Function at 0x424f84
Capabilities:
Accept command line arguments
Connect pipe
Copy file
Delete file
Get common file path
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2904
call fcn.0041b4a0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], ebx
call edi
cmp dword [0x47ae3c], 0x16
jne 0x424fcc
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push ebx
lea eax, [ebp - 0xd00]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
call edi
cmp dword [0x47ae3c], 0x9e
jne 0x42502e
push ebx
lea eax, [ebp - 0xd00]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
push ebx
lea eax, [ebp - 0x1500]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
lea eax, [ebp - 0x320]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push ebx
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push ebx
push ebx
call esi
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 4], 0x187276e
jg 0x425047
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x332beaf6
jl 0x424fa5
call fcn.00424e9b
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp - 4], ebx
cmp dword [0x47ae3c], 0x10
jne 0x425083
lea eax, [ebp - 8]
push eax
call edi
push ebx
push ebx
push ebx
push 0x4082fc
push 0x408300
push ebx
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
push 0x408310
call dword [sym.imp.KERNEL32.dll_AddAtomW]
cmp dword [ebp - 4], 0x1e673
jne 0x425096
add dword [0x461318], 0
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x3e79e
jl 0x425055
mov dword [ebp - 4], 0xdd9a7
cmp dword [0x47ae3c], 0xc01
jne 0x4250e3
push 0x408368
push 0x408370
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
dec dword [ebp - 4]
jne 0x4250a9
call fcn.00424d1d
push 0x455cc8
mov byte [0x455cc8], 0x6d
mov byte [0x455cc9], 0x73
mov byte [0x455cd2], 0x6c
mov byte [0x455cce], 0x32
mov byte [0x455cca], 0x69
mov byte [0x455ccd], 0x33
mov byte [0x455cd3], bl
mov byte [0x455ccc], 0x67
mov byte [0x455cd0], 0x64
mov byte [0x455ccb], 0x6d
mov byte [0x455cd1], 0x6c
mov byte [0x455ccf], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x47ae3c], 0x1144
jne 0x42522d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
push ebx
lea eax, [ebp - 0x500]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
lea eax, [ebp - 0x1d00]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x2100]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
lea eax, [ebp - 0x18]
push eax
call edi
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x1100]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
push ebx
lea eax, [ebp - 0x10]
push eax
call esi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea eax, [ebp - 0x2900]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
lea eax, [ebp - 0x900]
push eax
push 0x40839c
call dword [sym.imp.KERNEL32.dll_GetProfileSectionA]
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseActCtx]
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret