mov ecx, dword [r8 + 0x30c]
imul ecx, dword [rdx + 0x4a4]
mov eax, dword [r8 + 0x304]
imul eax, dword [rdx + 0x4a8]
add rcx, rax
add rcx, qword [rdx + 0x4b0]
movzx eax, byte [r8 + 0x9f1]
test al, 0xfb
je 0x18003043a
cmp al, 1
jne 0x18003044c
mov edx, r10d
cmp dword [r8 + 0x314], 0
jle 0x18003044c
nop
movzx eax, byte [rcx]
add al, byte [r9]
and al, 3
mov byte [rcx], al
lea rcx, [rcx + 1]
lea r9, [r9 + 1]
inc edx
mov rax, qword [r12]
cmp edx, dword [rax + 0x314]
jl 0x180030410
mov dword [rsp + 0x34], r10d
jmp case.0x1800302f3.11
movsxd r8, dword [r8 + 0x314]
mov rdx, r9
call sub.VCRUNTIME140.dll_memcpy
xor r10d, r10d
mov dword [rsp + 0x34], r10d
jmp case.0x1800302f3.11
mov eax, dword [rsi]
mov edx, dword [r15]
cmp edx, eax
je 0x18003046d
sub edx, eax
lea rcx, str.Installing_Update:__0
call fcn.1800d6920
mov edx, dword [r15]
mov rax, qword [rsp + 0x48]
mov r9d, dword [rax]
mov r8, r12
lea rcx, str.service_number
call fcn.1800d6920
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx]
add eax, dword [r15]
mov dword [rsp + 0x34], eax
jmp 0x1800304b9
mov word [rbp + 0x52], r10w
mov r8d, 1
lea rdx, [0x1801dda82]
lea rcx, [rbp + 0x38]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, 0x6c43
mov word [rbp - 0x20], ax
xor r10d, r10d
lea rcx, [0x180000000]
dec ebx
lea eax, [rbx + 0xbd]
cmp eax, edi
ja 0x1800302d1
lea ebx, [r14 + 0xa]
mov dword [rsp + 0x30], ebx
cmp r14d, ebx
jae case.0x180030532.0
lea ebx, [r14 - 0xbd]
mov dword [rsp + 0x40], ebx
mov edi, 0x50
mov eax, dword [rsp + 0x30]
movabs r8, 0x7fffffffffffffff
mov r11d, 0x65
lea r9d, [r11 + 7]
lea edx, [r11 - 4]
cmp ebx, 0x23
ja case.default.0x180030532
movzx eax, byte [rcx + rbx + 0x30bb8]
mov ecx, dword [rcx + rax*4 + 0x30b90]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov r8d, 0x17
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x40]
call fcn.1800878a0
xor esi, esi
test al, al
je 0x180030a56
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
mov word [rsp + 0x38], ax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
mov r9d, SHSetInstanceExplorer
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.1800b3f40
mov eax, dword [rsp + 0x30]
jmp 0x180030a34
mov byte [rsp + 0x34], 1
jmp case.0x180030532.9
movzx eax, word [0x1801dda90]
mov word [rbp + 1], ax
movzx eax, byte [0x1801dda92]
mov byte [rbp + 3], al
jmp case.0x180030532.9
mov r8d, 2
lea rdx, [0x1801ddac3]
lea rcx, [rbp - 0x14]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov dword [rbp - 0x12], 0x61684372
mov byte [rbp - 0xe], 0
jmp case.0x180030532.9
mov dword [rbp - 0xe], 0x6c656e6e
mov byte [rbp - 0xa], 0
mov r8d, 2
lea rdx, [0x1801ddacc]
lea rcx, [rbp - 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
movsd xmm0, qword [str.LV_Inter]
movsd qword [rbp - 7], xmm0
movzx eax, byte [0x1801ddad8]
mov byte [rbp + 1], al
jmp case.0x180030532.9
mov eax, dword [str.etat]
mov dword [rbp + 3], eax
mov eax, dword [str.ions]
mov dword [rbp + 7], eax
movzx eax, byte [0x1801ddae8]
mov byte [rbp + 0xb], al
cmp qword [r12 + 0x10], 0x35
jb case.0x180030532.9
mov r15d, 0x105
jmp 0x180030653
xor r10d, r10d
cmp r15d, 0xd410
ja 0x1800308b6
je 0x1800306c8
xor esi, esi
cmp r15d, 0x105
je 0x1800306ae
cmp r15d, 0x475e
je 0x18003069b
cmp r15d, 0x8db7
jne 0x1800309cf
mov dword [rbp + 0x24], 0x680074
mov dword [rbp + 0x28], 0x610056
mov word [rbp + 0x2c], r9w
jmp 0x1800309cf
mov dword [rbp + 0x1c], 0x650076
mov dword [rbp + 0x20], 0x610050
jmp 0x1800309cf
mov dword [rbp + 0x10], 0x650052
mov dword [rbp + 0x14], 0x61006c
mov dword [rbp + 0x18], 0x690074
jmp 0x1800309cf
mov dword [rbp + 0x2e], 0x650075
mov word [rbp + 0x32], r10w
mov qword [rbp - 0x70], ILRemoveLastID
mov byte [rsp + 0x78], 0
mov esi, 0xb
cmp qword [r12 + 0x10], rsi
cmovb rsi, qword [r12 + 0x10]
mov r14, r12
cmp qword [r12 + 0x18], 0x10
jb 0x180030700
mov r14, qword [r12]
cmp rsi, 0xf
ja 0x180030724
mov qword [rbp - 0x78], rsi
mov r8, rsi
mov rdx, r14
lea rcx, [rsp + 0x78]
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rsi + 0x78], 0
jmp 0x1800307ba
cmp rsi, r8
ja 0x180030b35
mov rdi, rsi
or rdi, 0xf
cmp rdi, r8
jbe 0x18003073e
mov rdi, r8
jmp 0x18003074b
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x180030784
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180030b2f
mov rcx, rax
call fcn.1800d6a60
test rax, rax
je 0x180030a5d
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x180030796
test rcx, rcx
je 0x180030793
call fcn.1800d6a60
mov rbx, rax
jmp 0x180030796
mov rbx, r10
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rdi
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov qword [rsp + 0x78], rbx
mov edi, 0x50
or r13d, 1
lea rdx, [rsp + 0x78]
lea rcx, [0x1801eeed8]
call fcn.180004a20
mov rax, qword [rbp - 0x70]
cmp rax, 0x10
jb 0x18003080c
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180030807
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180030a5d
call fcn.1800d6a9c
xor esi, esi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], ILRemoveLastID
mov byte [rsp + 0x78], sil
mov rax, qword [r12 + 0x10]
cmp rax, 0xb
jb 0x180030b29
add rax, 0xfffffffffffffff5
mov r8d, 6
cmp rax, r8
cmovb r8, rax
mov rdx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x18003084e
mov rdx, qword [r12]
add rdx, 0xb
lea rcx, [rsp + 0x78]
call fcn.180022dc0
or r13d, 2
lea rdx, [rsp + 0x78]
lea rcx, [0x1801eeef8]
call fcn.180004a20
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x1800309b8
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800308ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180030a5d
call fcn.1800d6a9c
jmp 0x1800309b8
cmp r15d, 0x11a69
je 0x1800308d3
xor esi, esi
cmp r15d, 0x160c2
je 0x180030a76
jmp 0x1800309cf
mov qword [rbp - 0x78], r10
mov qword [rbp - 0x70], ILRemoveLastID
mov byte [rsp + 0x78], 0
mov rax, qword [r12 + 0x10]
cmp rax, 0x11
jb 0x180030b29
add rax, 0xffffffffffffffef
mov r8d, 0x24
cmp rax, r8
cmovb r8, rax
mov rdx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x180030913
mov rdx, qword [r12]
add rdx, 0x11
lea rcx, [rsp + 0x78]
call fcn.180022dc0
or r13d, 4
lea rdx, [rsp + 0x78]
lea rcx, [0x1801eeeb8]
call fcn.180004a20
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x180030972
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003096d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180030a5d
call fcn.1800d6a9c
mov dword [rsp + 0x20], 0xffffffff
lea r9, [rbp + 0x60]
mov r8d, 0xffffffff
lea rdx, [rbp + 0x10]
lea ecx, [r8 + 0x11]
call qword [sym.imp.KERNEL32.dll_FoldStringW]
xor esi, esi
mov word [rsp + 0x20], si
mov r9d, 0x104
lea r8, [rbp + 0xd0]
lea edx, [rsi + 7]
lea ecx, [r9 - 0x39]
call qword [sym.imp.KERNEL32.dll_GetGeoInfoW]
mov byte [rsp + 0x34], 1
mov edx, 0x61
movabs r8, 0x7fffffffffffffff
lea r9d, [rdx + 0xb]
lea r11d, [rdx + 4]
add r15d, 0x4659
cmp r15d, 0x1a616
jbe 0x180030650
mov ebx, dword [rsp + 0x40]
mov r14d, dword [rsp + 0x38]
mov eax, dword [rsp + 0x30]
mov r15, qword [rsp + 0x70]
jmp 0x180030a34
lea r9, [rbp + 0x38]
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x68], rax
mov r8d, 2
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 8]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [rsp + 0x30]
xor esi, esi
inc r14d
mov dword [rsp + 0x38], r14d
inc ebx
mov dword [rsp + 0x40], ebx
cmp r14d, eax
jae 0x180030a76
xor r10d, r10d
lea rcx, [0x180000000]
jmp 0x1800304f8
mov byte [rsp + 0x34], 0
jmp 0x180030a76
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x34], 0
xor esi, esi
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x180030af2
mov rdi, qword [rsp + 0x58]
cmp rbx, rdi
je 0x180030aa8
nop word [rax + rax]
xor edx, edx
mov rcx, rbx
call fcn.180004d40
add rbx, 0x20
cmp rbx, rdi
jne 0x180030a90
mov rbx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x60]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x180030adc
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180030adc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1800d6a9c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
lea rcx, [rbp - 0x60]
call fcn.180004530
mov eax, dword [rsp + 0x34]
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.1800d7250
mov rbx, qword [rsp + 0x448]
add rsp, 0x3f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800173d0
nop
call fcn.180017250
int3
call fcn.180017390
int3