Function at 0x180004eb0
Capabilities:
Create pipe
Get disk information
Get geographical location

Disassembly:
push rbx
sub rsp, 0x60
mov dword [rsp + 0x58], 0x1dc
lea rax, [fcn.1800051b0]
add rax, 0x1dc
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180010b70
mov rax, qword [0x18011ccd0]
xor ebx, ebx
mov r8d, dword [0x18011ccd8]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx + 0x2f78]
mov dword [rax + 4], 0x28c60f21
cmp r8d, 0x94df70c6
jne 0x180004ff7
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetKerningPairsW]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetMapMode]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
lea r9, str.OydtpV1lrrPKg9AdWYCnER5
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
lea rcx, str.ph2dX49Oc6L48TOk
call qword [sym.imp.KERNEL32.dll_GetTimeFormatEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetupComm]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_SetMetaFileBitsEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPreferredUILanguages]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_RectInRegion]
lea rcx, str.AWTIGR3SBeYq4dSn3ppug
call qword [sym.imp.KERNEL32.dll_IsValidLocaleName]
mov r8d, dword [0x18011ccd8]
mov rax, qword [0x18011cce0]
mov rcx, qword [rax + 0x10]
mov rax, qword [0x18011ccd0]
mov edx, dword [rcx + 0x2380]
mov rcx, qword [rax + 0x10]
add edx, 0x4e8f29af
mov rax, qword [rcx + 0x2f78]
mov dword [rax], edx
cmp r8d, 0xa6a49287
jne 0x18000514f
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryProcessCycleTime]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerCreateRequest]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_RemoveFontResourceExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileSectionW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalReAlloc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryMemoryResourceNotification]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_ModifyWorldTransform]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateDIBSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreatePipe]
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
mov qword [rsp + 0x40], rbx
lea rax, str.aUQQ6v6H9szVZHc7jCRaEq9
mov qword [rsp + 0x38], rbx
lea r8, str.oFrrFAELi7X6yV7lFKJWjSesUA
mov qword [rsp + 0x30], rbx
lea rcx, str.OYHD6HGJRaF63c76mT4y8
mov dword [rsp + 0x28], ebx
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringEx]
mov rax, qword [0x18011ccd0]
mov rcx, qword [rax + 0x10]
mov rax, qword [0x18011cce0]
mov rdx, qword [rcx + 0x2f78]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x2380]
add dword [rdx + 4], eax
mov rax, qword [0x18011ccc8]
mov r8, qword [rax + 0x10]
mov rax, qword [0x18011ccd0]
mov rcx, qword [rax + 0x10]
mov eax, dword [r8 + 0x1b60]
mov rdx, qword [rcx + 0x2f78]
mov dword [rdx + 8], eax
add rsp, 0x60
pop rbx
ret