Function at 0x474c00
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb723
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c0
push ebx
push esi
push edi
lea eax, [ebp - 0x3cc]
mov dword [ebp - 0x10], esp
xor esi, esi
push eax
mov dword [ebp - 4], esi
mov dword [0xe56df0], esi
call fcn.004ab6e0
add esp, 4
lea ecx, [ebp - 0x84]
push ecx
call fcn.00401350
add esp, 4
lea edx, [ebp - 0x34c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 1
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x14], esi
call fcn.004f0653
push 1
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 1
call fcn.004f0653
mov eax, dword [0x4fe4e8]
lea ecx, [ebp - 0xcc]
push eax
push 8
push str.c:endpcacheprocess_log.txt
mov byte [ebp - 4], 2
call fcn.004f0727
mov ecx, dword [0x4fe4e8]
push ecx
push 1
push str.c:endpcache_fileMonitor_special_filelog.txt
lea ecx, [ebp - 0x64]
call fcn.004f0727
mov esi, dword [ebp - 0x60]
push 0xa
lea edx, [ebp - 0x1cc]
inc esi
push 0x100
push edx
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x60], esi
call fcn.004f0ae9
lea edi, [ebp - 0x1cc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x1cc]
mov ebx, ecx
lea ecx, [ebp - 0x7cc]
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x475130
lea edi, [ebp - 0x1cc]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x7cc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x2cc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1cc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x2cc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp eax, ecx
jge 0x474d6f
cmp byte [ebp + eax - 0x2cc], 0x2e
je 0x474d6f
inc eax
jmp 0x474d5e
cmp ebx, 5
mov byte [ebp + eax - 0x2c8], 0
jle 0x475130
mov eax, dword [0xe56bf8]
test eax, eax
jne 0x474e3e
lea ecx, [ebp - 0x34c]
push str.packet.dll
push ecx
lea edx, [ebp - 0x4cc]
push str._s_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x4cc]
lea ecx, [ebp - 0x2cc]
push eax
push ecx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x475130
lea edx, [ebp - 0x34c]
push str.WanPacket.dll
push edx
lea eax, [ebp - 0x4cc]
push str._s_s
push eax
call fcn.004f175f
lea ecx, [ebp - 0x4cc]
lea edx, [ebp - 0x2cc]
push ecx
push edx
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x475130
lea eax, [ebp - 0x34c]
push str.wpcap.dll
push eax
lea ecx, [ebp - 0x4cc]
push str._s_s
push ecx
call fcn.004f175f
lea edx, [ebp - 0x4cc]
lea eax, [ebp - 0x2cc]
push edx
push eax
call fcn.004f61e0
add esp, 0x18
test eax, eax
je 0x475130
lea ecx, [ebp - 0x1cc]
push str.32A6Wizard_
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x475130
lea edx, [ebp - 0x1cc]
push str.32LIBEAY32.DLL
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x475130
lea eax, [ebp - 0x1cc]
push str.32SSLEAY32.DLL
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x475130
lea ecx, [ebp - 0x1cc]
push str.32_vrvarpl.exe
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x475130
lea edx, [ebp - 0x1cc]
push str.32_vrvarp.exe
push edx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x475130
mov byte [ebp - 0x6cc], al
lea eax, [ebp - 0x2cc]
push 0x515e8c
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x474f0e
lea ecx, [ebp - 0x2cc]
push 0x515e88
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x474f0e
lea edx, [ebp - 0x2cc]
push edx
call fcn.00424ae0
jmp 0x474f1a
lea eax, [ebp - 0x2cc]
push eax
call fcn.0047c8a0
add esp, 4
mov ebx, eax
push 0x5147b4
push ebx
call fcn.004f2d80
push 0x5144fc
push ebx
mov esi, eax
call fcn.004f2d80
push 0x516d88
push ebx
mov edi, eax
call fcn.004f2d80
push 0x523e80
push ebx
mov dword [ebp - 0x18], eax
call fcn.004f2d80
push 0x516efc
push ebx
mov dword [ebp - 0x1c], eax
call fcn.004f2d80
add esp, 0x28
test esi, esi
jne 0x4750c4
test edi, edi
jne 0x4750c4
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x4750c4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x4750c4
test eax, eax
jne 0x4750c4
push ebx
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x1cc]
lea edx, [ebp - 0x84]
push eax
push ecx
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x3cc]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x6cc]
push eax
push 0x523e3c
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x18
test eax, eax
jne 0x475033
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b0]
test eax, eax
mov eax, dword [ebp + 0x1b4]
lea edx, [ebp - 0x6cc]
push edx
push eax
push ecx
jne 0x475016
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x47502d
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
push 0x5147ac
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x47506a
mov edx, dword [0xe56d24]
mov ecx, dword [0xe56d28]
mov eax, dword [0xe56d04]
inc edx
inc ecx
inc eax
mov dword [0xe56d24], edx
mov dword [0xe56d28], ecx
mov dword [0xe56d04], eax
push 0x51755c
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x47508e
push 0x517564
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x475094
inc dword [0xe56d00]
lea edx, [ebp - 0x6cc]
lea ecx, [ebp - 0xc0]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp - 0x14], 1
jmp 0x475130
push ebx
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1cc]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x3cc]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x6cc]
push 0x523e0c
push eax
call fcn.004f175f
add esp, 0x18
lea ecx, [ebp - 0x6cc]
push ecx
lea ecx, [ebp - 0xc0]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x64]
mov eax, dword [edx + 4]
test byte [ebp + eax - 0x5c], 1
je 0x474caf
lea ecx, [ebp - 0x64]
call fcn.004f076e
push 0x80
push str.c:endpcache_fileMonitor_special_filelog.txt
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.c:endpcache_fileMonitor_special_filelog.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x475233
lea ecx, [ebp - 0x84]
push 0x523dcc
push ecx
mov byte [ebp - 0x6cc], 0
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x3cc]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x6cc]
push 0x5190b4
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x14
test eax, eax
jne 0x47520c
mov eax, dword [0xe56dbc]
mov edx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x6cc]
test eax, eax
mov eax, dword [ebp + 0x1b0]
push ecx
push edx
push eax
jne 0x4751ef
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x475206
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x6cc]
push ecx
lea ecx, [ebp - 0xc0]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0xcc]
call fcn.004f076e
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 1
call fcn.004f0714
lea ecx, [ebp - 0xb8]
call fcn.004f05fb
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x50]
call fcn.004f05fb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret