Function at 0x434560
Capabilities:
Copy file
Create pipe
Delete file
Get common file path
Get disk information
Get file attributes
Manipulate console buffer
Query environment variable
Read pipe
Receive http response
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x3130
call fcn.0040e830
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [esp + 0x38]
xor esi, esi
cmp esi, 0x2cdc8
jge 0x43458e
call ebp
cmp dword [0x7bea94], 0x6fb
jne 0x4345ac
push 0
lea eax, [esp + 0x144]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
cmp esi, 0x1e9afa1e
jle 0x4345c4
cmp edi, 0xc10c34
je 0x4345c4
cmp ebx, 0x952fd20
jne 0x4345cd
inc esi
cmp esi, 0x992a2
jl 0x434584
cmp dword [0x7bea94], 0xcf8
jne 0x43468f
fldz
sub esp, 8
fstp qword [esp]
call fcn.00405250
fstp st(0)
fldz
fstp qword [esp]
call fcn.00404f50
fstp st(0)
push 0x404848
push 0
call fcn.00405192
push 0
call fcn.00405162
add esp, 0x14
push 0
push 0
call fcn.0041099c
fldz
fstp qword [esp]
call fcn.00404f50
fstp st(0)
push 0
call fcn.00405157
add esp, 0xc
push 0
push 0
call fcn.0040506d
push 0
push 0
call fcn.00405392
fld qword [0x404c60]
add esp, 8
fstp qword [esp]
push 0x404854
call fcn.00405192
add esp, 0xc
push 0
call fcn.004050ad
add esp, 4
push 0
push 0
call fcn.00405392
push 0
call fcn.0040536a
add esp, 0xc
push 0
call fcn.004054ac
add esp, 4
push 0
push 0
push 0
push 0
call fcn.00404f2c
add esp, 0x10
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
xor esi, esi
cmp esi, 0x408
jne 0x4346b0
mov eax, 0x5d1
add dword [0x7bea94], eax
cmp dword [0x7bea94], 3
jne 0x4346dc
xor ecx, ecx
lea eax, [esp + 0x38]
push eax
push ecx
push ecx
push 0x40485c
push ecx
mov dword [esp + 0x50], ecx
call edi
push 0
push 0
lea edx, [esp + 0x948]
push edx
call ebx
inc esi
cmp esi, 0x1518d4
jl 0x43469d
mov eax, dword [0x7bea94]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x43fae4], eax
mov eax, dword [0x7bea94]
xor esi, esi
test eax, eax
je 0x43474f
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
cmp eax, 0xfe
jne 0x434720
push 0
call ebp
call fcn.00434130
mov eax, dword [0x7bea94]
cmp eax, 0x29
jne 0x43474a
push 0
push 0
lea ecx, [esp + 0x148]
push ecx
push 0
call edi
push 0
push 0
call ebx
mov eax, dword [0x7bea94]
inc esi
cmp esi, eax
jb 0x434715
cmp eax, 0x70
jne 0x4348a4
push 0x40489c
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x4048dc
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0
push 0x4048f0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea edx, [esp + 0x940]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
lea eax, [esp + 0x2d44]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push 0
lea ecx, [esp + 0x1d44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll__hread]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 0x404908
push 0x40491c
call esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push 0
call dword [sym.imp.KERNEL32.dll_FatalExit]
mov esi, dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov dword [esp + 0x38], 0x9682ab
cmp eax, 0xdf
jne 0x4349f5
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call edi
xor edx, edx
lea ecx, [esp + 0x4c]
push ecx
push edx
push edx
lea eax, [esp + 0x14c]
push eax
push edx
mov dword [esp + 0x50], edx
call ebp
lea ecx, [esp + 0x44]
push ecx
push 0
push 0
push 0
call ebx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
call dword [sym.imp.KERNEL32.dll_ZombifyActCtx]
push 0x404a80
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x48]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
push 0x404aa8
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
lea eax, [esp + 0x40]
push eax
push 0x404ab4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFix]
push 0
lea edx, [esp + 0xd44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0x30
lea eax, [esp + 0x64]
push 0
push eax
mov dword [esp + 0x68], 0
call fcn.00406560
add esp, 0xc
push 0
lea ecx, [esp + 0x60]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
lea edx, [esp + 0x1540]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [0x7bea94]
dec dword [esp + 0x38]
jne 0x4348c4
mov edi, dword [sym.imp.USER32.dll_CharUpperW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, 0x12dba7f4
push 0
call edi
push 0
call ebx
dec esi
jne 0x434a10
mov byte [0x43ad50], 0
call fcn.00434040
call fcn.004343a0
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
jmp 0x434a40
cmp dword [0x7bea94], 0xba
jne 0x434a81
push 0
lea eax, [esp + 0x144]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x54]
push eax
push 0
lea ecx, [esp + 0x1558]
push ecx
push 0x404ac4
call edi
push 0x404ae4
push 0
push 0
call ebx
cmp esi, 0x2f64
jne 0x434a94
mov eax, 0
add dword [0x43fae4], eax
inc esi
cmp esi, 0x1605a
jl 0x434a40
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov edi, 0xf2b8b
jmp 0x434ab0
cmp dword [0x7bea94], 0x21
jne 0x434ac3
push 0
push 0
push 0
push 0
call esi
dec edi
jne 0x434ab0
mov edx, 0x73
mov eax, 0x6d
mov word [0x7bea9a], dx
mov word [0x7bea9e], ax
xor eax, eax
mov ecx, 0x33
mov edx, 0x67
mov word [0x7beaa2], cx
mov word [0x7beaae], ax
mov word [0x7beaa0], dx
mov eax, 0x69
mov ecx, 0x6d
mov edx, 0x6c
push 0x7bea98
mov dword [0x7beaa8], 0x6c0064
mov word [0x7bea9c], ax
mov word [0x7bea98], cx
mov word [0x7beaac], dx
mov dword [0x7beaa4], 0x2e0032
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp dword [0x7bea94], 0xc30
jne 0x434c43
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea edx, [esp + 0x940]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push edi
lea eax, [esp + 0xd44]
push eax
push 0x404b10
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
call dword [sym.imp.KERNEL32.dll_AddRefActCtx]
push edi
lea ecx, [esp + 0x44]
push ecx
push edi
lea edx, [esp + 0x14c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
push edi
lea eax, [esp + 0x2544]
push eax
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x4c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0x404b40
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0x404b4c
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
lea edx, [esp + 0x1d44]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_VerLanguageNameW]
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
push edi
push 0x404b70
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
lea eax, [esp + 0x50]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
push edi
lea ecx, [esp + 0x1544]
push ecx
push 0x404c30
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [esp + 0x90]
push edx
call dword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret