You'd probably have a weight of some sort so if the program wants to modify N files, it gets 0.23N 'suspicious-points'. To get how many files the code wants to

You'd probably have a weight of some sort so if the program wants to modify N files, it gets 0.23N 'suspicious-points'. To get how many files the code wants to modify, you have standard symbolic execution without actually performing the syscalls/WINAPI. Same with checking if the deletion is in the main code path vs behind some event trigger. There's no silver bullets but you can certainly factor 'normal' behavior into your analysis.