Function at 0x10009690
Capabilities:
Get memory capacity
Get uefi variable
Identify system language via api
Query environment variable
Read .ini file
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
jne 0x10009811
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
push 0
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetAtomNameW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeClientComputerNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolTimer]
push 0
call dword [sym.imp.KERNEL32.dll_LocalSize]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call dword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
push 0
call dword [sym.imp.KERNEL32.dll_DisassociateCurrentThreadFromCallback]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
push 0
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0
push 0
push str.D5gi2s7SyaiYezOG9QGPUDcJOJi
push 0
push 0
push str.paUW2oOLRrPC6phXqFk2
call dword [sym.imp.KERNEL32.dll_GetTimeFormatEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFiber]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0
call edi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSynchronizationBarrier]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessId]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push 0
push 0
push 0
push str.U1V9knFzT4L5JQ6vqI18Fabx984H9
push 0
call dword [sym.imp.KERNEL32.dll_GetStringScripts]
push 0
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 1
jne 0x10009803
cmp dword [0x100f7d8c], 0x57d0b459
mov esi, dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
mov edi, dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jne 0x10009972
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrefetchVirtualMemory]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckNameLegalDOS8Dot3W]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetMailslotInfo]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 0
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformationForYear]
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_InitAtomTable]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameTransactedW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
mov eax, 0x10008880
add eax, 0x247
push 0x247
push eax
call fcn.1000e9e0
mov eax, 0x10005600
add eax, 0x23b
push 0x23b
push eax
call fcn.1000e9e0
mov eax, 0x10006b10
add eax, 0x189
push 0x189
push eax
call fcn.100106c0
add esp, 0x18
mov ebx, eax
cmp dword [0x100f7d8c], 0x55131a1d
jne 0x10009afa
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddVectoredContinueHandler]
push 0
call dword [sym.imp.USER32.dll_GetTopWindow]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetMenuItemRect]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
push 0
push 0
call dword [sym.imp.USER32.dll_GetTitleBarInfo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProtectedPolicy]
push 0
call dword [sym.imp.USER32.dll_DdeUninitialize]
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
push 0
push 0
call dword [sym.imp.USER32.dll_MonitorFromRect]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDesktopW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesExW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
push 0
call dword [sym.imp.USER32.dll_CloseWindowStation]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0
call dword [sym.imp.KERNEL32.dll_DisassociateCurrentThreadFromCallback]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetWindowRgnBox]
call dword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
push 0
call edi
push 0
call dword [sym.imp.USER32.dll_CloseDesktop]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
push 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcatW]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc