Function at 0x10002ff0
Capabilities:
Check for unexpected memory writes
Create directory
Create pipe
Create process on windows
Create thread
Delete directory
Get file attributes
Get file size
Get geographical location
Identify system language via api
Manipulate console buffer
Read .ini file
Read file on windows
Set registry value
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
lea edx, [esp + 0x1c]
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x20]
add eax, 0x1de
mov dword [esp + 0x24], 4
push 0x1de
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0x100c1ee4
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x34], 0x100c1ed8
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0x20019
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], 0x80000001
call fcn.10009280
add esp, 0x14
test eax, eax
jne 0x100035f2
cmp dword [0x100b7590], 0x44e1a1b0
mov esi, dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
mov edi, dword [sym.imp.KERNEL32.dll_BackupRead]
jne 0x10003329
push eax
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLocaleName]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
push 0
push 0
push 0x100c1a18
push 0
push 0
push 0x100c1a3c
call dword [sym.imp.KERNEL32.dll_GetTimeFormatEx]
push 0
push 0
call esi
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_SetUserGeoID]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
push 0
push 0
push 0
push 0x100c1a74
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolTimer]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DiscardVirtualMemory]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push 0
push 0
push 0
push 0
push 0x100c1a94
call dword [sym.imp.KERNEL32.dll_FindFirstFileNameTransactedW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
xor eax, eax
lock inc dword [eax]
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreatePrivateNamespaceW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWriteWatch]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetApplicationRestartSettings]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
push 0
push 0
push 0x100c1ac0
push 0
push 0x100c1af0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExEx]
push 0
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddSIDToBoundaryDescriptor]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteTapemark]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadErrorMode]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommConfig]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiberEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
lea eax, [esp + 0x24]
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], eax
lea edx, [esp + 0x28]
lea eax, [esp + 0xc]
mov dword [esp + 0x18], eax
lea ecx, [esp + 8]
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add eax, 0x1fc
push 0x1fc
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.10009500
add esp, 0x18
push dword [esp + 8]
test eax, eax
jne 0x100035ec
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x100b7590], 0xf95dbd1
jne 0x100035e2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
push 0x100c1b28
call dword [sym.imp.KERNEL32.dll_AddDllDirectory]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0
call dword [sym.imp.KERNEL32.dll_NeedCurrentDirectoryForExePathW]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesTransactedW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimerEx]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push 0
push 0
call esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_LocalLock]
push 0
call dword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualLock]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
mov edi, dword [sym.imp.KERNEL32.dll_ResolveLocaleName]
push 0
push 0
push 0x100c1b50
call edi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNLSVersion]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveSecureMemoryCacheCallback]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64SuspendThread]
push 0
call dword [sym.imp.KERNEL32.dll_DebugBreakProcess]
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
push 0
push 0
push 0
push 0x100c1b7c
call esi
push 0
push 0
push 0x100c1bac
call edi
push 0
push 0
push 0
push 0x100c1be8
call esi
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
push 0x100c1c10
push 0
push 0
push 0x100c1c4c
push 0
push 0
push 0x100c1c70
call dword [sym.imp.KERNEL32.dll_GetDateFormatEx]
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0
push 0
push 0x100c1c94
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDurationFormat]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadErrorMode]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
mov eax, dword [esp + 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov byte [0x1008f461], 1
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret