Function at 0x4c5170
Capabilities:
Copy file
Delete registry value
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc453
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x358
push ebx
push esi
push edi
lea eax, [ebp - 0x264]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x80
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x264]
lea edx, [ebp - 0x364]
push ecx
push str._sSystem32msgina.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x264]
push str.Program_FilesInternet_ExplorerIEXPLORE.EXE
push eax
lea ecx, [ebp - 0x2e4]
push str._s_s
push ecx
mov byte [ebp - 0x262], bl
call fcn.004f175f
add esp, 0x1c
lea ecx, [ebp - 0x5c]
push 1
call fcn.004f0653
push 1
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 1
call fcn.004f0653
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0x5c]
push edx
push 1
push str.c:endpcache_acl_model.txt
mov byte [ebp - 4], 2
xor esi, esi
call fcn.004f0727
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0x58]
cmp dword [eax + 0x30], 0xffffffff
je 0x4c57c3
mov edi, dword [ebp - 0x58]
push 0xa
lea edx, [ebp - 0x1e4]
inc edi
push 0x40
push edx
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x58], edi
call fcn.004f0ae9
lea edi, [ebp - 0x1e4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jge 0x4c5348
call fcn.004c9560
push str.c:endpcacheNewlSP.dll
call fcn.004a9350
add esp, 4
push str.c:endpcacheLINK.EXE
call fcn.004a9350
add esp, 4
push str.c:endpcacheDUMPBIN.EXE
call fcn.004a9350
add esp, 4
push str.c:endpcachemspdb60.dll
call fcn.004a9350
add esp, 4
push str.c:endpcache_sigcheck.exe
call fcn.004a9350
add esp, 4
push str.c:endpcache_fileM.sys
call fcn.004a9350
add esp, 4
push str.c:endpcache_regsys.sys
call fcn.004a9350
add esp, 4
push str.c:endpcacheccProcMon.sys
call fcn.004a9350
add esp, 4
push str.c:endpcacheccFILEMon.SYS
call fcn.004a9350
add esp, 4
push str.c:endpcacheccRegMon.SYS
call fcn.004a9350
add esp, 4
push str.c:endpcacheccRegmonEx.sys
call fcn.004a9350
add esp, 4
push str.c:endpcacheproc_bin2.exe
call fcn.004a9350
add esp, 4
push str.c:endpcacheproc_bin1.exe
call fcn.004a9350
add esp, 4
push str.c:endpcacheproc_bin3.exe
call fcn.004a9350
add esp, 4
push str.c:endpcache_tlist.exe
call fcn.004a9350
add esp, 4
lea eax, [ebp - 0x2e4]
push eax
call fcn.004a9350
add esp, 4
call fcn.004c6be0
mov esi, 1
lea ecx, [ebp - 0x1e4]
push str.20091216
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4c57e7
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
push str.c:endpcache_ntldr
push str.c:_ntldr
call esi
push ebx
push str.c:endpcacheNTDETECT.COM
push str.c:NTDETECT.COM
call esi
cmp dword [0xf3f470], 1
jne 0x4c5394
call fcn.004c9c40
jmp 0x4c5399
call fcn.004c9b00
push ebx
lea edx, [ebp - 0x364]
push str.c:endpcachemsgina.dll
push edx
call esi
push str.AudioSrv
mov dword [ebp - 0x14], ebx
call fcn.004fa6c0
push eax
lea eax, [ebp - 0x1a4]
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x10
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x1a4]
push ecx
push 0xf003f
push ebx
push edx
push closesocket
call esi
test eax, eax
jne 0x4c53f9
push str.regedit.exe__e_c:endpcacheAudioSrv.reg_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesAudioSrv
call fcn.004f2ce2
add esp, 4
mov eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
push str.Browser
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0x1a4]
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.004f175f
add esp, 0x10
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1a4]
push edx
push 0xf003f
push ebx
push eax
push closesocket
call esi
test eax, eax
jne 0x4c544d
push str.regedit.exe__e_c:endpcacheBrowser.reg_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesBrowser
call fcn.004f2ce2
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call edi
push str.lanmanserver
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x1a4]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
add esp, 0x10
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1a4]
push eax
push 0xf003f
push ebx
push ecx
push closesocket
call esi
test eax, eax
jne 0x4c549b
push str.regedit.exe__e_c:endpcachelanmanserver.reg_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceslanmanserver
call fcn.004f2ce2
add esp, 4
mov edx, dword [ebp - 0x14]
push edx
call edi
push str.lanmanworkstation
call fcn.004fa6c0
push eax
lea eax, [ebp - 0x1a4]
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
add esp, 0x10
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x1a4]
push ecx
push 0xf003f
push ebx
push edx
push closesocket
call esi
test eax, eax
jne 0x4c54e9
push str.regedit.exe__e_c:endpcachelanmanworkstation.reg_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceslanmanworkstation
call fcn.004f2ce2
add esp, 4
mov eax, dword [ebp - 0x14]
push eax
call edi
push str.PlugPlay
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0x1a4]
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.004f175f
add esp, 0x10
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1a4]
push edx
push 0xf003f
push ebx
push eax
push closesocket
call esi
test eax, eax
jne 0x4c5537
push str.regedit.exe__e_c:endpcachePlugPlay.reg_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesPlugPlay
call fcn.004f2ce2
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call edi
push str.Spooler
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x1a4]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
add esp, 0x10
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1a4]
push eax
push 0xf003f
push ebx
push ecx
push closesocket
call esi
test eax, eax
jne 0x4c5585
push str.regedit.exe__e_c:endpcacheSpooler.reg_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSpooler
call fcn.004f2ce2
add esp, 4
mov edx, dword [ebp - 0x14]
push edx
call edi
push str.Netman
call fcn.004fa6c0
push eax
lea eax, [ebp - 0x1a4]
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
add esp, 0x10
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x1a4]
push ecx
push 0xf003f
push ebx
push edx
push closesocket
call esi
test eax, eax
jne 0x4c55d3
push str.regedit.exe__e_c:endpcacheNetman.reg_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNetman
call fcn.004f2ce2
add esp, 4
mov eax, dword [ebp - 0x14]
push eax
call edi
push str.IPSec
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0x1a4]
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.004f175f
add esp, 0x10
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1a4]
push edx
push 0xf003f
push ebx
push eax
push closesocket
call esi
test eax, eax
jne 0x4c5621
push str.regedit.exe__e_c:endpcacheipsec.reg_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesIPSec
call fcn.004f2ce2
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call edi
push str.USBSTOR
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x1a4]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
add esp, 0x10
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1a4]
push eax
push 0xf003f
push ebx
push ecx
push closesocket
call esi
test eax, eax
jne 0x4c566f
push str.regedit.exe__e_c:endpcacheUSBSTOR.reg_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesUSBSTOR
call fcn.004f2ce2
add esp, 4
mov edx, dword [ebp - 0x14]
push edx
call edi
push str.RpcSs
call fcn.004fa6c0
push eax
lea eax, [ebp - 0x1a4]
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
add esp, 0x10
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x1a4]
push ecx
push 0xf003f
push ebx
push edx
push closesocket
call esi
test eax, eax
jne 0x4c56bd
push str.regedit.exe__e_c:endpcacheRpcSs.reg_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesRpcSs
call fcn.004f2ce2
add esp, 4
mov eax, dword [ebp - 0x14]
push eax
call edi
push str.PolicyAgent
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0x1a4]
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.004f175f
add esp, 0x10
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1a4]
push edx
push 0xf003f
push ebx
push eax
push closesocket
call esi
test eax, eax
jne 0x4c570b
push str.regedit.exe__e_c:endpcachePolicyAgent.reg_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesPolicyAgent
call fcn.004f2ce2
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call edi
push str.Dcomlaunch
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x1a4]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.004f175f
add esp, 0x10
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1a4]
push eax
push 0xf003f
push ebx
push ecx
push closesocket
call esi
test eax, eax
jne 0x4c5768
mov edx, dword [ebp - 0x14]
push str.FailureActions
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.regedit.exe__e_c:endpcacheDcomlaunch.reg_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesDcomlaunch
call fcn.004f2ce2
add esp, 4
mov eax, dword [ebp - 0x14]
push eax
call edi
push str.winsock
call fcn.004fa6c0
push eax
lea ecx, [ebp - 0x1a4]
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.004f175f
add esp, 0x10
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1a4]
push edx
push 0xf003f
push ebx
push eax
push closesocket
call esi
test eax, eax
jne 0x4c57b6
push str.regedit.exe__e_c:endpcachewinsock.reg_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceswinsock
call fcn.004f2ce2
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call edi
mov esi, 1
jmp 0x4c57e7
push str.open_file_defeat___
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0x5c]
call fcn.004f076e
cmp esi, 1
jne 0x4c589a
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0xa4]
push edx
push 2
push str.c:endpcache_acl_model.txt
call fcn.004f0727
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0xa0]
cmp dword [eax + 0x30], 0xffffffff
je 0x4c584c
push str.20091216
lea ecx, [ebp - 0x98]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0xa4]
call fcn.004f076e
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 1
call fcn.004f0714
lea ecx, [ebp - 0x90]
call fcn.004f05fb
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.004f0714
lea ecx, [ebp - 0x48]
call fcn.004f05fb
mov eax, 5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 1
call fcn.004f0714
lea ecx, [ebp - 0x90]
call fcn.004f05fb
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.004f0714
lea ecx, [ebp - 0x48]
call fcn.004f05fb
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret