Function at 0x80ed20
Capabilities:
Copy file
Delete file
Get common file path
Get file attributes
Manipulate console buffer
Move file
Query environment variable
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x80fefc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, 0x2370
call fcn.004132c0
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [esp + 0xfc]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp esi, 0x2d19c
jge 0x80ed71
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call edi
cmp dword [0xb9b108], 0x6fb
jne 0x80ed89
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
cmp esi, 0x1e9afa0a
jle 0x80eda1
cmp ebx, 0xc10b3a
je 0x80eda1
cmp ebp, 0x9514f0c
jne 0x80edaa
inc esi
cmp esi, 0x83358
jl 0x80ed5f
cmp dword [0xb9b108], 0xcf8
jne 0x80ef51
push 0
call fcn.00407939
add esp, 4
xor ebp, ebp
push ebp
push ebp
call fcn.004077fd
add esp, 8
lea eax, [esp + 0x50]
push eax
call fcn.004057d0
fldz
sub esp, 0x10
fst qword [esp + 8]
fstp qword [esp]
call fcn.00407a00
fstp st(0)
push ebp
push ebp
call fcn.004078f9
push ebp
push ebp
call fcn.004078f9
push ebp
call fcn.00407a38
add esp, 0x24
push ebp
call fcn.00407b1e
add esp, 4
push ebp
push ebp
push ebp
push ebp
push ebp
call fcn.004074f8
mov edx, dword [esp + 0x64]
mov eax, dword [edx + 4]
lea ecx, [esp + 0xbc]
add esp, 0x14
mov dword [esp + 0x40], ecx
mov dword [esp + eax + 0x50], 0x4043c4
mov dword [esp + 0x23bc], ebp
test byte [esp + 0xa0], 1
lea ecx, [esp + 0x60]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x60], 0x404384
je 0x80ee64
mov edx, dword [esp + 0x70]
mov eax, dword [edx]
push eax
call fcn.00407a2d
add esp, 4
mov eax, dword [esp + 0x70]
mov dword [eax], ebp
mov ecx, dword [esp + 0x80]
mov dword [ecx], ebp
mov edx, dword [esp + 0x90]
mov dword [edx], ebp
mov eax, dword [esp + 0x74]
mov dword [eax], ebp
mov ecx, dword [esp + 0x84]
mov dword [ecx], ebp
mov edx, dword [esp + 0x94]
mov dword [edx], ebp
and dword [esp + 0xa0], 0xfffffffe
mov dword [esp + 0x9c], ebp
mov dword [esp + 0x60], 0x40433c
mov byte [esp + 0x23bc], 1
mov eax, dword [esp + 0x98]
mov ebx, eax
cmp eax, ebp
je 0x80ef0b
mov edi, dword [eax]
cmp edi, ebp
je 0x80ef02
push ebp
lea ecx, [esp + 0x40]
call fcn.00406c92
mov eax, dword [edi + 4]
cmp eax, ebp
jbe 0x80eee0
cmp eax, 0xffffffff
jae 0x80eee0
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x3c]
and esi, edi
call fcn.00406cba
cmp esi, ebp
je 0x80ef02
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
push ebx
call fcn.00407a2d
add esp, 4
lea ecx, [esp + 0x64]
mov byte [esp + 0x23bc], 0
call fcn.00406ceb
mov dword [esp + 0x23bc], 0xffffffff
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + 4]
lea edx, [esp + 0xa8]
mov dword [esp + ecx + 0x50], 0x40437c
push edx
mov dword [esp + 0xac], 0x40432c
call fcn.0040689e
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
xor esi, esi
cmp esi, 0x408
jne 0x80ef6c
mov eax, 0x5d1
add dword [0xb9b108], eax
cmp dword [0xb9b108], 3
jne 0x80ef83
push 0
push 0
lea eax, [esp + 0x388]
push eax
call edi
inc esi
cmp esi, 0x1518d4
jl 0x80ef59
mov ecx, dword [0xb9b108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0xb9a084], eax
mov eax, dword [0xb9b108]
xor esi, esi
test eax, eax
je 0x80efd9
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
call fcn.0080e8a0
cmp dword [0xb9b108], 0x29
jne 0x80efcf
push 0
push 0
lea edx, [esp + 0x388]
push edx
push 0
call edi
mov eax, dword [0xb9b108]
inc esi
cmp esi, eax
jb 0x80efb1
cmp eax, 0x70
jne 0x80f0ad
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push 0
push 0x404150
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [esp + 0x380]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
lea ecx, [esp + 0xb84]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommConfig]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
lea edx, [esp + 0x1384]
push edx
push 0
call dword [sym.imp.KERNEL32.dll__hread]
call dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
push 0
push 0
lea eax, [esp + 0x1b88]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov edi, dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
mov dword [esp + 0x3c], 0x9682ab
lea ecx, [ecx]
cmp dword [0xb9b108], 3
jne 0x80f0fd
push 0x404164
push 0
lea ecx, [esp + 0x1388]
push ecx
push 0x404170
push 0x404180
push 0x4041ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [0xb9b108], 0xdf
jne 0x80f20c
push 0
push 0
push 0
call edi
xor edx, edx
lea ecx, [esp + 0x48]
push ecx
push edx
push edx
lea eax, [esp + 0x1b8c]
push eax
push edx
mov dword [esp + 0x54], edx
call ebp
lea ecx, [esp + 0x4c]
push ecx
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
push 0
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x44]
push edx
push 0
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
push 0x4041c8
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
push 0
push 0x4041e0
push 0x4041f8
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
lea eax, [esp + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
push 0
push 0
lea ecx, [esp + 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
lea edx, [esp + 0xb84]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
lea eax, [esp + 0x1380]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec dword [esp + 0x3c]
jne 0x80f0d0
mov edi, dword [sym.imp.USER32.dll_CharUpperA]
mov esi, 0x1ff896f4
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
dec esi
jne 0x80f221
mov byte [0x8163d0], 0
call fcn.0080e7a0
call fcn.0080eb40
mov eax, 0
add dword [0xb9a084], eax
push 0x8163d0
mov dword [0x8163d2], 0x33676d69
mov word [0x8163d0], 0x736d
mov dword [0x8163d8], 0x6c6c64
mov word [0x8163d6], 0x2e32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0xb9b108], 0xc30
jne 0x80f345
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0x240]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push esi
lea edx, [esp + 0x48]
push edx
push esi
lea eax, [esp + 0x138c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
push 0x404250
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [esp + 0x1b84]
push ecx
push 0x404268
call esi
push 0
lea edx, [esp + 0xb84]
push edx
push 0x4042b8
call esi
push 0
lea eax, [esp + 0x384]
push eax
push 0x4042f8
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea ecx, [esp + 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edx, dword [esp + 0x44]
push 0
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_GetTapeParameters]
mov ecx, dword [esp + 0x23b4]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret