Function at 0x42aea6
Capabilities:
Accept command line arguments
Connect pipe
Copy file
Delete file
Get common file path
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2a1c
call fcn.00419190
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
xor ebx, ebx
xor edi, edi
call esi
cmp dword [0x468a2c], 0x16
jne 0x42aee7
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push ebx
lea eax, [ebp - 0xa18]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
call esi
cmp dword [0x468a2c], 0x9e
jne 0x42af4d
push ebx
lea eax, [ebp - 0xa18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
push ebx
lea eax, [ebp - 0xe18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
push ebx
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp edi, 0x187276e
jg 0x42af62
inc edi
cmp edi, 0x332beaf6
jl 0x42aec0
call fcn.0042adbc
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
xor edi, edi
cmp dword [0x468a2c], 0x10
jne 0x42af9a
push ebx
call esi
push ebx
push ebx
push ebx
push 0x4086c4
push 0x4086c8
push ebx
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
push 0x4086d8
call dword [sym.imp.KERNEL32.dll_AddAtomW]
cmp edi, 0x1e673
jne 0x42afac
add dword [0x44ef08], 0x1684
inc edi
cmp edi, 0x3e79e
jl 0x42af6f
mov edi, 0xdd9a7
cmp dword [0x468a2c], 0xc01
jne 0x42aff4
push 0x408730
push 0x408740
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
dec edi
jne 0x42afba
call fcn.0042ad67
push 0x4438b8
mov byte [0x4438b8], 0x6d
mov byte [0x4438b9], 0x73
mov byte [0x4438c2], 0x6c
mov byte [0x4438be], 0x32
mov byte [0x4438ba], 0x69
mov byte [0x4438bd], 0x33
mov byte [0x4438c3], bl
mov byte [0x4438bc], 0x67
mov byte [0x4438c0], 0x64
mov byte [0x4438bb], 0x6d
mov byte [0x4438c1], 0x6c
mov byte [0x4438bf], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x468a2c], 0x1144
jne 0x42b141
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
push ebx
lea eax, [ebp - 0xe18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
lea eax, [ebp - 0x1618]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x408794
push 0x4087c0
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x1e18]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
push ebx
call esi
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x2218]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
push ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea eax, [ebp - 0xc]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea eax, [ebp - 0x2a18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
lea eax, [ebp - 0x618]
push eax
push 0x4087dc
call dword [sym.imp.KERNEL32.dll_GetProfileSectionA]
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseActCtx]
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret