Function at 0x180007470
Capabilities:
Delete file
Get geographical location
Move file
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
xor ecx, ecx
call fcn.180070ea0
mov ecx, eax
call fcn.18006d14c
call fcn.18006d120
and eax, 0x80000003
jge 0x1800074ad
dec eax
or eax, 0xfffffffc
inc eax
xor r14d, r14d
mov ebx, r14d
test eax, eax
jne 0x1800075c7
cmp dword [0x180117e58], 0x74e74ddd
jne 0x1800075b6
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateBoundaryDescriptorW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ClipCursor]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsMenu]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetQueueStatus]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetUserObjectInformationW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrefetchVirtualMemory]
xor edx, edx
lea rcx, str.718G3q4ZB4fgAbE5
call qword [sym.imp.KERNEL32.dll_LoadPackagedLibrary]
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnloadKeyboardLayout]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSizeEx]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ToUnicode]
call qword [sym.imp.USER32.dll_GetOpenClipboardWindow]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelIo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapWalk]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisassociateCurrentThreadFromCallback]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckTokenMembershipEx]
call qword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
mov rdx, qword [rbp + 0x6f]
call fcn.180002ad0
mov rbx, rax
jmp 0x180008022
cmp eax, 1
jne 0x180007989
mov r8d, 0xffffe804
nop word [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x1800075e0
lea ecx, [r8 - 0x749e]
mov eax, ecx
and eax, 0x80000003
jge 0x180007611
dec eax
or eax, 0xfffffffc
inc eax
lea edx, [r8 + 0x2ad1]
lea r10d, [r8 + r8]
lea r11d, [r8 + 0x1d94]
mov r9d, 0x2324
sub r9d, r10d
test r9b, 1
je 0x18000763e
test r9d, r9d
jle 0x18000763e
add r9d, 0x1081
add r10d, 0xffffbe4e
mov esi, r11d
sub esi, r10d
mov ebx, 0x51c3
mov r8d, 0x4ed1
test eax, eax
cmove r8d, ebx
add r8d, ecx
sub r10d, edx
lea ebx, [r11 + 0x225c]
lea r11d, [rdx*2 + 0x498]
sub esi, 0x991
mov eax, 0x976
sub eax, r11d
add r10d, eax
add r8d, ebx
sub r9d, r10d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
je 0x1800076ba
nop
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x1800076a0
add r11d, 0x19f8
sub ebx, r10d
lea edx, [r11 - 0x29f]
sub r11d, ebx
lea eax, [r9 + r9]
mov ecx, 0x1255
sub ecx, eax
add esi, ecx
lea edi, [rsi + rbx*2]
lea ebx, [rdx + r10]
mov eax, 0x55555556
imul r11d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
lea ecx, [r11 + 0x1bde]
cmp r11d, eax
cmove ecx, r11d
add ecx, 0x230e
mov r11d, ecx
add esi, 0x2a96
lea r10d, [r8 + 0x4c7]
add r10d, edi
add edi, ecx
mov r8d, esi
sub r8d, ecx
mov r9d, ebx
sub r9d, esi
sub ecx, 0xfb0
add ecx, r10d
sub edi, ecx
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, 0x1542
mov ecx, 0x4902
cmp ebx, eax
cmove edx, ecx
add edx, r8d
add edx, r10d
add edx, ebx
lea r10d, [r9 + rdi]
add edi, 0x46e
mov ebx, edx
sub ebx, edi
sub ebx, 0x48cf
sub esi, 0x2fc2
sub r10d, esi
sub r10d, 0x1c6
lea ecx, [r11 - 0x3cf3]
add ecx, edi
sub esi, r10d
add r10d, 0xc79
mov eax, 0xffffe7bb
sub eax, ecx
add ebx, eax
add ecx, 0xcb
add esi, ecx
lea r8d, [rdi + 0xaa3]
sub ebx, r8d
sub r8d, ebx
lea r9d, [rbx + r10]
add ecx, 0xffffe81b
add r9d, ecx
lea ecx, [rdx - 0x1d5f]
mov eax, 0xc35
sub eax, ebx
add r10d, eax
lea edx, [rcx + 0x2508]
add edx, esi
mov eax, 0x10f6
sub eax, ecx
sub eax, r9d
add ebx, eax
lea r11d, [r8 + 0x10a3]
add r11d, edx
lea r8d, [rcx + 0xc35]
sub r9d, 0x1dda
mov ecx, r8d
sub ecx, r10d
add edx, 0xfffffab6
add ecx, edx
sub ebx, r10d
add r8d, 0x21a0
mov eax, 0x16d3
sub eax, r9d
add r11d, eax
lea eax, [rcx + 0x39d7]
add eax, ebx
add r10d, eax
lea edx, [r10 + 0x3b8f]
add edx, ebx
add edx, r9d
add edx, ecx
sub r11d, edx
sub r11d, r10d
sub r10d, 0x101e
sub r8d, r10d
lea eax, [r11 + r11]
cmp edx, 0xffe73d90
jne 0x18000797d
cmp ebx, 0xfffb50eb
jne 0x18000797d
cmp r11d, 0x1f432f
jne 0x18000797d
cmp eax, 0x3e865e
jne 0x18000797d
cmp r10d, 0xfff52732
jne 0x18000797d
cmp r8d, 0x9ee2a
jne 0x18000797d
mov dword [rbp + 0x67], 4
mov dword [rbp + 0x77], 0x3000
mov qword [rbp + 0x7f], r14
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x24c
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], 0x24c
xorps xmm0, xmm0
movups xmmword [rbp - 0x69], xmm0
mov qword [rbp - 0x51], r14
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x31], r14
mov ecx, InitCommonControls
call fcn.180067324
mov qword [rax + 8], r14
mov qword [rbp - 0x51], rax
lea rcx, [rbp - 0x51]
mov qword [rax], rcx
mov word [rbp - 0x21], r14w
mov qword [rbp - 0x1b], r14
mov qword [rbp - 0x13], r14
xor eax, eax
mov word [rbp - 0x1e], ax
mov byte [rbp - 0x1c], al
mov word [rbp - 0x1b], ax
mov byte [rbp - 0x19], al
mov word [rbp - 0x18], ax
mov byte [rbp - 0x16], al
mov word [rbp - 0x15], ax
mov byte [rbp - 0x13], al
mov word [rbp - 0x12], ax
mov byte [rbp - 0x10], al
mov word [rbp - 0xf], ax
mov byte [rbp - 0xd], al
mov dword [rbp - 0x55], r14d
mov dword [rbp - 0x25], r14d
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 9], xmm0
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x7f]
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x69]
call fcn.1800156c0
mov rbx, qword [rbp - 0x61]
lea rcx, [rbp - 0x51]
call fcn.1800187f0
mov rcx, qword [rbp - 0x51]
mov qword [rbp - 0x51], r14
jmp 0x180008018
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x180007bf0
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x285
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], 0x285
xorps xmm0, xmm0
movups xmmword [rbp - 0x69], xmm0
mov qword [rbp - 0x51], r14
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x31], r14
mov ecx, InitCommonControls
call fcn.180067324
mov qword [rax + 8], r14
mov qword [rbp - 0x51], rax
lea rcx, [rbp - 0x51]
mov qword [rax], rcx
mov word [rbp - 0x21], bx
mov qword [rbp - 0x1b], r14
mov qword [rbp - 0x13], r14
xor eax, eax
mov word [rbp - 0x1e], ax
mov byte [rbp - 0x1c], al
mov word [rbp - 0x1b], ax
mov byte [rbp - 0x19], al
mov word [rbp - 0x18], ax
mov byte [rbp - 0x16], al
mov word [rbp - 0x15], ax
mov byte [rbp - 0x13], al
mov word [rbp - 0x12], ax
mov byte [rbp - 0x10], al
mov word [rbp - 0xf], ax
mov byte [rbp - 0xd], al
mov dword [rbp - 0x55], r14d
mov dword [rbp - 0x25], r14d
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 9], xmm0
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x69]
call fcn.1800154a0
mov rbx, qword [rbp - 0x61]
lea rcx, [rbp - 0x51]
call fcn.1800187f0
mov rcx, qword [rbp - 0x51]
mov qword [rbp - 0x51], r14
mov edx, InitCommonControls
call fcn.180067238
mov qword [rbp + 0x77], rbx
cmp dword [0x180117e58], 0xc675df89
jne 0x180007b1a
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dword [rbp + 0x67], 8
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rax, 0x188
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], 0x188
xorps xmm0, xmm0
movups xmmword [rbp - 0x69], xmm0
mov qword [rbp - 0x51], r14
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x31], r14
mov ecx, InitCommonControls
call fcn.180067324
mov qword [rax + 8], r14
mov qword [rbp - 0x51], rax
lea rcx, [rbp - 0x51]
mov qword [rax], rcx
mov word [rbp - 0x21], 0
mov qword [rbp - 0x1b], r14
mov qword [rbp - 0x13], r14
xor eax, eax
mov word [rbp - 0x1e], ax
mov byte [rbp - 0x1c], al
mov word [rbp - 0x1b], ax
mov byte [rbp - 0x19], al
mov word [rbp - 0x18], ax
mov byte [rbp - 0x16], al
mov word [rbp - 0x15], ax
mov byte [rbp - 0x13], al
mov word [rbp - 0x12], ax
mov byte [rbp - 0x10], al
mov word [rbp - 0xf], ax
mov byte [rbp - 0xd], al
mov dword [rbp - 0x55], r14d
mov dword [rbp - 0x25], r14d
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 9], xmm0
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x67]
lea r8, [rbp + 0x77]
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x69]
call fcn.180015260
mov rbx, qword [rbp - 0x61]
lea rcx, [rbp - 0x51]
call fcn.1800187f0
mov rcx, qword [rbp - 0x51]
mov qword [rbp - 0x51], r14
jmp 0x180008018
cmp eax, 3
jne 0x180008022
mov dword [rbp + 0x67], r14d
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
add rax, 0x1b6
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], 0x1b6
xorps xmm0, xmm0
movups xmmword [rbp - 0x69], xmm0
mov qword [rbp - 0x51], r14
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x31], r14
mov ecx, InitCommonControls
call fcn.180067324
mov qword [rax + 8], r14
mov qword [rbp - 0x51], rax
lea rcx, [rbp - 0x51]
mov qword [rax], rcx
mov word [rbp - 0x21], bx
mov qword [rbp - 0x1b], r14
mov qword [rbp - 0x13], r14
xor eax, eax
mov word [rbp - 0x1e], ax
mov byte [rbp - 0x1c], al
mov word [rbp - 0x1b], ax
mov byte [rbp - 0x19], al
mov word [rbp - 0x18], ax
mov byte [rbp - 0x16], al
mov word [rbp - 0x15], ax
mov byte [rbp - 0x13], al
mov word [rbp - 0x12], ax
mov byte [rbp - 0x10], al
mov word [rbp - 0xf], ax
mov byte [rbp - 0xd], al
mov dword [rbp - 0x55], r14d
mov dword [rbp - 0x25], r14d
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 9], xmm0
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x67]
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x69]
call fcn.180017c20
mov rbx, qword [rbp - 0x61]
lea rcx, [rbp - 0x51]
call fcn.1800187f0
mov rcx, qword [rbp - 0x51]
mov qword [rbp - 0x51], r14
mov edx, InitCommonControls
call fcn.180067238
mov qword [rbp + 0x27], rbx
mov dword [rbp + 0x67], 4
mov dword [rbp + 0x77], 0x3000
mov dword [rbp + 0x7f], 0x400
mov qword [rbp + 0x1f], r14
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x188
mov qword [rbp - 9], rax
mov dword [rbp - 1], 0x188
xorps xmm0, xmm0
movups xmmword [rbp - 0x69], xmm0
mov qword [rbp - 0x51], r14
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x31], r14
mov ecx, InitCommonControls
call fcn.180067324
mov qword [rax + 8], r14
mov qword [rbp - 0x51], rax
lea rcx, [rbp - 0x51]
mov qword [rax], rcx
mov word [rbp - 0x21], 0
mov qword [rbp - 0x1b], r14
mov qword [rbp - 0x13], r14
xor eax, eax
mov word [rbp - 0x1e], ax
mov byte [rbp - 0x1c], al
mov word [rbp - 0x1b], ax
mov byte [rbp - 0x19], al
mov word [rbp - 0x18], ax
mov byte [rbp - 0x16], al
mov word [rbp - 0x15], ax
mov byte [rbp - 0x13], al
mov word [rbp - 0x12], ax
mov byte [rbp - 0x10], al
mov word [rbp - 0xf], ax
mov byte [rbp - 0xd], al
mov dword [rbp - 0x55], r14d
mov dword [rbp - 0x25], r14d
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7f]
lea r8, [rbp + 0x1f]
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x69]
call fcn.180015020
mov rbx, qword [rbp - 0x61]
lea rcx, [rbp - 0x51]
call fcn.1800187f0
mov rcx, qword [rbp - 0x51]
mov qword [rbp - 0x51], r14
mov edx, InitCommonControls
call fcn.180067238
mov qword [rbp + 0x17], rbx
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
add rax, 0x156
mov qword [rbp - 9], rax
mov dword [rbp - 1], 0x156
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 9]
call fcn.1800120b0
mov rbx, rax
cmp dword [0x180117e58], 0xae52ff6c
jne 0x180007f44
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsThreadpoolTimerSet]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPages]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileBandwidthReservation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolIo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
call qword [sym.imp.KERNEL32.dll_GetThreadErrorMode]
xor r8d, r8d
xor edx, edx
lea rcx, str.ROvDLivCAhVKaJfCFjvEc
call qword [sym.imp.KERNEL32.dll_ResolveLocaleName]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTimeEx]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
lea r9, str.yda1PA2VjkwXjsp82hP6R5
xor r8d, r8d
lea rdx, str.6Flpx8cvCPO5D2K1hrYf6fU5SZ2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindStringOrdinal]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalReAlloc]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileStringW]
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.K8168GZTq68GNsby85kgBqT4OVPh
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsExEx]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, str.3xD3K32C9sBU5Y41YdF77cITU
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDevicePowerState]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.L43N6ql1Sz23E6Tz8Yp3zKlw3
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
mov dword [rbp + 0x67], 0x8000
mov dword [rbp + 0x77], r14d
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
add rax, 0x13d
mov qword [rbp - 9], rax
mov dword [rbp - 1], 0x13d
xor eax, eax
mov word [rbp - 0x69], ax
mov byte [rbp - 0x67], al
mov qword [rbp - 0x61], r14
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x51], r14
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], r14
mov ecx, InitCommonControls
call fcn.180067324
mov qword [rax + 8], r14
mov qword [rbp - 0x61], rax
lea rcx, [rbp - 0x61]
mov qword [rax], rcx
mov word [rbp - 0x31], 0
mov qword [rbp - 0x2b], r14
mov qword [rbp - 0x23], r14
xor eax, eax
mov word [rbp - 0x2e], ax
mov byte [rbp - 0x2c], al
mov word [rbp - 0x2b], ax
mov byte [rbp - 0x29], al
mov word [rbp - 0x28], ax
mov byte [rbp - 0x26], al
mov word [rbp - 0x25], ax
mov byte [rbp - 0x23], al
mov word [rbp - 0x22], ax
mov byte [rbp - 0x20], al
mov word [rbp - 0x1f], ax
mov byte [rbp - 0x1d], al
mov dword [rbp - 0x65], r14d
mov dword [rbp - 0x35], r14d
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
lea r8, [rbp + 0x17]
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x69]
call fcn.180014de0
nop
lea rcx, [rbp - 0x61]
call fcn.1800187f0
mov rcx, qword [rbp - 0x61]
mov qword [rbp - 0x61], r14
mov edx, InitCommonControls
call fcn.180067238
mov rax, rbx
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret