Function at 0x180005a30
Capabilities:
Get common file path
Get keyboard layout
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rcx
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_EnumSystemGeoID]
xor ecx, ecx
call qword [sym.imp.USER32.dll_UpdateWindow]
xor edi, edi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ToUnicode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidLanguageGroup]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetSysColors]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExcludeUpdateRgn]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LookupIconIdFromDirectory]
lea rax, str.E9EAyXg3vDYpNU4
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea r9, str.77O6kCF2z3tOdkf89E91GVC6T
mov dword [rsp + 0x28], edi
lea rcx, str.pp9cmTbv5K66ga3yXiJgXpzk5s7
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetDateFormatEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowRgn]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsIconic]
xor r8d, r8d
lea rcx, str.aHd5d4g6sq1F621K4sLFCb2Bf
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenFile]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetMessageExtraInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadKeyboardLayoutW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MonitorFromRect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetScrollPos]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisassociateCurrentThreadFromCallback]
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharToOemW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharToOemBuffW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, 0x903
inc eax
test al, 1
jne 0x180005bf3
cmp eax, 0x904
jne 0x180005c0d
mov eax, dword [rbx]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]