Function at 0x424920
Capabilities:
Accept command line arguments
Copy file
Create pipe
Delete file
Get common file path
Get disk information
Get file attributes
Get geographical location
Manipulate console buffer
Query environment variable
Receive http response
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x2cb0
call fcn.0040f040
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x9c]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
xor esi, esi
cmp esi, 0x2cdc8
jge 0x424955
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x7aebcc], 0x6fb
jne 0x424971
push 0
push 0
lea eax, [esp + 0xcc8]
push eax
push 0
call edi
cmp esi, 0x1e9afa1e
jle 0x424989
cmp ebx, 0xc10c34
je 0x424989
cmp ebp, 0x952fd20
jne 0x424992
inc esi
cmp esi, 0x992a2
jl 0x424947
cmp dword [0x7aebcc], 0xcf8
jne 0x424a6c
fldz
sub esp, 8
fstp qword [esp]
call fcn.004052a0
fstp st(0)
fldz
fstp qword [esp]
call fcn.00404e00
fstp st(0)
push 0
push 0
push 0
push 0x42ae88
call fcn.0040516a
push 0
call fcn.004051a8
add esp, 0x1c
push 0
push 0
call fcn.00404f1d
fldz
fstp qword [esp]
call fcn.00404e00
fstp st(0)
push 0
call fcn.0040519d
add esp, 0xc
push 0
push 0
call fcn.00405019
push 0
push 0
call fcn.0040540e
push 0x404664
push 0x4046cc
push 0x42ae88
call fcn.00404b80
fld qword [0x404a88]
add esp, 0x14
fstp qword [esp]
push 0x4046d4
call fcn.004051d8
add esp, 0xc
push 0
call fcn.00405059
add esp, 4
push 0
push 0
call fcn.0040540e
push 0
call fcn.004053e6
add esp, 0xc
push 0
call fcn.00405528
add esp, 4
push 0
push 0
push 0
push 0
call fcn.00404de0
add esp, 0x10
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
xor esi, esi
cmp esi, 0x408
jne 0x424a87
mov eax, 0x5d1
add dword [0x7aebcc], eax
cmp dword [0x7aebcc], 3
jne 0x424ab7
xor ecx, ecx
lea eax, [esp + 0x48]
push eax
push ecx
push ecx
push 0x4046dc
push ecx
mov dword [esp + 0x58], ecx
call edi
push 0
push 0
lea edx, [esp + 0xc8]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
inc esi
cmp esi, 0x1518d4
jl 0x424a74
mov eax, dword [0x7aebcc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x42fc1c], eax
mov eax, dword [0x7aebcc]
xor esi, esi
test eax, eax
je 0x424b2a
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov ebx, dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
cmp eax, 0xfe
jne 0x424afb
push 0
call ebp
call fcn.004244d0
mov eax, dword [0x7aebcc]
cmp eax, 0x29
jne 0x424b25
push 0
push 0
lea ecx, [esp + 0xc8]
push ecx
push 0
call edi
push 0
push 0
call ebx
mov eax, dword [0x7aebcc]
inc esi
cmp esi, eax
jb 0x424af0
cmp eax, 0x70
jne 0x424c5d
push 0x4046ec
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x404724
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0
push 0x404744
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
lea edx, [esp + 0xc0]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
lea eax, [esp + 0x14c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push 0
lea ecx, [esp + 0x8c4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll__hread]
push 0
push 0x404774
push 0x4047b4
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push 0
call dword [sym.imp.KERNEL32.dll_FatalExit]
mov esi, dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov ebx, dword [sym.imp.KERNEL32.dll_CommConfigDialogA]
mov dword [esp + 0x48], 0x9682ab
lea ecx, [ecx]
cmp eax, 0xdf
jne 0x424dc0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call edi
xor eax, eax
lea edx, [esp + 0x50]
push edx
push eax
push eax
lea ecx, [esp + 0xccc]
push ecx
push eax
mov dword [esp + 0x58], eax
call ebp
push 0
push 0
push 0
call ebx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
call dword [sym.imp.KERNEL32.dll_ZombifyActCtx]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x54]
push edx
push 0
lea eax, [esp + 0xa0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
push 0x4049c0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
lea ecx, [esp + 0x4c]
push ecx
push 0x4049e0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
push 0
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
lea eax, [esp + 0x4c4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
push 0x4049fc
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0x30
mov dword [esp + 0x68], 0
push 0
lea ecx, [esp + 0x70]
push ecx
call fcn.004075b0
add esp, 0xc
push 0
lea edx, [esp + 0x68]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
lea eax, [esp + 0x8c0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [0x7aebcc]
dec dword [esp + 0x48]
jne 0x424c80
mov edi, dword [sym.imp.USER32.dll_CharUpperW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, 0x12dba7f4
jmp 0x424de0
push 0
call edi
push 0
call ebx
dec esi
jne 0x424de0
mov byte [0x42ae88], 0
call fcn.004243e0
call fcn.00424760
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
jmp 0x424e10
cmp dword [0x7aebcc], 0xba
jne 0x424e34
lea ecx, [esp + 0x4c]
push ecx
push 0
push 0
push 0
call edi
push 0x404a0c
push 0
push 0
call ebx
cmp esi, 0x2f64
jne 0x424e47
mov eax, 0x4f70
add dword [0x42fc1c], eax
inc esi
cmp esi, 0x1605a
jl 0x424e10
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov edi, 0xf2b8b
jmp 0x424e60
cmp dword [0x7aebcc], 0x21
jne 0x424e73
push 0
push 0
push 0
push 0
call esi
dec edi
jne 0x424e60
mov edx, 0x73
mov eax, 0x6d
mov word [0x7aebd2], dx
mov word [0x7aebd6], ax
xor eax, eax
mov ecx, 0x33
mov edx, 0x67
mov word [0x7aebda], cx
mov word [0x7aebe6], ax
mov word [0x7aebd8], dx
mov eax, 0x69
mov ecx, 0x6d
mov edx, 0x6c
push 0x7aebd0
mov dword [0x7aebe0], 0x6c0064
mov word [0x7aebd4], ax
mov word [0x7aebd0], cx
mov word [0x7aebe4], dx
mov dword [0x7aebdc], 0x2e0032
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp dword [0x7aebcc], 0xc30
jne 0x424fb9
mov edx, dword [esp + 0x4c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea eax, [esp + 0xc0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push edi
lea ecx, [esp + 0xcc4]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
call dword [sym.imp.KERNEL32.dll_AddRefActCtx]
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
push edi
lea edx, [esp + 0x50]
push edx
push edi
lea eax, [esp + 0x4cc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
push 0x404a3c
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0x404a54
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
lea ecx, [esp + 0x8c4]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_VerLanguageNameA]
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov edx, dword [esp + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret