Function at 0x4a23b0
Capabilities:
Copy file
Delete file
Get common file path
Get disk information
Get file attributes
Manipulate console buffer
Query environment variable
Read pipe
Terminate process
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x3270
call fcn.0040d1b0
push ebx
mov ebx, dword [esp + 0x54]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [esp + 0x30]
xor esi, esi
cmp esi, 0x2cdc8
jge 0x4a23de
call ebp
cmp dword [0x82caac], 0x6fb
jne 0x4a23fc
push 0
lea eax, [esp + 0x684]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
cmp esi, 0x1e9afa1e
jle 0x4a2414
cmp edi, 0xc10c34
je 0x4a2414
cmp ebx, 0x952fd20
jne 0x4a241d
inc esi
cmp esi, 0x80c02
jl 0x4a23d4
cmp dword [0x82caac], 0xcf8
jne 0x4a24c2
fldz
sub esp, 8
fstp qword [esp]
call fcn.004052f0
fstp st(0)
fldz
fstp qword [esp]
call fcn.00404ef0
fstp st(0)
push 0x404884
push 0
call fcn.00405228
push 0
call fcn.00405149
add esp, 0x14
push 0
push 0
call fcn.0040500d
fldz
fstp qword [esp]
call fcn.00404ef0
fstp st(0)
push 0
call fcn.0040521d
add esp, 0xc
push 0
push 0
call fcn.00405109
push 0
push 0
call fcn.00405432
push 0x404890
push 0x404894
push 0x4a8d68
call fcn.00404e60
add esp, 0x1c
push 0
push 0
call fcn.00405109
push 0
push 0
call fcn.00405432
push 0
call fcn.0040540a
add esp, 0x14
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
xor esi, esi
cmp esi, 0x408
jne 0x4a24e3
mov eax, 0x5d1
add dword [0x82caac], eax
cmp dword [0x82caac], 3
jne 0x4a250f
xor ecx, ecx
lea eax, [esp + 0x30]
push eax
push ecx
push ecx
push 0x4048d0
push ecx
mov dword [esp + 0x48], ecx
call edi
push 0
push 0
lea edx, [esp + 0x688]
push edx
call ebx
inc esi
cmp esi, 0x1518d4
jl 0x4a24d0
mov eax, dword [0x82caac]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x4adafc], eax
mov eax, dword [0x82caac]
xor esi, esi
test eax, eax
je 0x4a2582
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov ebx, dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
cmp eax, 0xfe
jne 0x4a2553
push 0
call ebp
call fcn.004a1f40
mov eax, dword [0x82caac]
cmp eax, 0x29
jne 0x4a257d
push 0
push 0
lea ecx, [esp + 0xe88]
push ecx
push 0
call edi
push 0
push 0
call ebx
mov eax, dword [0x82caac]
inc esi
cmp esi, eax
jb 0x4a2548
cmp eax, 0x70
jne 0x4a26c5
push 0x40489c
call dword [sym.imp.KERNEL32.dll_FindAtomA]
mov esi, dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
push 0
call esi
push 0
push 0x404914
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea edx, [esp + 0x1a80]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0
lea eax, [esp + 0x2a84]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
lea ecx, [esp + 0xe84]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll__hread]
push 0
push 0x40491c
push 0x40493c
call dword [sym.imp.KERNEL32.dll_CopyFileW]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push 0x40495c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
push 0
push 0x4048ac
push 0x404974
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
push 0x404980
lea edx, [esp + 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x404a28
lea eax, [esp + 0x2284]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
push 0
push 0
lea ecx, [esp + 0x1288]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
push 0
push 0
call esi
xor eax, eax
lea edx, [esp + 0x54]
push edx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
lea eax, [esp + 0x34]
push eax
push 0
lea ecx, [esp + 0x68c]
push ecx
push 0
push 0
push 0
mov dword [esp + 0x70], 0
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov eax, dword [0x82caac]
mov edi, dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov dword [esp + 0x30], 0x9682ab
cmp eax, 0xdf
jne 0x4a2812
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
call ebp
xor edx, edx
lea ecx, [esp + 0x44]
push ecx
push edx
push edx
lea eax, [esp + 0x68c]
push eax
push edx
mov dword [esp + 0x48], edx
call ebx
lea ecx, [esp + 0x3c]
push ecx
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
lea edx, [esp + 0x88]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
push 0x4049cc
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x40]
push eax
push 0
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
push 0x4049fc
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
lea ecx, [esp + 0x38]
push ecx
push 0x404ac8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
lea edx, [esp + 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalCompact]
push 0
lea eax, [esp + 0x144]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0x30
lea ecx, [esp + 0x5c]
push 0
push ecx
mov dword [esp + 0x60], 0
call fcn.0040a6f0
add esp, 0xc
push 0
lea edx, [esp + 0x58]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
lea eax, [esp + 0x1280]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [0x82caac]
dec dword [esp + 0x30]
jne 0x4a26e5
mov edi, dword [sym.imp.USER32.dll_CharUpperA]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, 0x12dba7f4
lea ecx, [ecx]
push 0
call edi
push 0
call ebx
dec esi
jne 0x4a2830
mov byte [0x4a8d68], 0
call fcn.004a1e50
call fcn.004a21d0
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
jmp 0x4a2860
cmp dword [0x82caac], 0xba
jne 0x4a28a1
push 0
lea ecx, [esp + 0x684]
push ecx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x4c]
push ecx
push 0
lea edx, [esp + 0x158]
push edx
push 0x404ae4
call edi
push 0x404b14
push 0
push 0
call ebx
cmp esi, 0x2f64
jne 0x4a28b4
mov eax, 0
add dword [0x4adafc], eax
inc esi
cmp esi, 0x1605a
jl 0x4a2860
mov esi, dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownA]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpWriteData]
mov ebx, 0x1e6dcb
mov edi, edi
cmp dword [0x82caac], 0x85
jne 0x4a28ea
push 0
call esi
push 0
push 0
push 0
push 0
call edi
dec ebx
jne 0x4a28d0
mov eax, 0x73
mov ecx, 0x6d
mov word [0x82cab2], ax
mov word [0x82cab6], cx
xor ecx, ecx
mov edx, 0x33
mov eax, 0x67
mov word [0x82caba], dx
mov word [0x82cac6], cx
mov word [0x82cab8], ax
mov ecx, 0x69
mov edx, 0x6d
mov eax, 0x6c
push 0x82cab0
mov dword [0x82cac0], 0x6c0064
mov word [0x82cab4], cx
mov word [0x82cab0], dx
mov word [0x82cac4], ax
mov dword [0x82cabc], 0x2e0032
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp dword [0x82caac], 0xc30
jne 0x4a2a6c
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [esp + 0x540]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push ebx
lea ecx, [esp + 0x1284]
push ecx
push 0x404b50
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
call dword [sym.imp.KERNEL32.dll_AddRefActCtx]
push ebx
lea edx, [esp + 0x3c]
push edx
push ebx
lea eax, [esp + 0x68c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push ebx
lea ecx, [esp + 0x2284]
push ecx
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x44]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0x404bd0
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0x404c10
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea eax, [esp + 0x144]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VerLanguageNameA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push 0x404c68
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
lea ecx, [esp + 0x48]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
push ebx
lea edx, [esp + 0xe84]
push edx
push 0x404d08
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetTapeParameters]
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret