Function at 0x180002b90
Capabilities:
Connect pipe
Get common file path
Get geographical location
Read pipe
Set environment variable
Write pipe

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x58
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerSetRequest]
call qword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, str.LKcuEQblwLtdLmmqKdxC
xor r8d, r8d
lea rdx, str.DFEKkearOIMvrmoVGrgc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoExEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommState]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRestart]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
xor r8d, r8d
xor edx, edx
lea rcx, str.LmyXUiHtVOzPZTgsdKgtdovc
call qword [sym.imp.KERNEL32.dll_ResolveLocaleName]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateHardLinkW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.pJJEaxkDuERzmezvJIQHmDDrFtN
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPushListSListEx]
lea rcx, str.aWDZWqwHLyCSyeVvvchgy
call qword [sym.imp.KERNEL32.dll_IsValidLocaleName]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphoreWhenCallbackReturns]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommProperties]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
call qword [sym.imp.KERNEL32.dll_GetSystemDEPPolicy]
lea rdx, str.kKKUynqLfRZgKjhQeUIPWNwgP
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, str.gHDmouOfQiyrBxODeHKaDx
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.rdQhipYMOqmseYdgW
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNLSString]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitCommEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
mov dword [rsp + 0x40], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x58
ret