Function at 0x8084f0
Capabilities:
Copy file
Create pipe
Delete file
Get common file path
Get disk information
Get file attributes
Manipulate console buffer
Query environment variable
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x3130
call fcn.0040cef0
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [esp + 0x38]
xor esi, esi
cmp esi, 0x2cdc8
jge 0x80851e
call ebp
cmp dword [0xb92a8c], 0x6fb
jne 0x80853c
push 0
lea eax, [esp + 0x544]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
cmp esi, 0x1e9afa1e
jle 0x808554
cmp edi, 0xc10c34
je 0x808554
cmp ebx, 0x952fd20
jne 0x80855d
inc esi
cmp esi, 0x80c02
jl 0x808514
cmp dword [0xb92a8c], 0xcf8
jne 0x808607
fldz
sub esp, 8
fstp qword [esp]
call fcn.00405130
fstp st(0)
fldz
fstp qword [esp]
call fcn.00404d60
fstp st(0)
push 0x4047b0
push 0
call fcn.0040506e
push 0
push 0
call fcn.00404d20
push 0
push 0
call fcn.00404e7d
fldz
add esp, 0x18
fstp qword [esp]
call fcn.00404d60
fstp st(0)
push 0
call fcn.00405063
add esp, 0xc
push 0
push 0
call fcn.00404f79
push 0
push 0
call fcn.00405272
fld qword [0x404c28]
add esp, 8
fstp qword [esp]
push 0x4047bc
call fcn.0040506e
add esp, 0xc
push 0
call fcn.00404fb9
add esp, 4
push 0
push 0
call fcn.00405272
push 0
call fcn.0040524a
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
xor esi, esi
cmp esi, 0x408
jne 0x808628
mov eax, 0x5d1
add dword [0xb92a8c], eax
cmp dword [0xb92a8c], 3
jne 0x808654
xor ecx, ecx
lea eax, [esp + 0x38]
push eax
push ecx
push ecx
push 0x4047c4
push ecx
mov dword [esp + 0x50], ecx
call edi
push 0
push 0
lea edx, [esp + 0x148]
push edx
call ebx
inc esi
cmp esi, 0x1518d4
jl 0x808615
mov eax, dword [0xb92a8c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x813adc], eax
mov eax, dword [0xb92a8c]
xor esi, esi
test eax, eax
je 0x8086ca
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov ebx, dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
lea ecx, [ecx]
cmp eax, 0xfe
jne 0x80869b
push 0
call ebp
call fcn.008080c0
mov eax, dword [0xb92a8c]
cmp eax, 0x29
jne 0x8086c5
push 0
push 0
lea ecx, [esp + 0x148]
push ecx
push 0
call edi
push 0
push 0
call ebx
mov eax, dword [0xb92a8c]
inc esi
cmp esi, eax
jb 0x808690
cmp eax, 0x70
jne 0x80881f
push 0x4047e8
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x404800
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0
push 0x404814
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea edx, [esp + 0x140]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
lea eax, [esp + 0x2d44]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push 0
lea ecx, [esp + 0x1d44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll__hread]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 0x40482c
push 0x404868
call esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push 0
call dword [sym.imp.KERNEL32.dll_FatalExit]
mov esi, dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov dword [esp + 0x38], 0x9682ab
nop
cmp eax, 0xdf
jne 0x808971
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call edi
xor edx, edx
lea ecx, [esp + 0x4c]
push ecx
push edx
push edx
lea eax, [esp + 0x54c]
push eax
push edx
mov dword [esp + 0x50], edx
call ebp
lea ecx, [esp + 0x44]
push ecx
push 0
push 0
push 0
call ebx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
call dword [sym.imp.KERNEL32.dll_ZombifyActCtx]
push 0x404990
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x48]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
push 0x4049d8
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
lea eax, [esp + 0x40]
push eax
push 0x4049fc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFix]
push 0
lea edx, [esp + 0xd44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0x30
lea eax, [esp + 0x64]
push 0
push eax
mov dword [esp + 0x68], 0
call fcn.0040a200
add esp, 0xc
push 0
lea ecx, [esp + 0x60]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
lea edx, [esp + 0x1540]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [0xb92a8c]
dec dword [esp + 0x38]
jne 0x808840
mov edi, dword [sym.imp.USER32.dll_CharUpperW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, 0x12dba7f4
lea esp, [esp]
push 0
call edi
push 0
call ebx
dec esi
jne 0x808990
mov byte [0x80ed48], 0
call fcn.00807fd0
call fcn.00808330
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
jmp 0x8089c0
cmp dword [0xb92a8c], 0xba
jne 0x808a01
push 0
lea eax, [esp + 0x544]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x54]
push eax
push 0
lea ecx, [esp + 0x1558]
push ecx
push 0x404a10
call edi
push 0x404a4c
push 0
push 0
call ebx
cmp esi, 0x2f64
jne 0x808a14
mov eax, 0
add dword [0x813adc], eax
inc esi
cmp esi, 0x1605a
jl 0x8089c0
mov esi, dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownA]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov ebx, 0xf2b8b
mov edi, edi
cmp dword [0xb92a8c], 0x21
jne 0x808a47
push 0
call esi
push 0
push 0
push 0
push 0
call edi
dec ebx
jne 0x808a30
mov edx, 0x73
mov eax, 0x6d
mov word [0xb92a92], dx
mov word [0xb92a96], ax
xor eax, eax
mov ecx, 0x33
mov edx, 0x67
mov word [0xb92a9a], cx
mov word [0xb92aa6], ax
mov word [0xb92a98], dx
mov eax, 0x69
mov ecx, 0x6d
mov edx, 0x6c
push 0xb92a90
mov dword [0xb92aa0], 0x6c0064
mov word [0xb92a94], ax
mov word [0xb92a90], cx
mov word [0xb92aa4], dx
mov dword [0xb92a9c], 0x2e0032
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp dword [0xb92a8c], 0xc30
jne 0x808bc7
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea edx, [esp + 0x140]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push ebx
lea eax, [esp + 0xd44]
push eax
push 0x404a78
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
call dword [sym.imp.KERNEL32.dll_AddRefActCtx]
push ebx
lea ecx, [esp + 0x44]
push ecx
push ebx
lea edx, [esp + 0x54c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
push ebx
lea eax, [esp + 0x2544]
push eax
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x4c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0x404ac4
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0x404b04
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
lea edx, [esp + 0x1d44]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_VerLanguageNameW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push 0x404b80
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
lea eax, [esp + 0x50]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
push ebx
lea ecx, [esp + 0x1544]
push ecx
push 0x404b44
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [esp + 0x90]
push edx
call dword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret