Function at 0x10004290
Capabilities:
Get common file path
Identify system language via api
Manipulate console buffer
Query environment variable
Register raw input devices
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_AdjustWindowRect]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
push 0
push 0
call dword [sym.imp.USER32.dll_EqualRect]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetClassWord]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddResourceAttributeAce]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatusEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsExW]
push 0
push 0
push 0
push str.OTgoxG3GVwkGfCx4amO
push 0
push str.9DNjdsww9CPUCwC3451
call dword [sym.imp.KERNEL32.dll_GetNumberFormatEx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowRgn]
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatusEx]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
push 0
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolTimer]
xor eax, eax
xor ecx, ecx
lock xadd dword [ecx], eax
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
push dword [ebp - 4]
push dword [ebp - 4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_wvsprintfW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_FillRect]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
call dword [sym.imp.USER32.dll_LoadCursorFromFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadIdealProcessorEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
push 0
push 0
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeServerProcessId]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileValidData]
push 0
push 0
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteSynchronizationBarrier]
push 0
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call dword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov esp, ebp
pop ebp
ret