Function at 0x404e90
Capabilities:
Copy file
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4bc
mov eax, dword [0x4853bc]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
push eax
xor esi, esi
push 1
push str.c:endpcache_server_model.txt
mov ecx, 0x4df598
mov dword [0x57cd60], esi
mov dword [0x57cd70], esi
mov dword [0x57cd74], esi
mov dword [0x57cd78], esi
mov dword [0x57cd7c], esi
mov dword [ebp - 4], esi
call fcn.00479c3d
mov ecx, dword [0x4df598]
or ebx, 0xffffffff
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0x4df59c]
cmp dword [eax + 0x30], ebx
je 0x404fce
mov eax, dword [0x4df59c]
push 0xa
inc eax
push 0x40
mov dword [0x4df59c], eax
lea eax, [ebp - 0x80]
push eax
mov ecx, 0x4df598
call fcn.00479fff
lea edi, [ebp - 0x80]
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jle 0x404fce
lea ecx, [ebp - 0x80]
push str.close
push ecx
call fcn.0047fde0
add esp, 8
mov edi, 1
test eax, eax
jne 0x404f5e
mov dword [0x57d034], edi
lea edx, [ebp - 0x80]
push 0x491638
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x404f85
mov dword [0x57d034], edi
mov dword [0x57cc2c], edi
mov dword [0x57cc40], edi
lea eax, [ebp - 0x80]
push str.army
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x404fa5
mov dword [0x57cc34], edi
call fcn.0046d6c0
lea ecx, [ebp - 0x80]
push str.army_waterbox
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x404fce
mov eax, 1
mov dword [0x57cc34], eax
mov dword [0x57cc44], eax
call fcn.0046d6c0
mov ecx, 0x4df598
call fcn.00479c84
mov edx, dword [0x4853bc]
mov ecx, 0x4df598
push edx
push 1
push str.c:endpcache_special_gina_dll.txt
mov dword [0x57d038], 1
mov byte [0x5467ac], 0
call fcn.00479c3d
mov eax, dword [0x4df598]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + 0x4df59c]
cmp dword [eax + 0x30], ebx
je 0x40509e
mov edi, dword [0x4df59c]
push 0xa
lea edx, [ebp - 0x284]
inc edi
push 0x100
push edx
mov ecx, 0x4df598
mov dword [0x4df59c], edi
call fcn.00479fff
lea edi, [ebp - 0x284]
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
jle 0x405082
lea edi, [ebp - 0x284]
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x57cde4], 1
mov eax, ecx
mov esi, edi
mov edi, 0x5467ac
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
jmp 0x405094
mov ecx, dword [0x4df598]
mov edx, dword [ecx + 4]
test byte [edx + 0x4df5a0], 1
je 0x405018
mov ecx, 0x4df598
call fcn.00479c84
push esi
push str.c:endpcachelongtime_attack_event_old.txt
push str.c:endpcachelongtime_attack_event.txt
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [0x4853bc]
mov ecx, 0x4df598
push eax
push 1
push str.c:endpcacheloginAddress.txt
call fcn.00479c3d
mov ecx, dword [0x4df598]
mov byte [0x54ab8c], 0
mov byte [0x54e900], 0
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0x4df59c]
cmp dword [eax + 0x30], ebx
jne 0x405134
push str.cant_open_file
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov edi, 0x4915a4
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x54ab8c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
jmp 0x405157
mov edi, dword [0x4df59c]
push 0xa
inc edi
push 0x80
push 0x54ab8c
mov ecx, 0x4df598
mov dword [0x4df59c], edi
call fcn.00479fff
mov ecx, 0x4df598
call fcn.00479c84
mov ecx, dword [0x4853bc]
push ecx
push 1
push str.c:endpcachemcnAddress.txt
mov ecx, 0x4df598
call fcn.00479c3d
mov edx, dword [0x4df598]
mov eax, dword [edx + 4]
mov eax, dword [eax + 0x4df59c]
cmp dword [eax + 0x30], ebx
jne 0x4051d9
push str.cant_open_file
mov ecx, 0x65cd80
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
mov edi, 0x4915a4
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x54e900
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
jmp 0x4051fc
mov edi, dword [0x4df59c]
push 0xa
inc edi
push 0x80
push 0x54e900
mov ecx, 0x4df598
mov dword [0x4df59c], edi
call fcn.00479fff
mov ecx, 0x4df598
call fcn.00479c84
mov eax, dword [0x4853bc]
mov ecx, 0x4df598
push eax
push 1
push str.c:endpcachelocal_macaddress.txt
mov byte [ebp - 0x40], 0
call fcn.00479c3d
mov ecx, dword [0x4df598]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0x4df59c]
cmp dword [eax + 0x30], ebx
je 0x405252
mov eax, dword [0x4df59c]
push 0xa
inc eax
push 0x28
mov dword [0x4df59c], eax
lea eax, [ebp - 0x40]
push eax
mov ecx, 0x4df598
call fcn.00479fff
mov ecx, 0x4df598
call fcn.00479c84
lea edi, [ebp - 0x40]
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jle 0x405279
lea ecx, [ebp - 0x40]
push ecx
call fcn.00404520
add esp, 4
push esi
push 0x80
push 3
push esi
push esi
push 0xc0000000
push str..CCREGMONEX
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, ebx
mov dword [0x48bb78], eax
je 0x4052eb
push str.CreateFile___CCREGMONEX__successed._n
call fcn.0047a8c7
add esp, 4
mov eax, dword [0x48bb78]
lea edx, [ebp - 0x18]
push esi
push edx
push esi
push esi
push esi
push esi
push 0x83058008
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x40544b
push str.InitEx..Couldnt_access_device_driver..1_n
call fcn.0047a8c7
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateFile___Fail:_lx_n
call fcn.0047a8c7
add esp, 8
lea edx, [ebp - 0x184]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.CCREGMONEX.SYS
lea eax, [ebp - 0x184]
push 0x491524
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp + eax - 0x184]
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x184]
push edx
call fcn.0047b0b8
add esp, 0x10
lea eax, [ebp - 0x4c8]
lea ecx, [ebp - 0x184]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, ebx
jne 0x4053b4
lea edx, [ebp - 0x388]
lea eax, [ebp - 0x184]
push edx
push eax
push 0x104
push esi
push str.CCREGMONEX.SYS
push esi
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x4053bb
push str.CCREGMONEX.SYS
push str._s_was_not_found.
push 0x563924
call fcn.0047a8f8
push 0x563924
call fcn.0047b0b8
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0x184]
push 0x48bb78
push ecx
push str.CCREGMONEX
mov ecx, edi
call fcn.00405470
cmp eax, esi
jne 0x4052a9
lea edx, [ebp - 0x184]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x184]
push 0x48bb78
push eax
push str.CCREGMONEX
mov ecx, edi
call fcn.00405470
cmp eax, esi
jne 0x4052a9
push str.CCREGMONEX
mov ecx, edi
call fcn.00405780
lea ecx, [ebp - 0x184]
push 0x48bb78
push ecx
push str.CCREGMONEX
mov ecx, edi
call fcn.00405470
cmp eax, esi
jne 0x4052a9
push str.CCREGMONEX
push str.Error_loading__s
jmp 0x40538a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret