Function at 0x4806a7
Capabilities:
Copy file
Delete file
Enumerate files on windows
Get common file path
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b0476
mov eax, dword fs:[0]
push eax
mov eax, 0x167c
call fcn.005b9d80
mov eax, dword [0x8aa514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1684], ecx
mov esi, dword [ebp + 8]
xor eax, eax
mov ebx, dword [ebp + 0xc]
mov edi, eax
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x208
lea eax, [ebp - 0x5b0]
push edi
push eax
call fcn.007351d0
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x5b0]
push 0x8776c4
push eax
call esi
lea eax, [ebp - 0x5b0]
push 0x208
push eax
call fcn.004676a1
push 0x208
lea eax, [ebp - 0xbc8]
push edi
push eax
call fcn.007351d0
push 0x208
lea eax, [ebp - 0xfd8]
push edi
push eax
call fcn.007351d0
push 0x208
lea eax, [ebp - 0x7b8]
push edi
push eax
call fcn.007351d0
add esp, 0x44
lea eax, [ebp - 0x1a0]
push 0x190
push edi
push eax
call fcn.007351d0
lea eax, [ebp - 0xfd8]
push eax
call fcn.00467469
lea eax, [ebp - 0xfd8]
push eax
lea eax, [ebp - 0x7b8]
push str._s.lnk
push eax
call esi
add esp, 0x1c
lea eax, [ebp - 0x1680]
push eax
lea eax, [ebp - 0x7b8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x1688], eax
cmp eax, 0xffffffff
je 0x480aba
push ebx
lea ecx, [ebp - 0x1400]
call fcn.0045414f
mov eax, dword [ebp - 0x13f0]
lea ecx, [ebp - 0x1400]
xor ebx, ebx
mov dword [ebp - 4], ebx
test eax, eax
je 0x480ab2
add eax, 0xfffffffe
push eax
push 1
lea eax, [ebp - 0x1430]
push eax
call fcn.00480f4a
push eax
lea ecx, [ebp - 0x1400]
call fcn.0045786a
push ebx
push 1
lea ecx, [ebp - 0x1430]
call fcn.0045bf09
push 0x208
lea eax, [ebp - 0x9c0]
push ebx
push eax
call fcn.007351d0
cmp dword [ebp - 0x13ec], 8
lea eax, [ebp - 0x1400]
cmovae eax, dword [ebp - 0x1400]
push eax
lea eax, [ebp - 0x9c0]
push 0x8776c4
push eax
call esi
lea eax, [ebp - 0x9c0]
push 0x208
push eax
call fcn.004676a1
lea ecx, [ebp - 0x9c0]
add esp, 0x20
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x48085d
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x9c0]
push eax
call fcn.00748c5c
pop ecx
pop ecx
lea ecx, [ebp - 0x5b0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x480887
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x5b0]
push eax
call fcn.00748c5c
pop ecx
pop ecx
cmp dword [ebp - 0x1680], 0x10
je 0x480a83
mov edi, 0x208
lea eax, [ebp - 0xbc8]
push edi
push ebx
push eax
call fcn.007351d0
push edi
lea eax, [ebp - 0x7b8]
push ebx
push eax
call fcn.007351d0
push 0x190
lea eax, [ebp - 0x1a0]
push ebx
push eax
call fcn.007351d0
lea eax, [ebp - 0x1654]
push eax
lea eax, [ebp - 0xfd8]
push eax
lea eax, [ebp - 0x7b8]
push 0x7cb7d0
push eax
call esi
mov ecx, dword [ebp - 0x1684]
lea eax, [ebp - 0xbc8]
add esp, 0x34
push eax
lea eax, [ebp - 0x7b8]
push eax
call fcn.00480cba
mov edi, eax
lea eax, [ebp - 0xbc8]
push eax
lea eax, [ebp - 0x1a0]
push 0x8776c4
push eax
call esi
lea eax, [ebp - 0x1a0]
push 0x190
push eax
call fcn.00467731
lea ecx, [ebp - 0x1a0]
add esp, 0x14
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x480954
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1a0]
push eax
call fcn.00748c5c
pop ecx
pop ecx
lea eax, [ebp - 0x1a0]
push eax
lea ecx, [ebp - 0x1430]
call fcn.0045414f
lea eax, [ebp - 0x5b0]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x1418]
call fcn.0045414f
push dword [ebp - 0x1408]
cmp dword [ebp - 0x1404], 8
lea eax, [ebp - 0x1418]
push ebx
cmovae eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1430]
push eax
mov byte [ebp - 4], 2
call fcn.00480e8c
mov ebx, eax
test edi, edi
jne 0x4809d5
xor ebx, ebx
jmp 0x480a64
lea ecx, [ebp - 0x9c0]
lea eax, [ebp - 0x1a0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x480a09
test dx, dx
je 0x480a03
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x480a09
add eax, 4
add ecx, 4
test dx, dx
jne 0x4809e1
xor edi, edi
mov eax, edi
jmp 0x480a10
sbb eax, eax
or eax, 1
xor edi, edi
test eax, eax
je 0x480cb3
lea ecx, [ebp - 0x5b0]
lea eax, [ebp - 0x1a0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x480a4a
test dx, dx
je 0x480a46
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x480a4a
add eax, 4
add ecx, 4
test dx, dx
jne 0x480a24
mov eax, edi
jmp 0x480a4f
sbb eax, eax
or eax, 1
test eax, eax
je 0x480ae0
cmp ebx, 0xffffffff
jne 0x480ae0
xor ebx, ebx
mov edi, ebx
push ebx
push 1
lea ecx, [ebp - 0x1418]
call fcn.0045bf09
push ebx
push 1
lea ecx, [ebp - 0x1430]
mov byte [ebp - 4], bl
call fcn.0045bf09
lea eax, [ebp - 0x1680]
push eax
push dword [ebp - 0x1688]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4808a8
xor ebx, ebx
push dword [ebp - 0x1688]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x1400]
push ebx
push 1
call fcn.0045bf09
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b937d
mov esp, ebp
pop ebp
ret 0xc
mov edi, 0x208
lea eax, [ebp - 0x3a8]
push edi
xor ebx, ebx
push ebx
push eax
call fcn.007351d0
push edi
lea eax, [ebp - 0xdd0]
push ebx
push eax
call fcn.007351d0
cmp dword [ebp - 0x13ec], 8
lea eax, [ebp - 0x1400]
cmovae eax, dword [ebp - 0x1400]
push eax
lea eax, [ebp - 0xdd0]
push 0x8776c4
push eax
call esi
lea eax, [ebp - 0xdd0]
push edi
push eax
call fcn.00467578
lea eax, [ebp - 0xbc8]
push eax
lea eax, [ebp - 0x3a8]
push 0x8776c4
push eax
call esi
lea eax, [ebp - 0x3a8]
push eax
call fcn.004673ee
lea eax, [ebp - 0xdd0]
push eax
lea eax, [ebp - 0x3a8]
push eax
push 0x7cb7dc
push eax
call esi
add esp, 0x4c
lea eax, [ebp - 0x1400]
cmp dword [ebp - 0x13ec], 8
lea ecx, [ebp - 0x3a8]
cmovae eax, dword [ebp - 0x1400]
push 4
pop esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x480bae
test dx, dx
je 0x480baa
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x480bae
add ecx, esi
add eax, esi
test dx, dx
jne 0x480b8a
mov eax, ebx
jmp 0x480bb3
sbb eax, eax
or eax, 1
test eax, eax
je 0x480c76
push edi
lea eax, [ebp - 0x13e8]
push ebx
push eax
call fcn.007351d0
push edi
lea eax, [ebp - 0x11e0]
push ebx
push eax
call fcn.007351d0
add esp, 0x18
lea eax, [ebp - 0x11e0]
push ebx
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0xdd0]
push eax
lea eax, [ebp - 0x11e0]
push eax
lea eax, [ebp - 0x13e8]
push str._sytool_s
push eax
call fcn.004800e5
add esp, 0x10
lea ecx, [ebp - 0x13e8]
lea eax, [ebp - 0x3a8]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x480c3d
test dx, dx
je 0x480c39
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x480c3d
add eax, esi
add ecx, esi
test dx, dx
jne 0x480c19
mov eax, ebx
jmp 0x480c42
sbb eax, eax
or eax, 1
test eax, eax
je 0x480c76
lea eax, [ebp - 0x3a8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x13ec], 8
lea ecx, [ebp - 0x3a8]
push ebx
lea eax, [ebp - 0x1400]
cmovae eax, dword [ebp - 0x1400]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x1684]
lea eax, [ebp - 0x3a8]
push eax
lea eax, [ebp - 0x7b8]
push eax
call fcn.00480dcc
xor edi, edi
inc edi
push ebx
push 1
lea ecx, [ebp - 0x1418]
call fcn.0045bf09
push ebx
push 1
lea ecx, [ebp - 0x1430]
call fcn.0045bf09
jmp 0x480aa0
xor edi, edi
inc edi
xor ebx, ebx
jmp 0x480c92