Function at 0x180006c8c
Capabilities:
Copy file
Extract resource via kernel32 functions
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
cmp dword [0x1800c3890], 0x68e9798b
mov ebx, edx
jne 0x180006ead
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
xor edi, edi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
call qword [sym.imp.KERNEL32.dll_GetErrorMode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesTransactedW]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rdx, str.QI7R6N18FC6TEn2LIZ2EfR
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringScripts]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterBadMemoryNotification]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueue]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckNameLegalDOS8Dot3W]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueue]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisassociateCurrentThreadFromCallback]
xor r9d, r9d
lea rcx, str.Nf1AKuL398CzD5q
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileSectionW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIdealProcessorEx]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIdealProcessorEx]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadProfiling]
lea r9, str.Z6cfWMd8QNk65RnXqT6wocab1P
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov dword [rsp + 0x20], edi
lea rdx, str.ZLdWUU1zY9i46jlf76941
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindStringOrdinal]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
call qword [sym.imp.KERNEL32.dll_GetACP]
sub ebx, 1
je 0x180006ebe
sub ebx, 1
je 0x180006eeb
cmp ebx, 1
je 0x180006eeb
jmp 0x180006f18
mov ecx, 0x12d
lea rax, [0x1800069b8]
mov dword [rsp + 0x48], ecx
add rax, rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000a81c
mov ecx, 0x235
lea rax, [0x180006c30]
mov dword [rsp + 0x48], ecx
add rax, rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000a81c
mov rbx, qword [rsp + 0x60]
mov eax, 1
add rsp, 0x50
pop rdi
ret