Function at 0x45eef0
Capabilities:
Copy file
Delete file
Enumerate files on windows
Get common file path
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9c56
mov eax, dword fs:[0]
push eax
mov eax, 0x16a0
call fcn.004b8b20
mov eax, dword [0x537700]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x169c], ecx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x208
lea eax, [ebp - 0x5b0]
push 0
push eax
call fcn.004ba6a0
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x5b0]
push 0x4edbe4
push eax
call esi
lea eax, [ebp - 0x5b0]
push 0x208
push eax
call fcn.004561e0
push 0x208
lea eax, [ebp - 0xbc8]
push 0
push eax
call fcn.004ba6a0
push 0x208
lea eax, [ebp - 0xfd8]
push 0
push eax
call fcn.004ba6a0
push 0x208
lea eax, [ebp - 0x7b8]
push 0
push eax
call fcn.004ba6a0
add esp, 0x44
lea eax, [ebp - 0x1a0]
push 0x190
push 0
push eax
call fcn.004ba6a0
lea eax, [ebp - 0xfd8]
push eax
call fcn.00455f20
lea eax, [ebp - 0xfd8]
push eax
lea eax, [ebp - 0x7b8]
push str._s.lnk
push eax
call esi
add esp, 0x1c
lea eax, [ebp - 0x1680]
push eax
lea eax, [ebp - 0x7b8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x16a0], eax
cmp eax, 0xffffffff
je 0x45f094
mov ecx, edi
mov dword [ebp - 0x13f0], 0
xorps xmm0, xmm0
mov dword [ebp - 0x13ec], 0
movups xmmword [ebp - 0x1400], xmm0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45f027
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x1400]
call fcn.00406460
mov eax, dword [ebp - 0x13f0]
mov dword [ebp - 4], 0
test eax, eax
jne 0x45f0bb
mov ecx, dword [ebp - 0x13ec]
cmp ecx, 7
jbe 0x45f094
mov edx, dword [ebp - 0x1400]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x45f08a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f9de
push ecx
push edx
call fcn.004b812d
add esp, 8
xor esi, esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b847a
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 0x1408], 0
xorps xmm0, xmm0
mov dword [ebp - 0x1404], 0
lea ecx, [eax - 2]
movups xmmword [ebp - 0x1418], xmm0
cmp eax, 1
jb 0x45f9d4
dec eax
cmp eax, ecx
cmovb ecx, eax
cmp dword [ebp - 0x13ec], 7
lea eax, [ebp - 0x1400]
cmova eax, dword [ebp - 0x1400]
push ecx
add eax, 2
lea ecx, [ebp - 0x1418]
push eax
call fcn.00406460
mov ecx, dword [ebp - 0x13ec]
cmp ecx, 7
jbe 0x45f14f
mov edx, dword [ebp - 0x1400]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x45f145
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f9de
push ecx
push edx
call fcn.004b812d
add esp, 8
movups xmm0, xmmword [ebp - 0x1418]
push 0x208
lea eax, [ebp - 0x9c0]
movups xmmword [ebp - 0x1400], xmm0
push 0
movq xmm0, qword [ebp - 0x1408]
push eax
movq qword [ebp - 0x13f0], xmm0
call fcn.004ba6a0
cmp dword [ebp - 0x13ec], 7
lea ecx, [ebp - 0x1400]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x9c0]
cmova ecx, dword [ebp - 0x1418]
push ecx
push 0x4edbe4
push eax
call edi
lea eax, [ebp - 0x9c0]
push 0x208
push eax
call fcn.004561e0
lea ecx, [ebp - 0x9c0]
add esp, 0x20
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45f1c6
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x9c0]
push eax
call fcn.004cccfc
lea ecx, [ebp - 0x5b0]
add esp, 8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45f1f1
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x5b0]
push eax
call fcn.004cccfc
add esp, 8
xor esi, esi
nop word [eax + eax]
cmp dword [ebp - 0x1680], 0x10
je 0x45f688
push 0x208
lea eax, [ebp - 0xbc8]
push 0
push eax
call fcn.004ba6a0
push 0x208
lea eax, [ebp - 0x7b8]
push 0
push eax
call fcn.004ba6a0
push 0x190
lea eax, [ebp - 0x1a0]
push 0
push eax
call fcn.004ba6a0
lea eax, [ebp - 0x1654]
push eax
lea eax, [ebp - 0xfd8]
push eax
lea eax, [ebp - 0x7b8]
push str._s_s
push eax
call edi
mov ecx, dword [ebp - 0x169c]
lea eax, [ebp - 0xbc8]
add esp, 0x34
push eax
lea eax, [ebp - 0x7b8]
push eax
call fcn.0045ff10
mov dword [ebp - 0x1688], eax
lea eax, [ebp - 0xbc8]
push eax
lea eax, [ebp - 0x1a0]
push 0x4edbe4
push eax
call edi
lea eax, [ebp - 0x1a0]
push 0x190
push eax
call fcn.004562a0
lea ecx, [ebp - 0x1a0]
add esp, 0x14
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45f2d6
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1a0]
push eax
call fcn.004cccfc
xorps xmm0, xmm0
mov dword [ebp - 0x1420], 0
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 0x141c], 0
add esp, 8
lea edx, [ecx + 2]
movups xmmword [ebp - 0x1430], xmm0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45f320
sub ecx, edx
lea eax, [ebp - 0x1a0]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1430]
call fcn.00406460
xorps xmm0, xmm0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5b0]
mov dword [ebp - 0x1408], 0
movups xmmword [ebp - 0x1418], xmm0
mov dword [ebp - 0x1404], 0
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45f370
sub ecx, edx
lea eax, [ebp - 0x5b0]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1418]
call fcn.00406460
cmp dword [ebp - 0x1404], 7
lea ecx, [ebp - 0x1418]
mov edx, dword [ebp - 0x1418]
lea eax, [ebp - 0x1430]
mov edi, dword [ebp - 0x1430]
cmova ecx, edx
mov esi, dword [ebp - 0x1408]
seta byte [ebp - 0x1681]
cmp dword [ebp - 0x141c], 7
mov byte [ebp - 4], 2
cmova eax, edi
mov dword [ebp - 0x168c], edx
mov dword [ebp - 0x1694], eax
mov eax, dword [ebp - 0x1420]
mov dword [ebp - 0x1690], ecx
mov dword [ebp - 0x1698], edi
cmp esi, eax
ja 0x45f4c8
sub eax, esi
test esi, esi
jne 0x45f402
xor eax, eax
jmp 0x45f4cb
mov esi, dword [ebp - 0x1694]
inc eax
movzx edi, word [ecx]
mov dword [ebp - 0x16ac], edi
lea edx, [esi + eax*2]
mov eax, esi
mov dword [ebp - 0x16a4], edx
nop dword [eax]
sub edx, eax
mov esi, 0
sar edx, 1
je 0x45f44d
movzx ecx, word [eax]
cmp cx, di
je 0x45f445
cmp edx, 1
je 0x45f447
movzx ecx, word [eax + 2]
add eax, 2
dec edx
cmp cx, di
jne 0x45f433
mov esi, eax
mov ecx, dword [ebp - 0x1690]
mov eax, esi
test eax, eax
je 0x45f4bc
mov edi, dword [ebp - 0x1408]
mov esi, ecx
test edi, edi
je 0x45f4a6
mov ecx, eax
sub ecx, dword [ebp - 0x1690]
mov dword [ebp - 0x16a8], ecx
nop dword [eax]
movzx edx, word [esi + ecx]
movzx ecx, word [esi]
cmp dx, cx
jne 0x45f48c
add esi, 2
sub edi, 1
je 0x45f4a6
mov ecx, dword [ebp - 0x16a8]
jmp 0x45f470
mov edi, dword [ebp - 0x16ac]
add eax, 2
mov ecx, dword [ebp - 0x1690]
mov edx, dword [ebp - 0x16a4]
jmp 0x45f420
sub eax, dword [ebp - 0x1694]
mov edi, dword [ebp - 0x1698]
mov edx, dword [ebp - 0x168c]
sar eax, 1
jmp 0x45f4cb
mov edi, dword [ebp - 0x1698]
mov edx, dword [ebp - 0x168c]
or eax, 0xffffffff
mov esi, dword [ebp - 0x1688]
test esi, esi
jne 0x45f562
cmp byte [ebp - 0x1681], 0
mov byte [ebp - 4], 1
je 0x45f51b
mov ecx, dword [ebp - 0x1404]
mov eax, edx
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x45f511
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f9de
push ecx
push edx
call fcn.004b812d
add esp, 8
mov eax, dword [ebp - 0x141c]
mov byte [ebp - 4], 0
cmp eax, 7
jbe 0x45f682
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x45f553
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f9de
push ecx
push edi
call fcn.004b812d
add esp, 8
jmp 0x45f682
lea edx, [ebp - 0x9c0]
lea ecx, [ebp - 0x1a0]
nop
mov si, word [ecx]
cmp si, word [edx]
jne 0x45f596
test si, si
je 0x45f592
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x45f596
add ecx, 4
add edx, 4
test si, si
jne 0x45f570
xor ecx, ecx
jmp 0x45f59b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x45f8fd
lea edx, [ebp - 0x5b0]
lea ecx, [ebp - 0x1a0]
nop
mov si, word [ecx]
cmp si, word [edx]
jne 0x45f5d6
test si, si
je 0x45f5d2
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x45f5d6
add ecx, 4
add edx, 4
test si, si
jne 0x45f5b0
xor ecx, ecx
jmp 0x45f5db
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x45f6a8
cmp eax, 0xffffffff
jne 0x45f6a8
cmp byte [ebp - 0x1681], 0
mov dword [ebp - 0x1688], 0
mov byte [ebp - 4], 1
je 0x45f63e
mov ecx, dword [ebp - 0x1404]
mov edx, dword [ebp - 0x168c]
mov eax, edx
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x45f634
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f9de
push ecx
push edx
call fcn.004b812d
add esp, 8
mov eax, dword [ebp - 0x141c]
mov byte [ebp - 4], 0
cmp eax, 7
jbe 0x45f67c
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x45f672
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f9de
push ecx
push edi
call fcn.004b812d
add esp, 8
mov esi, dword [ebp - 0x1688]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x1680]
push eax
push dword [ebp - 0x16a0]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45f220
jmp 0x45f983
push 0x208
lea eax, [ebp - 0x3a8]
push 0
push eax
call fcn.004ba6a0
push 0x208
lea eax, [ebp - 0xdd0]
push 0
push eax
call fcn.004ba6a0
cmp dword [ebp - 0x13ec], 7
lea eax, [ebp - 0x1400]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
cmova eax, dword [ebp - 0x1400]
push eax
lea eax, [ebp - 0xdd0]
push 0x4edbe4
push eax
call esi
lea eax, [ebp - 0xdd0]
push 0x208
push eax
call fcn.00456050
lea eax, [ebp - 0xbc8]
push eax
lea eax, [ebp - 0x3a8]
push 0x4edbe4
push eax
call esi
lea eax, [ebp - 0x3a8]
push eax
call fcn.00455e90
lea eax, [ebp - 0xdd0]
push eax
lea eax, [ebp - 0x3a8]
push eax
push 0x4f55c8
push eax
call esi
add esp, 0x4c
lea eax, [ebp - 0x1400]
cmp dword [ebp - 0x13ec], 7
lea ecx, [ebp - 0x3a8]
cmova eax, dword [ebp - 0x1400]
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x45f786
test dx, dx
je 0x45f782
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x45f786
add ecx, 4
add eax, 4
test dx, dx
jne 0x45f760
xor eax, eax
jmp 0x45f78b
sbb eax, eax
or eax, 1
test eax, eax
je 0x45f860
push 0x208
lea eax, [ebp - 0x13e8]
push 0
push eax
call fcn.004ba6a0
push 0x208
lea eax, [ebp - 0x11e0]
push 0
push eax
call fcn.004ba6a0
add esp, 0x18
lea eax, [ebp - 0x11e0]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0xdd0]
push eax
lea eax, [ebp - 0x11e0]
push eax
lea eax, [ebp - 0x13e8]
push str._sytool_s
push eax
call fcn.0045e240
add esp, 0x10
lea ecx, [ebp - 0x13e8]
lea eax, [ebp - 0x3a8]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x45f826
test dx, dx
je 0x45f822
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x45f826
add eax, 4
add ecx, 4
test dx, dx
jne 0x45f800
xor eax, eax
jmp 0x45f82b
sbb eax, eax
or eax, 1
test eax, eax
je 0x45f860
lea eax, [ebp - 0x3a8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x13ec], 7
lea ecx, [ebp - 0x3a8]
push 0
lea eax, [ebp - 0x1400]
cmova eax, dword [ebp - 0x1400]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x169c]
lea eax, [ebp - 0x3a8]
push eax
lea eax, [ebp - 0x7b8]
push eax
call fcn.00460050
mov ecx, dword [ebp - 0x1404]
mov dword [ebp - 0x1688], 1
cmp ecx, 7
jbe 0x45f8c3
mov edx, dword [ebp - 0x168c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x45f8b9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f9d9
push ecx
push edx
call fcn.004b812d
add esp, 8
mov eax, dword [ebp - 0x141c]
cmp eax, 7
jbe 0x45f97d
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x45f973
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f9d9
jmp 0x45f973
mov ecx, dword [ebp - 0x1404]
mov dword [ebp - 0x1688], 1
cmp ecx, 7
jbe 0x45f947
mov edx, dword [ebp - 0x168c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x45f93d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f9de
push ecx
push edx
call fcn.004b812d
add esp, 8
mov eax, dword [ebp - 0x141c]
cmp eax, 7
jbe 0x45f97d
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x45f973
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f9de
push ecx
push edi
call fcn.004b812d
add esp, 8
mov esi, dword [ebp - 0x1688]
push dword [ebp - 0x16a0]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x13ec]
cmp ecx, 7
jbe 0x45f096
mov edx, dword [ebp - 0x1400]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x45f9c5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45f9de
push ecx
push edx
call fcn.004b812d
add esp, 8
jmp 0x45f096
call fcn.004046d0
call fcn.004be0cf
call fcn.004be0cf
int3