Function at 0x48a8c0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb8ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4ec
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
push 1
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], edi
call fcn.004f0653
push 1
lea ecx, [ebp - 0x2f8]
mov byte [ebp - 4], 1
call fcn.004f0653
push 1
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 2
call fcn.004f0653
mov eax, dword [0x4fe4e8]
lea ecx, [ebp - 0x68]
push eax
push 8
push str.c:endpcacheprocess_log.txt
mov byte [ebp - 4], 3
call fcn.004f0727
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x18], edi
mov edx, dword [ecx + 4]
mov eax, dword [ebp + edx - 0x64]
cmp dword [eax + 0x30], 0xffffffff
je 0x48a948
mov dword [ebp - 0x18], 1
xor esi, esi
mov dword [ebp - 0x14], esi
cmp esi, dword [0xe56e7c]
jge 0x48aa8c
mov eax, esi
lea ecx, [ebp - 0x4f8]
shl eax, 8
lea ebx, [eax + 0xc4e29c]
push ebx
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x48aa81
lea edx, [ebp - 0x3f8]
mov byte [ebp - 0x3f8], 0
push edx
push ebx
call fcn.004d9590
add esp, 8
lea eax, [ebp - 0x3f8]
mov byte [ebp - 0x2b0], 0
push eax
push ebx
push 0xd09fb0
call fcn.004fa6c0
add esp, 4
push eax
push 0xd52ffc
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x2b0]
push eax
push 0x525ce0
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x18
cmp eax, edi
jne 0x48aa2f
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b0]
test eax, eax
mov eax, dword [ebp + 0x1b4]
lea edx, [ebp - 0x2b0]
push edx
push eax
push ecx
jne 0x48aa12
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x48aa29
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
cmp dword [ebp - 0x18], 1
jne 0x48aa59
lea edx, [ebp - 0x2b0]
lea ecx, [ebp - 0x5c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x14]
inc esi
xor edi, edi
mov dword [ebp - 0x14], esi
jmp 0x48a94d
mov eax, dword [0xe56e84]
mov dword [0xe56e7c], edi
cmp eax, 1
jne 0x48abfb
mov ecx, dword [0x4fe4e8]
push ecx
push 2
push str.c:endpcacheproc_svc_pid.txt
lea ecx, [ebp - 0xb0]
call fcn.004f0727
xor eax, eax
xor ebx, ebx
cmp ebx, dword [0xe56e88]
jge 0x48abe4
mov ecx, dword [ebx*4 + 0xe41c80]
cmp eax, ecx
je 0x48abdc
mov edx, dword [ebp - 0xb0]
mov eax, dword [edx + 4]
mov eax, dword [ebp + eax - 0xac]
cmp dword [eax + 0x30], 0xffffffff
je 0x48ab0f
push ecx
lea ecx, [ebp - 0xa4]
call fcn.004f0ba3
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebx*4 + 0xe41c80]
mov byte [ebp - 0x2b0], 0
push ecx
push 0xd09fb0
call fcn.004fa6c0
add esp, 4
push eax
push 0xd52ffc
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x2b0]
push eax
push 0x525c94
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x14
cmp eax, edi
jne 0x48abab
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b4]
mov edx, dword [ebp + 0x1b0]
test eax, eax
lea eax, [ebp - 0x2b0]
push eax
push ecx
push edx
jne 0x48ab8e
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x48aba5
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
cmp dword [ebp - 0x18], 1
jne 0x48abd5
lea eax, [ebp - 0x2b0]
lea ecx, [ebp - 0x5c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebx*4 + 0xe41c80]
inc ebx
xor edi, edi
jmp 0x48aabd
lea ecx, [ebp - 0xb0]
mov dword [0xe56e88], edi
mov dword [0xe56e84], edi
call fcn.004f076e
mov dword [ebp - 0x14], edi
mov ecx, dword [ebp - 0x14]
mov eax, dword [0xe56ea8]
cmp ecx, eax
jge 0x48ade6
mov edx, ecx
lea eax, [ebp - 0x4f8]
shl edx, 8
lea ebx, [edx + 0xda7e8c]
push ebx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x48adde
lea ecx, [ebp - 0x3f8]
mov byte [ebp - 0x2b0], 0
push ecx
push ebx
mov byte [ebp - 0x3f8], 0
call fcn.004d9590
add esp, 8
lea edx, [ebp - 0x20]
movsx edi, ax
lea eax, [ebp - 0x1c]
push edx
xor esi, esi
push eax
push ebx
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], esi
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
jne 0x48ac7b
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
je 0x48ac80
mov esi, 1
push ebx
mov dword [ebp - 4], 3
call fcn.004ab3c0
add esp, 4
cmp esi, 1
jne 0x48acfa
cmp eax, 0xc800
jge 0x48acfa
cmp edi, esi
jge 0x48acfa
mov edx, dword [ebp - 0x14]
mov eax, dword [edx*4 + 0xda6f00]
push eax
call fcn.004a7430
add esp, 4
mov eax, 0x80
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push 0xd09fb0
call fcn.004fa6c0
add esp, 4
push eax
push 0xd52ffc
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x2b0]
push eax
push 0x525c24
push ecx
call fcn.004f175f
add esp, 0x14
jmp 0x48ad32
lea edx, [ebp - 0x3f8]
push edx
push ebx
push 0xd09fb0
call fcn.004fa6c0
add esp, 4
push eax
push 0xd52ffc
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x2b0]
push 0x525be8
push eax
call fcn.004f175f
add esp, 0x18
mov eax, dword [0xe56db0]
test eax, eax
jne 0x48ad8f
mov eax, dword [0xe56dbc]
mov edx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x2b0]
test eax, eax
mov eax, dword [ebp + 0x1b0]
push ecx
push edx
push eax
jne 0x48ad72
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x48ad89
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
cmp dword [ebp - 0x18], 1
jne 0x48adb9
lea ecx, [ebp - 0x2b0]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
inc dword [ebp - 0x14]
jmp 0x48abfe
xor eax, eax
mov dword [0xe56ea8], eax
mov dword [ebp - 0x14], eax
mov ecx, eax
cmp ecx, dword [0xe56eb4]
jge 0x48b025
mov edx, ecx
lea eax, [ebp - 0x4f8]
shl edx, 8
lea ebx, [edx + 0xda6a00]
push ebx
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x48b01c
lea ecx, [ebp - 0x3f8]
mov byte [ebp - 0x2b0], 0
push ecx
push ebx
mov byte [ebp - 0x3f8], 0
call fcn.004d9590
add esp, 8
lea edx, [ebp - 0x1c]
movsx edi, ax
lea eax, [ebp - 0x20]
push edx
xor esi, esi
push eax
push ebx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], esi
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
jne 0x48ae6b
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
je 0x48ae70
mov esi, 1
push ebx
mov dword [ebp - 4], 3
call fcn.004ab3c0
add esp, 4
cmp esi, 1
jne 0x48af38
cmp eax, 0xc800
jge 0x48af38
cmp edi, esi
jge 0x48af38
push ebx
call fcn.004cb750
add esp, 4
test eax, eax
jne 0x48aedf
push ebx
push 0xd09fb0
call fcn.004fa6c0
add esp, 4
push eax
push 0xd52ffc
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x2b0]
push eax
push 0x525bb8
push edx
call fcn.004f175f
add esp, 0x14
jmp 0x48af70
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax*4 + 0xd69054]
push ecx
call fcn.004a7430
add esp, 4
mov eax, 0x80
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x3f8]
push edx
push ebx
push 0xd09fb0
call fcn.004fa6c0
add esp, 4
push eax
push 0xd52ffc
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x2b0]
push 0x525b78
push eax
jmp 0x48af68
lea ecx, [ebp - 0x3f8]
push ecx
push ebx
push 0xd09fb0
call fcn.004fa6c0
add esp, 4
push eax
push 0xd52ffc
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x2b0]
push eax
push 0x525b48
push edx
call fcn.004f175f
add esp, 0x18
mov eax, dword [0xe56db0]
test eax, eax
jne 0x48afcd
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b4]
mov edx, dword [ebp + 0x1b0]
test eax, eax
lea eax, [ebp - 0x2b0]
push eax
push ecx
push edx
jne 0x48afb0
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x48afc7
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
cmp dword [ebp - 0x18], 1
jne 0x48aff7
lea eax, [ebp - 0x2b0]
lea ecx, [ebp - 0x5c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x4f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x14]
inc eax
jmp 0x48aded
lea ecx, [ebp - 0x68]
mov dword [0xe56eb4], 0
call fcn.004f076e
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0x9c]
call fcn.004f05fb
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 1
call fcn.004f0714
lea ecx, [ebp - 0x2e4]
call fcn.004f05fb
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x54]
call fcn.004f05fb
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret