Function at 0x18003d968
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x180083330]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov qword [rsp + 0x78], r9
mov rbx, rdx
mov r13, rcx
xor r15d, r15d
mov qword [rbp - 0x48], r15
lea rax, [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], r15
mov dword [rbp - 0x30], r15d
lea rax, [rbp + 0x10]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x18], r15d
mov byte [rbp - 0x14], r15b
mov byte [rbp + 0x28], r15b
mov dword [rbp + 0x10], r15d
lea rax, [0x1800722b8]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], r15
lea r12d, [r15 + 1]
mov qword [rbp + 0x30], r12
mov qword [rbp + 0xc8], r15
xor edx, edx
mov r8d, Ordinal_145
lea rcx, [rbp + 0x38]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xorps xmm0, xmm0
movaps xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r15
lea rax, [0x180069110]
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x50]
call fcn.1800424cc
nop
mov rdx, rbx
mov rcx, r13
call fcn.18003d63c
mov edi, eax
mov rcx, qword [rbp + 0x168]
lea rsi, str.pcshell_shell_appresolverlib_appresolvercachebuilder.cpp
test eax, eax
jns 0x18003da5e
mov r9d, eax
mov r8, rsi
mov edx, 0x12b
call fcn.18000a128
test edi, edi
js 0x18003e113
mov rcx, qword [r13]
call fcn.180034cb0
mov rbx, rax
mov qword [rsp + 0x68], rax
test byte [rbp + 0x190], 2
je 0x18003dad4
lea rdx, [0x180084288]
mov ecx, 0x30
call fcn.180063efc
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x18003dacf
mov dword [rax], r12d
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov dword [rax + 0x18], r15d
mov byte [rax + 0x1c], r15b
mov qword [rax + 0x20], r15
mov rax, r12
lock xadd qword [0x180084210], rax
inc rax
mov qword [r14 + 0x28], rax
mov rbx, qword [rsp + 0x68]
jmp 0x18003dae0
mov r14, r15
jmp 0x18003dae0
mov rcx, qword [r13]
call fcn.180034cb0
mov r14, rax
mov rcx, r14
neg rcx
sbb edi, edi
not edi
and edi, 0x8007000e
mov rcx, qword [rbp + 0x168]
test r14, r14
jne 0x18003db15
mov r9d, edi
mov r8, rsi
mov edx, 0x132
call fcn.18000a128
test r14, r14
je 0x18003e106
cmp qword [r14 + 8], r15
jne 0x18003db20
call fcn.18005faf8
mov byte [rsp + 0x30], r15b
lea r12, [r13 + 0x28]
mov r9, r12
lea r8, [rsp + 0x50]
mov rcx, qword [r13]
call fcn.180033bb8
mov edi, eax
mov rcx, qword [rbp + 0x168]
test eax, eax
jns 0x18003db57
mov r9d, eax
mov r8, rsi
mov edx, 0x13d
call fcn.18000a128
test edi, edi
js 0x18003e0fd
mov rcx, qword [r12]
mov rax, qword [rcx]
lea rdx, [r13 + 0x30]
mov rax, qword [rax + 0x28]
call qword [case.0x18004bf34.0]
mov edi, eax
mov rcx, qword [rbp + 0x168]
test eax, eax
jns 0x18003db91
mov r9d, eax
mov r8, rsi
mov edx, 0x140
call fcn.18000a128
test edi, edi
js 0x18003e0fd
or dword [rsp + 0x34], 0xffffffff
mov rdi, qword [r12]
mov rax, qword [rdi]
lea rdx, [rsp + 0x70]
mov rcx, rdi
mov rax, qword [rax + 0x28]
call qword [case.0x18004bf34.0]
test eax, eax
js 0x18003dc36
mov rax, qword [rdi]
lea r8, [rsp + 0x34]
mov edx, 0x4c
mov rcx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x18004bf34.0]
test eax, eax
js 0x18003dc36
or eax, 0xffffffff
cmp dword [rsp + 0x34], eax
je 0x18003dc36
mov esi, dword [rsp + 0x34]
add rsi, qword [rsp + 0x70]
je 0x18003dc36
mov dword [rsi + 4], r15d
mov qword [rsi + 0xc], r15
mov dword [rsi + 0x14], r15d
mov dword [rsi + 0x18], eax
mov byte [rsi + 0x1c], r15b
mov dword [rsi + 0x20], r15d
mov dword [rsi + 0x24], eax
mov dword [rsi + 0x28], r15d
mov dword [rsi + 0x2c], eax
mov dword [rsi + 0x30], r15d
mov dword [rsi + 0x34], eax
mov dword [rsi + 0x38], r15d
mov dword [rsi + 0x3c], eax
mov dword [rsi + 0x40], r15d
mov dword [rsi + 0x44], eax
mov dword [rsi + 0x48], r15d
mov dword [rsi + 8], 0x20
mov dword [rsi], 0xacac00
jmp 0x18003dc39
mov rsi, r15
mov rax, rsi
neg rax
sbb edi, edi
not edi
and edi, 0x8007000e
mov rcx, qword [rbp + 0x168]
test rsi, rsi
jne 0x18003dc72
mov r9d, edi
lea r8, str.pcshell_shell_appresolverlib_appresolvercachebuilder.cpp
mov edx, 0x148
call fcn.18000a128
test rsi, rsi
je 0x18003dd47
mov r12, qword [r12]
call qword [sym.imp.api_ms_win_core_localization_obsolete_l1_2_0.dll_GetUserDefaultUILanguage]
nop dword [rax + rax]
movzx eax, ax
mov dword [rsi + 0x14], eax
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetUserDefaultLCID]
nop dword [rax + rax]
mov ecx, 0x411
cmp ax, cx
sete al
mov byte [rsi + 0x1c], al
mov ecx, 0x10
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetUserGeoID]
nop dword [rax + rax]
mov dword [rsi + 0x20], eax
mov qword [rbp - 0x70], r15
or rax, 0xffffffffffffffff
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x70]
call fcn.18003a8fc
mov edi, eax
mov r15, qword [rbp - 0x70]
test eax, eax
js 0x18003dd11
lea r8, [rsi + 0x18]
mov rdx, r15
mov rcx, r12
call fcn.18003a738
mov edi, eax
test eax, eax
js 0x18003dd11
mov rax, qword [r12]
lea rdx, [rsp + 0x40]
mov rcx, r12
mov rax, qword [rax + 0x20]
call qword [case.0x18004bf34.0]
mov edi, eax
test eax, eax
js 0x18003dd11
mov eax, dword [rsp + 0x40]
mov dword [rsi + 4], eax
test r15, r15
je 0x18003dd25
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x168]
xor r15d, r15d
test edi, edi
jns 0x18003dd4f
mov r9d, edi
lea r8, str.pcshell_shell_appresolverlib_appresolvercachebuilder.cpp
mov edx, 0x14b
call fcn.18000a128
test edi, edi
js 0x18003e030
lea rcx, [rsp + 0x58]
call qword [sym.imp.Windows.Storage.dll_SHGetDesktopFolder]
nop dword [rax + rax]
mov edi, eax
mov rcx, qword [rbp + 0x168]
test eax, eax
jns 0x18003dd81
mov r9d, eax
lea r8, str.pcshell_shell_appresolverlib_appresolvercachebuilder.cpp
mov edx, 0x151
call fcn.18000a128
test edi, edi
js 0x18003e030
test byte [0x180083d02], 1
je 0x18003ddb7
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, [0x18006e168]
lea rcx, [section..data]
call fcn.1800043e0
mov r12, qword [rsp + 0x78]
test edi, edi
js 0x18003de13
mov dword [rsp + 0x20], r15d
mov r9, r12
mov r8, qword [rsp + 0x58]
mov rdx, r14
mov rcx, r13
call fcn.1800418c8
mov rcx, qword [rbp + 0x168]
mov dword [rsp + 0x28], r15d
lea rdx, str.Root_index:__d
mov qword [rsp + 0x20], rdx
mov r9d, eax
lea r8, str.pcshell_shell_appresolverlib_appresolvercachebuilder.cpp
mov edx, 0x159
call fcn.180042720
mov edi, eax
inc r15
add r12, 0x18
cmp r15, 7
jb 0x18003ddbc
test byte [0x180083d02], 1
lea r12, [r13 + 0x28]
je 0x18003de45
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, [0x18006df08]
lea rcx, [section..data]
call fcn.1800043e0
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
xor r15d, r15d
test edi, edi
js 0x18003e087
mov r8, rsi
mov rcx, r13
call fcn.180041510
mov edi, eax
mov rcx, qword [rbp + 0x168]
test eax, eax
jns 0x18003de8e
mov r9d, eax
lea r8, str.pcshell_shell_appresolverlib_appresolvercachebuilder.cpp
mov edx, 0x162
call fcn.18000a128
test edi, edi
js 0x18003e087
mov rcx, qword [r12]
mov rax, qword [rcx]
lea r15, [rsi + 0xc]
mov rdx, r15
mov rax, qword [rax + 0x20]
call qword [case.0x18004bf34.0]
mov edi, eax
mov rcx, qword [rbp + 0x168]
test eax, eax
jns 0x18003decf
mov r9d, eax
lea r8, str.pcshell_shell_appresolverlib_appresolvercachebuilder.cpp
mov edx, 0x166
call fcn.18000a128
test edi, edi
js 0x18003e02d
mov rsi, qword [r12]
mov rax, qword [rsi]
lea rdx, [rsp + 0x44]
mov rcx, rsi
mov rax, qword [rax + 0x20]
call qword [case.0x18004bf34.0]
test eax, eax
js 0x18003df2b
mov rax, qword [rsi]
lea rdx, [rbp - 0x80]
mov rcx, rsi
mov rax, qword [rax + 0x28]
call qword [case.0x18004bf34.0]
mov rcx, qword [rbp + 0x168]
test eax, eax
jns 0x18003dfda
mov r9d, eax
lea r8, str.pcshell_shell_appresolverlib_appresolvercachebuilder.cpp
mov edx, 0x513
call fcn.18000a128
call fcn.1800037c4
cmp dword [rax], 4
jbe 0x18003df6b
mov ecx, dword [r15]
mov dword [rsp + 0x48], ecx
lea rcx, str.Committing_updated_cache_to_disk
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea rdx, [0x180076d68]
mov rcx, rax
call fcn.1800022b0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov rdx, qword [r12]
mov rax, qword [rax + 0x30]
call qword [case.0x18004bf34.0]
mov rcx, qword [rbp + 0x168]
xor r15d, r15d
test eax, eax
jns 0x18003dfa3
mov r9d, eax
lea r8, str.pcshell_shell_appresolverlib_appresolvercachebuilder.cpp
mov edx, 0x16e
call fcn.18000a128
mov sil, 1
test byte [0x180083d02], sil
je 0x18003e035
lea rax, [rbp + 0x110]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, [0x18006de88]
lea rcx, [section..data]
call fcn.1800043e0
jmp 0x18003e035
mov eax, dword [rsp + 0x44]
cmp eax, dword [r14 + 0x18]
jne 0x18003df2b
mov r8d, eax
mov rdx, qword [r14 + 0x10]
mov rcx, qword [rbp - 0x80]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
jne 0x18003df2b
call fcn.1800037c4
cmp dword [rax], 4
jbe 0x18003e02d
lea rcx, str.No_change_detected_during_folder_scan._New_cache_is_thrown_away
mov qword [rbp - 0x78], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x20], rcx
lea rdx, [0x180076200]
mov rcx, rax
call fcn.180001a98
xor r15d, r15d
mov sil, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x50], r15
test rcx, rcx
je 0x18003e051
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
test edi, edi
js 0x18003e0fd
test sil, sil
je 0x18003e0fd
mov qword [rsp + 0x38], r15
lea rdx, [rsp + 0x38]
mov rcx, qword [r13]
call fcn.180034c48
mov rcx, qword [rbp + 0x168]
test eax, eax
jns 0x18003e08c
mov edx, 0x185
jmp 0x18003e0ae
mov sil, r15b
jmp 0x18003e035
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
call qword [case.0x18004bf34.0]
mov rcx, qword [rbp + 0x168]
test eax, eax
jns 0x18003e0bd
mov edx, 0x187
mov r9d, eax
lea r8, str.pcshell_shell_appresolverlib_appresolvercachebuilder.cpp
call fcn.18000a128
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18003e0d9
mov qword [rsp + 0x38], r15
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
call fcn.18003e178
mov rcx, qword [rbp + 0x168]
test eax, eax
jns 0x18003e0fd
mov r9d, eax
lea r8, str.pcshell_shell_appresolverlib_appresolvercachebuilder.cpp
mov edx, 0x18e
call fcn.18000a128
mov rcx, r14
call fcn.180034f0c
nop
test rbx, rbx
je 0x18003e113
mov rcx, rbx
call fcn.180034f0c
mov rcx, r13
call fcn.18003d894
mov edx, edi
lea rcx, [rbp - 0x50]
call fcn.18002bc8c
nop
lea rax, [0x180069110]
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x50]
call fcn.18002c5b4
lea rcx, [rbp - 0x50]
call fcn.18002c398
mov eax, edi
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.180062960
mov rbx, qword [rsp + 0x280]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret