Function at 0x4292e0
Capabilities:
Copy file
Delete file
Get common file path
Get file attributes
Manipulate console buffer
Move file
Query environment variable
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x42a4bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, 0x2370
call fcn.004132d0
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [esp + 0xfc]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp esi, 0x2d19c
jge 0x429331
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call edi
cmp dword [0x7b5108], 0x6fb
jne 0x429349
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
cmp esi, 0x1e9afa0a
jle 0x429361
cmp ebx, 0xc10b3a
je 0x429361
cmp ebp, 0x9514f0c
jne 0x42936a
inc esi
cmp esi, 0x83358
jl 0x42931f
cmp dword [0x7b5108], 0xcf8
jne 0x429511
push 0
call fcn.00407949
add esp, 4
xor ebp, ebp
push ebp
push ebp
call fcn.0040780d
add esp, 8
lea eax, [esp + 0x50]
push eax
call fcn.004057e0
fldz
sub esp, 0x10
fst qword [esp + 8]
fstp qword [esp]
call fcn.00407a10
fstp st(0)
push ebp
push ebp
call fcn.00407909
push ebp
push ebp
call fcn.00407909
push ebp
call fcn.00407a48
add esp, 0x24
push ebp
call fcn.00407b2e
add esp, 4
push ebp
push ebp
push ebp
push ebp
push ebp
call fcn.00407508
mov edx, dword [esp + 0x64]
mov eax, dword [edx + 4]
lea ecx, [esp + 0xbc]
add esp, 0x14
mov dword [esp + 0x40], ecx
mov dword [esp + eax + 0x50], 0x4043c4
mov dword [esp + 0x23bc], ebp
test byte [esp + 0xa0], 1
lea ecx, [esp + 0x60]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x60], 0x404384
je 0x429424
mov edx, dword [esp + 0x70]
mov eax, dword [edx]
push eax
call fcn.00407a3d
add esp, 4
mov eax, dword [esp + 0x70]
mov dword [eax], ebp
mov ecx, dword [esp + 0x80]
mov dword [ecx], ebp
mov edx, dword [esp + 0x90]
mov dword [edx], ebp
mov eax, dword [esp + 0x74]
mov dword [eax], ebp
mov ecx, dword [esp + 0x84]
mov dword [ecx], ebp
mov edx, dword [esp + 0x94]
mov dword [edx], ebp
and dword [esp + 0xa0], 0xfffffffe
mov dword [esp + 0x9c], ebp
mov dword [esp + 0x60], 0x40433c
mov byte [esp + 0x23bc], 1
mov eax, dword [esp + 0x98]
mov ebx, eax
cmp eax, ebp
je 0x4294cb
mov edi, dword [eax]
cmp edi, ebp
je 0x4294c2
push ebp
lea ecx, [esp + 0x40]
call fcn.00406ca2
mov eax, dword [edi + 4]
cmp eax, ebp
jbe 0x4294a0
cmp eax, 0xffffffff
jae 0x4294a0
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x3c]
and esi, edi
call fcn.00406cca
cmp esi, ebp
je 0x4294c2
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
push ebx
call fcn.00407a3d
add esp, 4
lea ecx, [esp + 0x64]
mov byte [esp + 0x23bc], 0
call fcn.00406cfb
mov dword [esp + 0x23bc], 0xffffffff
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + 4]
lea edx, [esp + 0xa8]
mov dword [esp + ecx + 0x50], 0x40437c
push edx
mov dword [esp + 0xac], 0x40432c
call fcn.004068ae
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
xor esi, esi
cmp esi, 0x408
jne 0x42952c
mov eax, 0x5d1
add dword [0x7b5108], eax
cmp dword [0x7b5108], 3
jne 0x429543
push 0
push 0
lea eax, [esp + 0x388]
push eax
call edi
inc esi
cmp esi, 0x1518d4
jl 0x429519
mov ecx, dword [0x7b5108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x7b4084], eax
mov eax, dword [0x7b5108]
xor esi, esi
test eax, eax
je 0x429599
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
call fcn.00428e60
cmp dword [0x7b5108], 0x29
jne 0x42958f
push 0
push 0
lea edx, [esp + 0x388]
push edx
push 0
call edi
mov eax, dword [0x7b5108]
inc esi
cmp esi, eax
jb 0x429571
cmp eax, 0x70
jne 0x42966d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push 0
push 0x404150
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [esp + 0x380]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
lea ecx, [esp + 0xb84]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommConfig]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
lea edx, [esp + 0x1384]
push edx
push 0
call dword [sym.imp.KERNEL32.dll__hread]
call dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
push 0
push 0
lea eax, [esp + 0x1b88]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov edi, dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
mov dword [esp + 0x3c], 0x9682ab
lea ecx, [ecx]
cmp dword [0x7b5108], 3
jne 0x4296bd
push 0x404164
push 0
lea ecx, [esp + 0x1388]
push ecx
push 0x404170
push 0x404180
push 0x4041ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [0x7b5108], 0xdf
jne 0x4297cc
push 0
push 0
push 0
call edi
xor edx, edx
lea ecx, [esp + 0x48]
push ecx
push edx
push edx
lea eax, [esp + 0x1b8c]
push eax
push edx
mov dword [esp + 0x54], edx
call ebp
lea ecx, [esp + 0x4c]
push ecx
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
push 0
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x44]
push edx
push 0
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
push 0x4041c8
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
push 0
push 0x4041e0
push 0x4041f8
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
lea eax, [esp + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
push 0
push 0
lea ecx, [esp + 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
lea edx, [esp + 0xb84]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
lea eax, [esp + 0x1380]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec dword [esp + 0x3c]
jne 0x429690
mov edi, dword [sym.imp.USER32.dll_CharUpperA]
mov esi, 0x1ff896f4
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
dec esi
jne 0x4297e1
mov byte [0x4303d0], 0
call fcn.00428d60
call fcn.00429100
mov eax, 0x494f
add dword [0x7b4084], eax
push 0x4303d0
mov dword [0x4303d2], 0x33676d69
mov word [0x4303d0], 0x736d
mov dword [0x4303d8], 0x6c6c64
mov word [0x4303d6], 0x2e32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x7b5108], 0xc30
jne 0x429905
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0x240]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push esi
lea edx, [esp + 0x48]
push edx
push esi
lea eax, [esp + 0x138c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
push 0x404250
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [esp + 0x1b84]
push ecx
push 0x404268
call esi
push 0
lea edx, [esp + 0xb84]
push edx
push 0x4042b8
call esi
push 0
lea eax, [esp + 0x384]
push eax
push 0x4042f8
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea ecx, [esp + 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edx, dword [esp + 0x44]
push 0
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_GetTapeParameters]
mov ecx, dword [esp + 0x23b4]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret