Function at 0x10009830
Capabilities:
Check for unexpected memory writes
Copy file
Delete directory
Delete file
Get common file path
Get file size
Get system firmware table
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 1
cmp dword [ebp + 0xc], 1
jne 0x10009a1f
movzx eax, byte [0x10037b00]
test eax, eax
je 0x10009a1f
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 3
jne 0x10009a1f
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumFontFamiliesExW]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestColor]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessGroupAffinity]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_AnimatePalette]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PatBlt]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateBitmap]
push 0
call dword [sym.imp.KERNEL32.dll_DisableThreadProfiling]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRasterizerCaps]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
push 0
mov edx, dword [ebp - 8]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64SuspendThread]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetArcDirection]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeNumberFromHandle]
push 0
push 0
push 0x10091468
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtEscape]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMinimum]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileTransactedW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateBoundaryDescriptorW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_OffsetClipRgn]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_IntersectClipRect]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
push 0
call dword [sym.imp.KERNEL32.dll_FlsAlloc]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPreferredUILanguages]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileById]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
movzx eax, byte [0x10037b00]
test eax, eax
je 0x10009a2f
call fcn.10008710
cmp dword [0x10037b08], 0x7a9d792
jne 0x10009cae
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFlags]
push 0x1009147c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_DisableThreadProfiling]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileTransactedW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileById]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PowerClearRequest]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckTokenCapability]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ScaleWindowExtEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FlushViewOfFile]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
call dword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PolyDraw]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
push 0
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFiberEx]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
push 0
call dword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov dword [ebp - 0x18], eax
push 0
push 0
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumLanguageGroupLocalesW]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_RemoveFontResourceExW]
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
push 0
call dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileTransactedW]
push 0
call dword [sym.imp.KERNEL32.dll_IsThreadpoolTimerSet]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
push 0
push 0
push 0x10091494
call dword [sym.imp.KERNEL32.dll_ResolveLocaleName]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
push 0
call dword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetTextJustification]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolTimer]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetGlyphOutlineW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextStreamW]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp dword [ebp - 4], 0
jne 0x10009cbe
push 0
call fcn.10005b70
add esp, 4
cmp dword [0x10037b08], 0xc01075
jne 0x10009e96
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetUserPreferredUILanguages]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetDIBitsToDevice]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0
call dword [sym.imp.GDI32.dll_EndPage]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveSecureMemoryCacheCallback]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileById]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformationForYear]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpool]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleHistoryInfo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePrivateNamespaceW]
push 0
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddSIDToBoundaryDescriptor]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileTransactedW]
push 0
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
xor eax, eax
xor ecx, ecx
lock xadd dword [ecx], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetSearchPathMode]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddResourceAttributeAce]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetWorldTransform]
push 0
call dword [sym.imp.KERNEL32.dll_DebugSetProcessKillOnExit]
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_AngleArc]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWriteWatch]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc