Function at 0x180001fb0
Capabilities:
Clear file content
Get geographical location
Get graphical window text
Get memory capacity
Move file
Switch active desktop

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x50
mov rax, qword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea r8, [rsp + 0x68]
mov dword [rsp + 0x48], 0x161
lea rdx, [rsp + 0x60]
add rax, 0x161
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
xor ebx, ebx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], ebx
call fcn.18000f470
cmp dword [0x180125cf0], 0xcf46590
mov qword [rsp + 0x70], rax
jne 0x180002205
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetMenuInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalSize]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SwitchDesktop]
call qword [sym.imp.USER32.dll_CloseClipboard]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetActiveWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSearchPathMode]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileIntW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetClassWord]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CopyImage]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNLSVersion]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MoveWindow]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CascadeWindows]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetDlgItemInt]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov dword [rsp + 0x30], ebx
xor r8d, r8d
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateDesktopExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdePostAdvise]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgItemInt]
xor ecx, ecx
call qword [sym.imp.USER32.dll_LockWindowUpdate]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateDesktopW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerCreateRequest]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov dword [rsp + 0x38], ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_TabbedTextOutW]
xor r9d, r9d
mov word [rsp + 0x20], bx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetGeoInfoW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [sym.imp.KERNEL32.dll_GlobalLock]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x48], 0x231
lea rcx, [rsp + 0x40]
add rax, 0x231
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000f640
add rsp, 0x50
pop rbx
ret