Function at 0x493fe0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fba43
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5b4
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
push 1
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], esi
call fcn.004f0653
push 1
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 1
call fcn.004f0653
mov eax, dword [0x4fe4e8]
lea ecx, [ebp - 0x78]
push eax
push 8
push str.c:endpcacheprocess_log.txt
mov byte [ebp - 4], 2
call fcn.004f0727
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0x1c], esi
mov edx, dword [ecx + 4]
mov eax, dword [ebp + edx - 0x74]
cmp dword [eax + 0x30], 0xffffffff
je 0x494057
mov dword [ebp - 0x1c], 1
mov eax, dword [0xe56e68]
mov dword [ebp - 0x20], esi
cmp esi, eax
jge 0x494678
mov ebx, esi
push str.AnyFileDel.
shl ebx, 8
lea edi, [ebx + 0xd7aeac]
push edi
mov dword [ebp - 0x30], edi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x494672
lea eax, [ebp - 0x5c0]
push edi
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x494672
lea ecx, [ebp - 0x178]
lea edx, [ebp - 0x4c0]
push ecx
push edx
push edi
mov byte [ebp - 0x4c0], 0
mov byte [ebp - 0x178], 0
call fcn.004da440
add esp, 0xc
push 0x5249f0
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4940ec
push 0x5249ec
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x494140
lea eax, [ebp - 0x4c0]
push 0x526940
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x494672
lea ecx, [ebp - 0x4c0]
push 0x526930
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x494672
lea edx, [ebp - 0x4c0]
push str.Microsoft_Corporation
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x494672
push edi
call fcn.004cc840
add esp, 4
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x4c0]
lea ecx, [ebp - 0x178]
push eax
push ecx
push 0xd09fb0
mov byte [ebp - 0x3c0], 0
call fcn.004fa6c0
add esp, 4
push eax
push 0xd52ffc
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x3c0]
push eax
push 0x5268fc
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x18
test eax, eax
jne 0x4941ee
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b4]
mov edx, dword [ebp + 0x1b0]
test eax, eax
lea eax, [ebp - 0x3c0]
push eax
push ecx
push edx
jne 0x4941d1
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x4941e8
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
mov eax, dword [ebp - 0x1c]
mov edi, 1
cmp eax, edi
jne 0x49421e
lea eax, [ebp - 0x3c0]
lea ecx, [ebp - 0x6c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea esi, [ebx + 0xda838c]
xor eax, eax
push str.Temp_
push esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x494253
push 0x516860
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x494253
mov dword [ebp - 0x18], edi
push str.Temp_
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49427a
push str..Tmp
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49427a
mov dword [ebp - 0x18], edi
push esi
push 0xd09fb0
mov byte [ebp - 0x3c0], 0
call fcn.004fa6c0
add esp, 4
push eax
push 0xd52ffc
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x3c0]
push eax
push 0x5268c0
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x14
test eax, eax
jne 0x494314
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b0]
test eax, eax
mov eax, dword [ebp + 0x1b4]
lea edx, [ebp - 0x3c0]
push edx
push eax
push ecx
jne 0x4942f2
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x494309
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
mov edi, 1
cmp dword [ebp - 0x1c], edi
jne 0x49433d
lea edx, [ebp - 0x3c0]
lea ecx, [ebp - 0x6c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea eax, [ebp - 0x4c0]
push 0x514ba8
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x494363
cmp dword [ebp - 0x24], edi
je 0x494363
cmp dword [ebp - 0x18], edi
jne 0x494649
lea ecx, [ebp - 0x178]
push ecx
call fcn.0044a870
add esp, 4
lea edx, [ebp - 0x178]
mov ebx, eax
push edx
call fcn.004ab3c0
mov edi, eax
add esp, 4
cmp edi, 0x7800
jge 0x4944bf
push 0x5268b8
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4943d9
push 0x5267d4
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4943d9
push 0x517554
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4943d9
push 0x5268ac
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x494429
lea eax, [ebp - 0x178]
push 0x5147e0
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x494429
lea ecx, [ebp - 0x178]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x178]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x178]
push eax
call fcn.004abbf0
mov esi, 1
add esp, 4
mov dword [ebp - 0x14], esi
jmp 0x49442e
mov esi, 1
cmp edi, 0x1800
jge 0x4944c4
lea ecx, [ebp - 0x178]
push 0x5147e0
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4944c4
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], esi
push edx
lea ecx, [ebp - 0x178]
xor esi, esi
push eax
push ecx
mov dword [ebp - 0x2c], esi
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
jne 0x49447d
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
je 0x494482
mov esi, 1
cmp esi, 1
mov dword [ebp - 4], 2
jne 0x4944bf
lea eax, [ebp - 0x178]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x178]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x178]
push edx
call fcn.004abbf0
add esp, 4
mov dword [ebp - 0x14], esi
mov esi, 1
cmp dword [ebp - 0x18], esi
jne 0x494502
cmp edi, 0xc800
jge 0x494502
lea eax, [ebp - 0x178]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x178]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x178]
push edx
call fcn.004abbf0
add esp, 4
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x24], esi
jne 0x49454a
push 0x5182a0
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x49454a
lea eax, [ebp - 0x178]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x178]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x178]
push edx
call fcn.004abbf0
add esp, 4
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x14]
mov byte [ebp - 0x3c0], 0
cmp eax, esi
push ebx
jne 0x49458a
lea eax, [ebp - 0x178]
push eax
push 0xd09fb0
call fcn.004fa6c0
add esp, 4
push eax
push 0xd52ffc
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x3c0]
push eax
push 0x526854
push ecx
jmp 0x4945b9
lea edx, [ebp - 0x178]
push edx
push 0xd09fb0
call fcn.004fa6c0
add esp, 4
push eax
push 0xd52ffc
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x3c0]
push 0x526814
push eax
call fcn.004f175f
mov eax, dword [ebp - 0x1c]
add esp, 0x18
cmp eax, esi
jne 0x4945ec
lea ecx, [ebp - 0x3c0]
push ecx
lea ecx, [ebp - 0x6c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [0xe56db0]
test eax, eax
jne 0x494649
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b0]
test eax, eax
mov eax, dword [ebp + 0x1b4]
lea edx, [ebp - 0x3c0]
push edx
push eax
push ecx
jne 0x49462c
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x494643
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
mov edi, dword [ebp - 0x30]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x5c0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x20]
inc esi
jmp 0x494057
lea ecx, [ebp - 0x78]
mov dword [0xe56e68], 0
call fcn.004f076e
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 4], 1
call fcn.004f0714
lea ecx, [ebp - 0x1ac]
call fcn.004f05fb
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x64]
call fcn.004f05fb
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret