Function at 0x1000a7f0
Capabilities:
Get common file path
Get file size
Get hostname
Get system firmware table
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 1
cmp dword [ebp + 0xc], 1
jne 0x1000aa04
movzx eax, byte [0x1003fb00]
test eax, eax
je 0x1000aa04
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 3
jne 0x1000aa04
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetDCPenColor]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumFontFamiliesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSectionWhenCallbackReturns]
xor ecx, ecx
lock inc dword [ecx]
push 0
call dword [sym.imp.KERNEL32.dll_SetSearchPathMode]
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
call dword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov dword [ebp - 0x14], eax
push 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckTokenCapability]
push 0
push 0x10066b90
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedPushListSListEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
xor edx, edx
xor ecx, ecx
xor eax, eax
lock cmpxchg dword [ecx], edx
push 0
push 0
push 0x10066bc4
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtEscape]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteTapemark]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPreferredUILanguages]
push 0
call dword [sym.imp.GDI32.dll_SaveDC]
push 0
call dword [sym.imp.KERNEL32.dll_LocalSize]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetBrushOrgEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumObjects]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
push 0
push 0
push 0x10066bdc
push 0
push 0x10066c18
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
push 0
call dword [sym.imp.KERNEL32.dll_DisableThreadProfiling]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventExW]
movzx ecx, byte [0x1003fb00]
test ecx, ecx
je 0x1000aa14
call fcn.100094e0
cmp dword [0x1003fb04], 0x7a9d792
jne 0x1000aba4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolTimer]
push 0
call dword [sym.imp.GDI32.dll_GetTextAlign]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPagesNuma]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_Arc]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
mov dword [ebp - 0x1c], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
push 0
push 0
push 0x10066c4c
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
push 0
call dword [sym.imp.GDI32.dll_SaveDC]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push 0
call dword [sym.imp.GDI32.dll_UpdateColors]
push 0
call dword [sym.imp.GDI32.dll_CloseMetaFile]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileValidData]
call dword [sym.imp.KERNEL32.dll_GetSystemDEPPolicy]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetApplicationRecoveryCallback]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
call dword [sym.imp.KERNEL32.dll_IsThreadAFiber]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRecoveryCallback]
xor eax, eax
xor edx, edx
xor esi, esi
xor edi, edi
xor ecx, ecx
push ebx
mov ebx, edi
lock cmpxchg8b qword [esi]
mov edi, ebx
pop ebx
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateDIBPatternBrush]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTimeEx]
push 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolTimerEx]
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], edx
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp dword [ebp - 4], 0
jne 0x1000abb4
push 0
call fcn.10006350
add esp, 4
cmp dword [0x1003fb04], 0xc01075
jne 0x1000adaf
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
push 0
call dword [sym.imp.GDI32.dll_GetROP2]
push 0
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetTextExtentExPointI]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileIntW]
push 0
call dword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PolyDraw]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupSeek]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumFontsW]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileDescriptionW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolIo]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 0
call dword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov dword [ebp - 0x24], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolWork]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFiber]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileBandwidthReservation]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_DPtoLP]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetTextCharsetInfo]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
push 0
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRoundRectRgn]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNLSVersion]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineTransform]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 0
call dword [sym.imp.GDI32.dll_StartPage]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc