Function at 0x180004e50
Capabilities:
Get geographical location
Move file
Set current directory
Terminate process

Disassembly:
push rbx
sub rsp, 0x60
mov dword [rsp + 0x58], 0x1ef
lea rax, [fcn.180005230]
add rax, 0x1ef
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180010ef0
mov rax, qword [0x180125ce8]
xor ebx, ebx
mov r8d, dword [0x180125cf0]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx + 0x1ba8]
mov dword [rax + 4], 0x42c771bd
cmp r8d, 0x7a890914
jne 0x18000501b
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_EnumFontFamiliesExW]
mov qword [rsp + 0x30], rbx
lea r8, str.69ID6h5Fycl4WnnE
mov dword [rsp + 0x28], ebx
lea rcx, str.5hCLLAM5EI4xZ3cs7S67t
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rdx, qword [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor r9d, r9d
mov word [rsp + 0x20], bx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetGeoInfoW]
call qword [sym.imp.KERNEL32.dll_GetACP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetCharWidthW]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateBrushIndirect]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov qword [rsp + 0x48], rbx
lea rax, str.OfkPuTLGCwSZEnZS
mov qword [rsp + 0x40], rbx
lea r8, str.3QYOgS3DOXOIrSEXoFGTWNqilWT3k
mov qword [rsp + 0x38], rbx
lea rcx, str.TI3O7No1Al8i4ip
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FindNLSStringEx]
xor r8d, r8d
lea rdx, str.f7H6xTDWY2O9QDs8a2Ase269
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNLSVersionEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugSetProcessKillOnExit]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserPreferredUILanguages]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleHistoryInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_StartThreadpoolIo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterBadMemoryNotification]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r8d, dword [0x180125cf0]
mov rax, qword [0x180125cf8]
mov rcx, qword [rax + 0x10]
mov rax, qword [0x180125ce8]
mov edx, dword [rcx + 0x43a0]
mov rcx, qword [rax + 0x10]
add edx, 0x7d2abb98
mov rax, qword [rcx + 0x1ba8]
mov dword [rax], edx
cmp r8d, 0x38db68c0
jne 0x1800051d0
mov qword [rsp + 0x30], rbx
lea rax, str.cW13emz9EtZmnGOMaId
mov dword [rsp + 0x28], ebx
lea r8, str.2QlRX4rA1yFZM7w4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNLSString]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapWalk]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphoreWhenCallbackReturns]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_PolyPolyline]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTapeParameters]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapViewOfFileExNuma]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_ResetDCW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_PaintRgn]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateBitmap]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_DeleteMetaFile]
mov dword [rsp + 0x38], ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationByHandleW]
call qword [sym.imp.KERNEL32.dll_IsThreadAFiber]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_StrokePath]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetCharABCWidthsI]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTime]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetRgnBox]
mov rax, qword [0x180125ce8]
mov rcx, qword [rax + 0x10]
mov rax, qword [0x180125cf8]
mov rdx, qword [rcx + 0x1ba8]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x43a0]
add dword [rdx + 4], eax
mov rax, qword [0x180125ce0]
mov r8, qword [rax + 0x10]
mov rax, qword [0x180125ce8]
mov rcx, qword [rax + 0x10]
mov eax, dword [r8 + 0x3ec8]
mov rdx, qword [rcx + 0x1ba8]
mov dword [rdx + 8], eax
add rsp, 0x60
pop rbx
ret