Function at 0x100048e0
Capabilities:
Copy file
Create directory
Create pipe
Get common file path
Get file size
Get geographical location
Get uefi variable
Manipulate console buffer
Move file
Read .ini file
Read pipe
Set current directory
Terminate process
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0xc
call fcn.10020185
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10004906
mov ecx, dword [ebp - 0xc]
call fcn.100087a0
mov dword [ebp - 0x10], eax
jmp 0x1000490d
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [0x10062ed4], eax
mov ecx, dword [0x10062ecc]
xor edx, edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x34], 0x845fe16f
jne 0x10004a5a
cmp dword [ebp - 0x30], 0
jne 0x10004a5a
push 0
push 0
push 0x10069d54
push 0
push 0x10069d80
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeaps]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RtlUnwind]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0
call dword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryTransactedW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push 0
push 0
push 3
push 0
push 7
push 0x80000000
push 0x10069da8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x10004c29
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMaskEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov dword [ebp - 4], 0
jmp 0x10004c3b
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 4
jge 0x10004f17
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x1005cef4]
mov dword [ebp - 8], eax
cmp dword [0x10062ecc], 0x40a7a41e
jne 0x10004de8
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
push 0
call dword [sym.imp.KERNEL32.dll_InitOnceInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameTransactedW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetAppContainerNamedObjectPath]
push 0
push 0x10069e00
push 0
call dword [sym.imp.KERNEL32.dll_IsValidNLSVersion]
push 0
push 0x10069e38
push 0
call dword [sym.imp.KERNEL32.dll_IsValidNLSVersion]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpool]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReclaimVirtualMemory]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetAppContainerNamedObjectPath]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumberEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
push 0
call dword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteTapemark]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDevicePowerState]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], ecx
push 0
mov edx, dword [ebp - 0x20]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
push 0
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileBandwidthReservation]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileBandwidthReservation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
push 0
call dword [sym.imp.KERNEL32.dll_WakeConditionVariable]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov eax, dword [ebp - 8]
add eax, dword [0x10062ee8]
mov dword [ebp - 8], eax
mov ecx, dword [0x10062ecc]
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x3c], 0x957bccc9
jne 0x10004f03
cmp dword [ebp - 0x38], 0
jne 0x10004f03
push 0
push 0
push 0
push 0
push 0x10069e70
call dword [sym.imp.KERNEL32.dll_FindFirstStreamTransactedW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreExW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetAtomNameW]
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSize]
push 0
call dword [sym.imp.KERNEL32.dll_QueryUnbiasedInterruptTime]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolIo]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push 0
call dword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
push 0x10069eac
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadDescription]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
xor ecx, ecx
lock xadd dword [ecx], eax
push 0
call dword [sym.imp.KERNEL32.dll_FatalExit]
lea edx, [ebp - 8]
push edx
mov ecx, dword [0x10062ed4]
call fcn.10008760
jmp 0x10004c32
mov esp, ebp
pop ebp
ret