Function at 0x1800068f0
Capabilities:
Connect pipe
Create directory
Get common file path
Get system firmware table
Identify system language via api
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push r14
mov rbp, rsp
sub rsp, 0x80
xor ecx, ecx
call fcn.180078b7c
mov ecx, eax
call fcn.180075774
call fcn.180075748
and eax, 0x80000003
jge 0x180006929
dec eax
or eax, 0xfffffffc
inc eax
xor r14d, r14d
mov qword [rsp + 0x70], rdi
mov ebx, r14d
test eax, eax
jne 0x180006a51
cmp dword [0x180115cb8], 0x65c199a6
jne 0x180006a40
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ChangeDisplaySettingsExW]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DlgDirListW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgItemInt]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowStationW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMouseMovePointsEx]
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerClearRequest]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsRectEmpty]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalExit]
mov rdx, qword [rbp + 0x28]
call fcn.180001fb0
mov rbx, rax
jmp 0x180006f4e
cmp eax, 1
jne 0x180006c0a
mov qword [rsp + 0x78], rsi
mov ecx, 0x2d0d
nop dword [rax]
nop dword [rax + rax]
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x180006a70
add ecx, 0x21d0
test cl, 1
je 0x180006a99
inc ecx
test cl, 1
jne 0x180006a92
lea r8d, [rcx*2 + 0xf882]
mov eax, 0x2eb0
lea edx, [r8 - 0x7eb1]
mov r10d, 0x5517
sub eax, edx
mov r9d, 0xfffe3dfc
add r8d, eax
add edx, 0xffffffec
sub r10d, r8d
sub r9d, ecx
mov esi, 0xffff1328
lea edi, [r9 + rdx]
add edx, edx
lea eax, [r10 - 0x2e15]
sub edx, edi
sub r8d, eax
lea r11d, [rax - 0x20c4]
sub r8d, edi
lea eax, [r10 - 0x4e6b]
add r8d, 0xb8
add edx, r9d
add r11d, r8d
lea r8d, [r10 - 0x5a04]
sub esi, r11d
add r8d, edi
add eax, r8d
add r11d, edi
mov ebx, r11d
mov r9d, eax
sub ebx, esi
sub eax, 0x10c
sub ebx, 0xd03d
sub r11d, r8d
sub ebx, eax
add r8d, 0xa52
mov ecx, esi
and ecx, 0x80000003
jge 0x180006b3f
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
mov eax, 0xffffda9d
lea ecx, [rsi + 0x9072]
mov r10d, 0x2563
mov rsi, qword [rsp + 0x78]
cmove eax, r10d
sub eax, edx
sub eax, r8d
add ecx, eax
cmp r9d, 0xfffdad96
jne 0x180006bfe
cmp ebx, 0x48422
jne 0x180006bfe
cmp edi, 0xffff0699
jne 0x180006bfe
cmp r8d, 0xfffe5e9d
jne 0x180006bfe
cmp r11d, 0x2390a
jne 0x180006bfe
cmp edx, 0x1177d
jne 0x180006bfe
cmp ecx, 0xfffecc27
jne 0x180006bfe
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [rbp + 0x30]
add rax, 0x198
mov dword [rbp - 0x28], 0x198
mov qword [rbp - 0x30], rax
lea r8, [rbp + 0x28]
movaps xmm0, xmmword [rbp - 0x30]
lea rax, [rbp + 0x20]
lea rdx, [rbp + 0x38]
movdqa xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x30], 0x3000
mov qword [rbp + 0x38], r14
call fcn.180011530
mov rbx, rax
jmp 0x180006f4e
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x180006d3a
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea rcx, [rbp - 0x20]
add rax, 0x1d9
mov dword [rbp - 0x28], 0x1d9
mov qword [rbp - 0x30], rax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x20], xmm0
call fcn.180011710
cmp dword [0x180115cb8], 0xc8887121
mov qword [rbp + 0x30], rax
jne 0x180006cf5
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDynamicTimeZoneInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Beep]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], r14d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelSynchronousIo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerCreateRequest]
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolIo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call qword [sym.imp.KERNEL32.dll_IsThreadAFiber]
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r9, [rbp + 0x28]
add rax, 0x204
mov dword [rbp - 0x28], 0x204
mov qword [rbp - 0x30], rax
lea r8, [rbp + 0x20]
movaps xmm0, xmmword [rbp - 0x30]
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
mov dword [rbp + 0x20], 8
call fcn.1800118c0
mov rbx, rax
jmp 0x180006f4e
cmp eax, 3
jne 0x180006f4e
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r8, [rbp + 0x28]
add rax, 0x26e
mov dword [rbp - 0x28], 0x26e
mov qword [rbp - 0x30], rax
lea rdx, [rbp + 0x20]
movaps xmm0, xmmword [rbp - 0x30]
lea rcx, [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
mov dword [rbp + 0x20], r14d
call fcn.18000eea0
mov qword [rbp - 0x38], rax
lea r9, [rbp + 0x30]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r8, [rbp + 0x38]
add rax, 0x242
mov dword [rbp - 0x18], 0x242
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x40]
movaps xmm0, xmmword [rbp - 0x20]
lea rax, [rbp + 0x20]
lea rcx, [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x30], 0x3000
mov dword [rbp + 0x38], 0x400
mov qword [rbp - 0x40], r14
call fcn.180011aa0
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x38]
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x213
add rax, 0x213
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
call fcn.18000f070
cmp dword [0x180115cb8], 0x3034da0d
mov rbx, rax
jne 0x180006f0d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReclaimVirtualMemory]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIdealProcessorEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
mov r9d, dword [rbp + 0x20]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor eax, eax
lock cmpxchg qword [r14], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryTransactedW]
call qword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPushListSListEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetupComm]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommConfig]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidLocale]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalExit]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
lea r9, [rbp + 0x20]
mov dword [rbp - 0x18], 0x131
lea r8, [rbp + 0x30]
add rax, 0x131
mov dword [rbp + 0x20], 0x8000
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x30]
movaps xmm0, xmmword [rbp - 0x20]
lea rcx, [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
mov dword [rbp + 0x30], r14d
call fcn.180011c80
mov rdi, qword [rsp + 0x70]
mov rax, rbx
add rsp, 0x80
pop r14
pop rbx
pop rbp
ret