Function at 0x180001fb0
Capabilities:
Create pipe
Get disk information
Get geographical location
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x60
mov rax, qword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea r8, [rsp + 0x78]
mov dword [rsp + 0x58], 0x219
lea rdx, [rsp + 0x70]
add rax, 0x219
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
xor ebx, ebx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x70], ebx
call fcn.18000f210
cmp dword [0x180125260], 0x4ccdcd1e
mov qword [rsp + 0x80], rax
jne 0x1800021fa
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetAppContainerNamedObjectPath]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ArrangeIconicWindows]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveSecureMemoryCacheCallback]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetActiveWindow]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edx, edx
lea rcx, str.8trFC6CBpAJ6bjeMf
call qword [sym.imp.KERNEL32.dll_LoadPackagedLibrary]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CopyIcon]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ChangeDisplaySettingsExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowRect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateDesktopW]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
lea rcx, str.2W34EZp3Jsq6X63
call qword [sym.imp.KERNEL32.dll_AddDllDirectory]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FoldStringW]
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov dword [rsp + 0x30], ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov dword [rsp + 0x30], ebx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_DrawIconEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolTimer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolWait]
xor ecx, ecx
call qword [sym.imp.USER32.dll_LockSetForegroundWindow]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckTokenCapability]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapWalk]
mov rax, qword [sym.imp.KERNEL32.dll_GlobalLock]
lea rdx, [rsp + 0x80]
mov dword [rsp + 0x58], 0x25b
lea rcx, [rsp + 0x50]
add rax, 0x25b
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000f3e0
add rsp, 0x60
pop rbx
ret