Function at 0x180001fb0
Capabilities:
Create process on windows
Enumerate gui resources
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
xor edi, edi
mov dword [rbp + 0x67], edi
mov rax, qword [sym.imp.KERNEL32.dll_GlobalAlloc]
add rax, 0x1bc
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], 0x1bc
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 1], rdi
mov qword [rbp + 7], rdi
mov qword [rbp + 0xf], rdi
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], rdi
mov ecx, 0x10
call fcn.18006e5e8
mov qword [rax + 8], rdi
mov qword [rbp - 1], rax
lea rcx, [rbp - 1]
mov qword [rax], rcx
mov word [rbp + 0x2f], di
mov qword [rbp + 0x35], rdi
mov qword [rbp + 0x3d], rdi
xor eax, eax
mov word [rbp + 0x32], ax
mov byte [rbp + 0x34], al
mov word [rbp + 0x35], ax
mov byte [rbp + 0x37], al
mov word [rbp + 0x38], ax
mov byte [rbp + 0x3a], al
mov word [rbp + 0x3b], ax
mov byte [rbp + 0x3d], al
mov word [rbp + 0x3e], ax
mov byte [rbp + 0x40], al
mov word [rbp + 0x41], ax
mov byte [rbp + 0x43], al
mov dword [rbp - 5], edi
mov dword [rbp + 0x2b], edi
movaps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 0x29], xmm0
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x67]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.180016c90
mov rbx, qword [rbp - 0x11]
lea rcx, [rbp - 1]
call fcn.1800175b0
mov rcx, qword [rbp - 1]
mov qword [rbp - 1], rdi
mov edx, 0x10
call fcn.18006e4fc
mov qword [rbp + 0x77], rbx
cmp dword [0x1800f8cb8], 0x8cc6ca11
jne 0x180002271
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemFileCacheSize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetRawInputDeviceList]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReclaimVirtualMemory]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenu]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateDialogParamW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DestroyIcon]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharLowerBuffW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadpoolStackInformation]
call qword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameTransactedW]
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GrayStringW]
call qword [sym.imp.KERNEL32.dll_IsThreadAFiber]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetTitleBarInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumLanguageGroupLocalesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_TrackMouseEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCompressedFileSizeTransactedW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetActiveWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuInfo]
call qword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowCaret]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PeekMessageW]
mov rax, qword [sym.imp.KERNEL32.dll_GlobalLock]
add rax, 0x25b
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], 0x25b
movaps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 0x29], xmm0
lea rdx, [rbp + 0x77]
lea rcx, [rbp - 0x29]
call fcn.1800104d0
add rsp, 0xc0
pop rdi
pop rbx
pop rbp
ret