Function at 0x180001fb0
Capabilities:
Get common file path
Get memory capacity
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x50
mov rax, qword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea r8, [rsp + 0x68]
mov dword [rsp + 0x48], 0x231
lea rdx, [rsp + 0x60]
add rax, 0x231
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
xor ebx, ebx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], ebx
call fcn.18000f260
cmp dword [0x180100cd8], 0x3a77d5aa
mov qword [rsp + 0x70], rax
jne 0x1800021c5
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateCursor]
mov r9d, dword [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolIoCallbacks]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetMenuContextHelpId]
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnloadKeyboardLayout]
xor eax, eax
lock cmpxchg qword [rbx], rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateIconIndirect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdePostAdvise]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommConfig]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReuseDDElParam]
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnableMouseInPointer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerSessionId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DestroyIcon]
xor r9d, r9d
lea rcx, [0x1801182d8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IntersectRect]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_HiliteMenuItem]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlPcToFileHeader]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeEnableCallback]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeCreateDataHandle]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUILanguageInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetPhysicalCursorPos]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClassWord]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov rax, qword [sym.imp.KERNEL32.dll_GlobalLock]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x48], 0x1a5
lea rcx, [rsp + 0x40]
add rax, 0x1a5
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000f3f0
add rsp, 0x50
pop rbx
ret