Function at 0x4a2150
Capabilities:
Copy file
Delete file
Get common file path
Get disk information
Get file attributes
Manipulate console buffer
Query environment variable
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x2d70
call fcn.0040cf70
push ebx
mov ebx, dword [esp + 0x6c]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [esp + 0x48]
xor esi, esi
cmp esi, 0x2cdc8
jge 0x4a217e
call ebp
cmp dword [0x82ca8c], 0x6fb
jne 0x4a219c
push 0
lea eax, [esp + 0x984]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
cmp esi, 0x1e9afa1e
jle 0x4a21b4
cmp edi, 0xc10c34
je 0x4a21b4
cmp ebx, 0x952fd20
jne 0x4a21bd
inc esi
cmp esi, 0x80c02
jl 0x4a2174
cmp dword [0x82ca8c], 0xcf8
jne 0x4a2266
fldz
sub esp, 8
fstp qword [esp]
call fcn.00405120
fstp st(0)
fldz
fstp qword [esp]
call fcn.00404de0
fstp st(0)
push 0x40478c
push 0
call fcn.0040505a
push 0
push 0
call fcn.00404da0
push 0
push 0
call fcn.00404efd
fldz
add esp, 0x18
fstp qword [esp]
call fcn.00404de0
fstp st(0)
push 0
call fcn.0040504f
add esp, 0xc
push 0
push 0
call fcn.00404ff9
push 0
push 0
call fcn.00405262
fld qword [0x404ca8]
add esp, 8
fstp qword [esp]
push 0x404798
call fcn.0040505a
add esp, 0xc
push 0
push 0
call fcn.00404ff9
push 0
push 0
call fcn.00405262
push 0
call fcn.0040523a
add esp, 0x14
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
xor esi, esi
cmp esi, 0x408
jne 0x4a2287
mov eax, 0x5d1
add dword [0x82ca8c], eax
cmp dword [0x82ca8c], 3
jne 0x4a22b3
xor ecx, ecx
lea eax, [esp + 0x48]
push eax
push ecx
push ecx
push 0x4047a0
push ecx
mov dword [esp + 0x60], ecx
call edi
push 0
push 0
lea edx, [esp + 0x188]
push edx
call ebx
inc esi
cmp esi, 0x1518d4
jl 0x4a2274
mov eax, dword [0x82ca8c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x4adadc], eax
mov eax, dword [0x82ca8c]
xor esi, esi
test eax, eax
je 0x4a232a
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov ebx, dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
lea esp, [esp]
cmp eax, 0xfe
jne 0x4a22fb
push 0
call ebp
call fcn.004a1d40
mov eax, dword [0x82ca8c]
cmp eax, 0x29
jne 0x4a2325
push 0
push 0
lea ecx, [esp + 0x188]
push ecx
push 0
call edi
push 0
push 0
call ebx
mov eax, dword [0x82ca8c]
inc esi
cmp esi, eax
jb 0x4a22f0
mov esi, dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
cmp eax, 0x70
jne 0x4a247e
push 0x4047c4
call dword [sym.imp.KERNEL32.dll_FindAtomA]
xor ebx, ebx
push ebx
push ebx
call esi
push ebx
push 0x4047d4
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea edx, [esp + 0x180]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea eax, [esp + 0x2184]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push 0x30
lea ecx, [esp + 0xa4]
push ebx
push ecx
mov dword [esp + 0xa8], ebx
call fcn.0040a280
add esp, 0xc
push ebx
lea edx, [esp + 0xa0]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommConfig]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push ebx
lea eax, [esp + 0x2584]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll__hread]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
push 0x4047dc
push 0x4047fc
call edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push 0x40481c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
push ebx
push 0x404838
push 0x404880
call edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
push 0x404898
lea ecx, [esp + 0x1184]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x404918
lea edx, [esp + 0x1984]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
push ebx
push ebx
lea eax, [esp + 0x588]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
push ebx
push ebx
call esi
xor eax, eax
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
lea ecx, [esp + 0x6c]
push ecx
lea edx, [esp + 0x4c]
push edx
push ebx
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
lea eax, [esp + 0x98c]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov eax, dword [0x82ca8c]
mov edi, dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov dword [esp + 0x48], 0x9682ab
jmp 0x4a24a0
cmp eax, 0xdf
jne 0x4a25ef
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
call ebp
xor ecx, ecx
lea eax, [esp + 0x5c]
push eax
push ecx
push ecx
lea edx, [esp + 0x98c]
push edx
push ecx
mov dword [esp + 0x60], ecx
call ebx
lea eax, [esp + 0x54]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
lea ecx, [esp + 0x94]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
push 0x4048e4
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x58]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
push 0x4049b8
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
lea eax, [esp + 0x50]
push eax
push 0x4049e4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
push 0
lea ecx, [esp + 0x584]
push ecx
push 0x404a00
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
lea edx, [esp + 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFix]
push 0
lea eax, [esp + 0x1984]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
call esi
mov dword [esp + 0x9c], 0
push 0x30
lea ecx, [esp + 0xa4]
push 0
push ecx
call fcn.0040a280
add esp, 0xc
push 0
lea edx, [esp + 0xa0]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
lea eax, [esp + 0x1180]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [0x82ca8c]
dec dword [esp + 0x48]
jne 0x4a24a0
mov edi, dword [sym.imp.USER32.dll_CharUpperW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, 0x12dba7f4
lea ebx, [ebx]
push 0
call edi
push 0
call ebx
dec esi
jne 0x4a2610
mov byte [0x4a8d48], 0
call fcn.004a1c50
call fcn.004a1fa0
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
jmp 0x4a2640
cmp dword [0x82ca8c], 0xba
jne 0x4a2681
push 0
lea ecx, [esp + 0x984]
push ecx
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x64]
push ecx
push 0
lea edx, [esp + 0x598]
push edx
push 0x404a1c
call edi
push 0x404a4c
push 0
push 0
call ebx
cmp esi, 0x2f64
jne 0x4a2694
mov eax, 0
add dword [0x4adadc], eax
inc esi
cmp esi, 0x1605a
jl 0x4a2640
mov esi, dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownA]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpWriteData]
mov ebx, 0x1e6dcb
mov edi, edi
cmp dword [0x82ca8c], 0x85
jne 0x4a26ca
push 0
call esi
push 0
push 0
push 0
push 0
call edi
dec ebx
jne 0x4a26b0
mov eax, 0x73
mov ecx, 0x6d
mov word [0x82ca92], ax
mov word [0x82ca96], cx
xor ecx, ecx
mov edx, 0x33
mov eax, 0x67
mov word [0x82ca9a], dx
mov word [0x82caa6], cx
mov word [0x82ca98], ax
mov ecx, 0x69
mov edx, 0x6d
mov eax, 0x6c
push 0x82ca90
mov dword [0x82caa0], 0x6c0064
mov word [0x82ca94], cx
mov word [0x82ca90], dx
mov word [0x82caa4], ax
mov dword [0x82ca9c], 0x2e0032
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp dword [0x82ca8c], 0xc30
jne 0x4a284a
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea eax, [esp + 0x180]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push ebx
lea ecx, [esp + 0x1984]
push ecx
push 0x404a88
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
call dword [sym.imp.KERNEL32.dll_AddRefActCtx]
push ebx
lea edx, [esp + 0x54]
push edx
push ebx
lea eax, [esp + 0x98c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
push ebx
lea ecx, [esp + 0x1184]
push ecx
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x6c]
push ecx
lea edx, [esp + 0x5c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0x404b08
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0x404b48
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea eax, [esp + 0x2584]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VerLanguageNameW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push 0x404ba0
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
lea ecx, [esp + 0x60]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
push ebx
lea edx, [esp + 0x584]
push edx
push 0x404c40
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [esp + 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
mov ecx, dword [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret