Function at 0x4a8880
Capabilities:
Copy file
Delete file
Get common file path
Get file attributes
Manipulate console buffer
Move file
Query environment variable
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x4a9a6c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, 0x22f0
call fcn.004132e0
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0xec]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp esi, 0x2d19c
jge 0x4a88d1
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call edi
cmp dword [0x834114], 0x6fb
jne 0x4a88e9
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
cmp esi, 0x1e9afa0a
jle 0x4a8901
cmp ebx, 0xc10b3a
je 0x4a8901
cmp ebp, 0x9514f0c
jne 0x4a890a
inc esi
cmp esi, 0x83358
jl 0x4a88bf
cmp dword [0x834114], 0xcf8
jne 0x4a8aab
push 0
call fcn.00407959
add esp, 4
xor ebp, ebp
push ebp
push ebp
call fcn.0040781d
add esp, 8
lea eax, [esp + 0x48]
push eax
call fcn.00405820
fldz
sub esp, 0x10
fst qword [esp + 8]
fstp qword [esp]
call fcn.00407a20
fstp st(0)
push ebp
push ebp
call fcn.00407919
push ebp
push ebp
call fcn.00407919
push ebp
call fcn.00407a58
add esp, 0x24
push ebp
call fcn.00407b3e
add esp, 4
push ebp
push ebp
push ebp
push ebp
push ebp
call fcn.00407518
mov edx, dword [esp + 0x5c]
mov eax, dword [edx + 4]
lea ecx, [esp + 0xb4]
add esp, 0x14
mov dword [esp + 0x30], ecx
mov dword [esp + eax + 0x48], 0x4043d4
mov dword [esp + 0x233c], ebp
test byte [esp + 0x98], 1
lea ecx, [esp + 0x58]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x58], 0x404394
je 0x4a89c4
mov edx, dword [esp + 0x68]
mov eax, dword [edx]
push eax
call fcn.00407a4d
add esp, 4
mov eax, dword [esp + 0x68]
mov dword [eax], ebp
mov ecx, dword [esp + 0x78]
mov dword [ecx], ebp
mov edx, dword [esp + 0x88]
mov dword [edx], ebp
mov eax, dword [esp + 0x6c]
mov dword [eax], ebp
mov ecx, dword [esp + 0x7c]
mov dword [ecx], ebp
mov edx, dword [esp + 0x8c]
mov dword [edx], ebp
and dword [esp + 0x98], 0xfffffffe
mov dword [esp + 0x94], ebp
mov dword [esp + 0x58], 0x40434c
mov byte [esp + 0x233c], 1
mov eax, dword [esp + 0x90]
mov ebx, eax
cmp eax, ebp
je 0x4a8a65
mov edi, dword [eax]
cmp edi, ebp
je 0x4a8a5c
push ebp
lea ecx, [esp + 0x30]
call fcn.00406cb2
mov eax, dword [edi + 4]
cmp eax, ebp
jbe 0x4a8a3a
cmp eax, 0xffffffff
jae 0x4a8a3a
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x2c]
and esi, edi
call fcn.00406cda
cmp esi, ebp
je 0x4a8a5c
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
push ebx
call fcn.00407a4d
add esp, 4
lea ecx, [esp + 0x5c]
mov byte [esp + 0x233c], 0
call fcn.00406d0b
mov dword [esp + 0x233c], 0xffffffff
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + 4]
lea edx, [esp + 0xa0]
mov dword [esp + ecx + 0x48], 0x40438c
push edx
mov dword [esp + 0xa4], 0x40433c
call fcn.004068be
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
xor esi, esi
cmp esi, 0x408
jne 0x4a8ac6
mov eax, 0x5d1
add dword [0x834114], eax
cmp dword [0x834114], 3
jne 0x4a8add
push 0
push 0
lea eax, [esp + 0x308]
push eax
call edi
inc esi
cmp esi, 0x1518d4
jl 0x4a8ab3
mov ecx, dword [0x834114]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x4b5164], eax
mov eax, dword [0x834114]
xor esi, esi
test eax, eax
je 0x4a8b4d
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
cmp eax, 0xfe
jne 0x4a8b24
push 0
lea edx, [esp + 0x304]
push edx
call ebx
call fcn.004a83f0
mov eax, dword [0x834114]
cmp eax, 0x29
jne 0x4a8b48
push 0
push 0
lea eax, [esp + 0x308]
push eax
push 0
call edi
mov eax, dword [0x834114]
inc esi
cmp esi, eax
jb 0x4a8b11
cmp eax, 0x70
jne 0x4a8c2a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push 0
push 0x404150
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea ecx, [esp + 0x1b00]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
lea edx, [esp + 0xb04]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommConfig]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
lea eax, [esp + 0x304]
push eax
push 0
call dword [sym.imp.KERNEL32.dll__hread]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileA]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push 0
push 0
lea ecx, [esp + 0x1308]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov eax, dword [0x834114]
mov edi, dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
mov dword [esp + 0x2c], 0x9682ab
lea ebx, [ebx]
cmp eax, 3
jne 0x4a8c7e
push 0x404164
push 0
lea edx, [esp + 0x308]
push edx
push 0x404170
push 0x404180
push 0x4041ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [0x834114]
cmp eax, 0xdf
jne 0x4a8d7e
push 0
push 0
push 0
call edi
xor eax, eax
lea edx, [esp + 0x38]
push edx
push eax
push eax
lea ecx, [esp + 0x130c]
push ecx
push eax
mov dword [esp + 0x44], eax
call ebp
lea edx, [esp + 0x3c]
push edx
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
push 0
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x34]
push eax
push 0
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
push 0x4041c8
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
push 0
push 0x40422c
push 0x404248
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
lea edx, [esp + 0xb04]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
lea eax, [esp + 0x1b00]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [0x834114]
dec dword [esp + 0x2c]
jne 0x4a8c50
mov edi, dword [sym.imp.USER32.dll_CharUpperA]
mov esi, 0x1ff896f4
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
dec esi
jne 0x4a8d93
mov byte [0x4b03d0], 0
call fcn.004a8300
call fcn.004a8690
mov eax, 0
add dword [0x4b5164], eax
push 0x4b03d0
mov dword [0x4b03d2], 0x33676d69
mov word [0x4b03d0], 0x736d
mov dword [0x4b03d8], 0x6c6c64
mov word [0x4b03d6], 0x2e32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x834114], 0xc30
jne 0x4a8ead
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0x1c0]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push esi
lea edx, [esp + 0x38]
push edx
push esi
lea eax, [esp + 0x30c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
push 0x4042a0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
lea ecx, [esp + 0x1304]
push ecx
push 0x4042b8
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [esp + 0x40]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push esi
lea eax, [esp + 0xb04]
push eax
push 0x404308
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea ecx, [esp + 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edx, dword [esp + 0x34]
push esi
push esi
push esi
push edx
call dword [sym.imp.KERNEL32.dll_GetTapeParameters]
mov ecx, dword [esp + 0x2334]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret