Function at 0x481ed0
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb7ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa04
push ebx
push esi
push edi
lea eax, [ebp - 0x190]
mov dword [ebp - 0x10], esp
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.004ab6e0
add esp, 4
lea ecx, [ebp - 0x38]
push ecx
call fcn.00401350
add esp, 4
lea edx, [ebp - 0x610]
mov dword [0xe56df0], esi
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x610]
push eax
call fcn.00481c90
add esp, 4
lea ecx, [ebp - 0x80]
push 1
call fcn.004f0653
push 1
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 1
call fcn.004f0653
push 1
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 2
call fcn.004f0653
mov ecx, dword [0x4fe4e8]
mov byte [ebp - 4], 3
push ecx
push 8
push str.c:endpcacheprocess_log.txt
lea ecx, [ebp - 0x80]
call fcn.004f0727
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0xc8]
push edx
push 2
push str.c:endpcacheevilsys_path.txt
call fcn.004f0727
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x14]
mov ecx, dword [0xe56df0]
cmp eax, ecx
jge 0x4824e0
mov ecx, eax
xor eax, eax
shl ecx, 6
lea esi, [ecx + 0xdfcf18]
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 2
jl 0x4824d2
push str.tcpip.sys
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4824d2
push str.TDIFilter.sys
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4824d2
push str.Protector.sys
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x48201b
push 0x5243b0
jmp 0x4821ad
push str.ProtectorA.sys
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4820e7
lea ecx, [ebp - 0x290]
push 0x5243b0
lea edx, [ebp - 0x38]
push ecx
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x590]
push eax
push 0x524360
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x18
test eax, eax
jne 0x4820db
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b0]
test eax, eax
mov eax, dword [ebp + 0x1b4]
lea edx, [ebp - 0x590]
push edx
push eax
push ecx
jne 0x4820be
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea edx, [ebp - 0x590]
push edx
jmp 0x4824b5
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x590]
push edx
jmp 0x4824b5
push str.sptd.sys
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x482185
lea eax, [ebp - 0x290]
push str.Alcohol_Soft
lea ecx, [ebp - 0x38]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x190]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x590]
push 0x524360
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x18
test eax, eax
jne 0x4824ae
mov eax, dword [0xe56dbc]
mov edx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x590]
test eax, eax
mov eax, dword [ebp + 0x1b0]
push ecx
push edx
push eax
jne 0x482491
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x4824a8
cmp dword [0xe56be4], 1
jne 0x48225e
push str.WBWSF.sys
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x48225e
push 0x524338
lea edx, [ebp - 0x290]
lea eax, [ebp - 0x38]
push edx
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x190]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x590]
push eax
push 0x524360
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x18
test eax, eax
jne 0x482252
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b4]
mov edx, dword [ebp + 0x1b0]
test eax, eax
lea eax, [ebp - 0x590]
push eax
push ecx
push edx
jne 0x482235
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
add esp, 0x1b4
lea eax, [ebp - 0x590]
push eax
jmp 0x4824b5
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x590]
push eax
jmp 0x4824b5
lea ecx, [ebp - 0x610]
push esi
push ecx
lea edx, [ebp - 0x290]
push str._sdrivers_s
push edx
mov byte [ebp - 0x290], 0
call fcn.004f175f
lea eax, [ebp - 0x310]
lea ecx, [ebp - 0x290]
push eax
push ecx
mov byte [ebp - 0x310], 0
call fcn.004d9590
add esp, 0x18
lea edx, [ebp - 0x310]
movsx edi, ax
push 0x514ba8
push edx
call fcn.004f2d80
add esp, 8
test edi, edi
je 0x48230e
test eax, eax
jne 0x48230e
lea eax, [ebp - 0x310]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x290]
lea edx, [ebp - 0x38]
push eax
push ecx
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x590]
push eax
push 0x524304
push ecx
call fcn.004f175f
add esp, 0x18
lea edx, [ebp - 0x590]
push edx
jmp 0x4824b5
lea eax, [ebp - 0x310]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x290]
lea edx, [ebp - 0x38]
push eax
push ecx
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x590]
push eax
push 0x5242bc
push ecx
call fcn.004f175f
mov ecx, dword [0xe56d24]
add esp, 0x18
inc ecx
mov edi, esi
mov dword [0xe56d24], ecx
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x710]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x18], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebx - 1]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test eax, eax
jle 0x4823a3
cmp byte [ebp + eax - 0x710], 0x2e
je 0x4823a3
dec eax
jmp 0x482392
lea ecx, [ebp - 0x710]
mov byte [ebp + eax - 0x710], 0
push ecx
call fcn.004c8a50
add esp, 4
test eax, eax
je 0x4823cc
cmp eax, 1
je 0x4823cc
cmp eax, 2
jne 0x482451
mov edx, dword [ebp - 0xc8]
mov eax, dword [edx + 4]
mov eax, dword [ebp + eax - 0xc4]
cmp dword [eax + 0x30], 0xffffffff
je 0x482409
lea ecx, [ebp - 0x290]
push ecx
lea ecx, [ebp - 0xbc]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea edx, [ebp - 0x310]
push edx
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp - 0x290]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x190]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x590]
push 0x524268
push eax
call fcn.004f175f
add esp, 0x18
mov eax, dword [0xe56db0]
test eax, eax
jne 0x4824ae
mov eax, dword [0xe56dbc]
mov edx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x590]
test eax, eax
mov eax, dword [ebp + 0x1b0]
push ecx
push edx
push eax
jne 0x482491
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x4824a8
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x590]
push ecx
lea ecx, [ebp - 0x74]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
inc eax
xor esi, esi
mov dword [ebp - 0x14], eax
jmp 0x481fa0
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0x110]
push edx
push 1
push str.c:endpcache_fileMonitor_special_syslog.txt
mov dword [ebp - 0x14], esi
call fcn.004f0727
mov edi, dword [ebp - 0x10c]
push 0xa
lea eax, [ebp - 0x290]
inc edi
push 0x100
push eax
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x10c], edi
call fcn.004f0ae9
lea edi, [ebp - 0x290]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xa10]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea ecx, [ebp - 0x290]
push ecx
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x482a25
lea edi, [ebp - 0x290]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xa10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp ebx, 5
rep movsb byte es:[edi], byte [esi]
jle 0x482a19
lea ecx, [ebp - 0x610]
push str.tcpip.sys
push ecx
lea edx, [ebp - 0x810]
push str._sdrivers_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x810]
lea ecx, [ebp - 0x290]
push eax
push ecx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x482a25
lea edx, [ebp - 0x610]
push str.Protector.sys
push edx
lea eax, [ebp - 0x810]
push str._sdrivers_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x810]
lea edx, [ebp - 0x290]
push ecx
push edx
call fcn.004f61e0
add esp, 0x18
test eax, eax
jne 0x482682
push 0x5243b0
lea eax, [ebp - 0x290]
lea ecx, [ebp - 0x38]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x190]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x590]
push 0x524360
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x18
test eax, eax
jne 0x48271b
mov eax, dword [0xe56dbc]
mov edx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x590]
test eax, eax
mov eax, dword [ebp + 0x1b0]
push ecx
push edx
push eax
jne 0x4826fe
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x482715
lea edx, [ebp - 0x610]
push str.ProtectorA.sys
push edx
lea eax, [ebp - 0x810]
push str._sdrivers_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x810]
lea edx, [ebp - 0x290]
push ecx
push edx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x4825fa
lea edx, [ebp - 0x610]
push str.sptd.sys
push edx
lea eax, [ebp - 0x810]
push str._sdrivers_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x810]
lea edx, [ebp - 0x290]
push ecx
push edx
call fcn.004f61e0
add esp, 0x18
test eax, eax
jne 0x482744
push str.Alcohol_Soft
jmp 0x4825ff
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x590]
push ecx
lea ecx, [ebp - 0x74]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
jmp 0x482a25
lea edx, [ebp - 0x310]
lea eax, [ebp - 0x290]
push edx
push eax
mov byte [ebp - 0x310], 0
call fcn.004d9590
add esp, 8
lea ecx, [ebp - 0x310]
movsx esi, ax
push 0x514ba8
push ecx
call fcn.004f2d80
add esp, 8
test esi, esi
je 0x4827cd
test eax, eax
jne 0x4827cd
lea edx, [ebp - 0x310]
push edx
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp - 0x290]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x190]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x590]
push 0x524304
push eax
call fcn.004f175f
add esp, 0x18
jmp 0x4829f5
lea edx, [ebp - 0x310]
push edx
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp - 0x290]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x190]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x590]
push 0x5242bc
push eax
call fcn.004f175f
mov eax, dword [0xe56d24]
add esp, 0x18
inc eax
lea edi, [ebp - 0x290]
mov dword [0xe56d24], eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x710]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x18], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x290]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
test ecx, ecx
jle 0x482873
cmp byte [ebp + ecx - 0x710], 0x2e
je 0x482873
dec ecx
jmp 0x482862
mov byte [ebp + ecx - 0x710], 0
lea edi, [ebp - 0x710]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebp - 0x710]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [ebp - 0x910]
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [edx - 1]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test eax, eax
jle 0x4828f2
cmp byte [ebp + eax - 0x910], 0x5c
je 0x4828c8
dec eax
jmp 0x4828b7
test eax, eax
jle 0x4828f2
lea ecx, [eax + 1]
cmp ecx, edx
jge 0x4828e8
mov bl, byte [ebp + ecx - 0x910]
mov esi, ecx
sub esi, eax
inc ecx
mov byte [ebp + esi - 0x711], bl
jmp 0x4828cf
sub edx, eax
mov byte [ebp + edx - 0x711], 0
lea ecx, [ebp - 0x710]
push ecx
call fcn.004c8a50
add esp, 4
test eax, eax
je 0x482913
cmp eax, 1
je 0x482913
cmp eax, 2
jne 0x482998
mov edx, dword [ebp - 0xc8]
mov eax, dword [edx + 4]
mov eax, dword [ebp + eax - 0xc4]
cmp dword [eax + 0x30], 0xffffffff
je 0x482950
lea ecx, [ebp - 0x290]
push ecx
lea ecx, [ebp - 0xbc]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea edx, [ebp - 0x310]
push edx
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp - 0x290]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x190]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x590]
push 0x524268
push eax
call fcn.004f175f
add esp, 0x18
mov eax, dword [0xe56db0]
test eax, eax
jne 0x4829f5
mov eax, dword [0xe56dbc]
mov edx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x590]
test eax, eax
mov eax, dword [ebp + 0x1b0]
push ecx
push edx
push eax
jne 0x4829d8
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x4829ef
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x590]
push ecx
lea ecx, [ebp - 0x74]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
inc eax
cmp eax, 0x64
mov dword [ebp - 0x14], eax
jg 0x482a3c
mov edx, dword [ebp - 0x110]
mov eax, dword [edx + 4]
test byte [ebp + eax - 0x108], 1
je 0x4824fc
lea ecx, [ebp - 0x110]
call fcn.004f076e
push 0x80
push str.c:endpcache_fileMonitor_special_syslog.txt
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.c:endpcache_fileMonitor_special_syslog.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0xc8]
call fcn.004f076e
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x482b36
lea ecx, [ebp - 0x38]
push 0x5241f0
push ecx
mov byte [ebp - 0x590], 0
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x190]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x590]
push 0x5190b4
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x14
test eax, eax
jne 0x482b12
mov eax, dword [0xe56dbc]
mov edx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x590]
test eax, eax
mov eax, dword [ebp + 0x1b0]
push ecx
push edx
push eax
jne 0x482af5
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x482b0c
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x590]
push ecx
lea ecx, [ebp - 0x74]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0x80]
call fcn.004f076e
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0xfc]
call fcn.004f05fb
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 1
call fcn.004f0714
lea ecx, [ebp - 0xb4]
call fcn.004f05fb
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x6c]
call fcn.004f05fb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret