Function at 0x45cef0
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb33b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x8570
call fcn.004f2630
push ebx
push esi
push edi
lea eax, [ebp - 0x200]
mov dword [ebp - 0x10], esp
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.004ab6e0
add esp, 4
lea ecx, [ebp - 0x38]
push ecx
call fcn.00401350
add esp, 4
lea edx, [ebp - 0x480]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x8580]
push eax
push ecx
mov dword [ebp - 0x14], esi
call fcn.004c4570
add esp, 8
lea ecx, [ebp - 0x180]
push 1
call fcn.004f0653
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0x180]
push edx
push 8
push str.c:endpcacheprocess_log.txt
mov byte [ebp - 4], 1
call fcn.004f0727
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], esi
cmp esi, eax
jge 0x45d145
mov eax, esi
push str.32A6Wizard_
shl eax, 8
lea ebx, [ebp + eax - 0x8580]
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x45d13f
lea ecx, [ebp - 0x580]
mov byte [ebp - 0x580], al
push ecx
push ebx
call fcn.004d9590
add esp, 8
push ebx
call fcn.0045dc50
add esp, 4
mov esi, eax
push 0x5147b4
push esi
call fcn.004f2d80
push 0x5144fc
push esi
mov edi, eax
call fcn.004f2d80
add esp, 0x10
test edi, edi
jne 0x45d06d
test eax, eax
jne 0x45d06d
push esi
call fcn.004fa6c0
add esp, 4
push eax
push ebx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x38]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x400]
push eax
push 0x5215c4
push ecx
call fcn.004f175f
push 0x5147ac
push esi
call fcn.004f2d80
add esp, 0x20
test eax, eax
je 0x45d0b8
mov ecx, dword [0xe56d28]
mov eax, dword [0xe56d24]
inc ecx
inc eax
mov dword [0xe56d28], ecx
mov dword [0xe56d24], eax
jmp 0x45d0b8
lea edx, [ebp - 0x580]
push edx
call fcn.004fa6c0
add esp, 4
push eax
push ebx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x200]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x400]
push eax
push 0x5215c4
push edx
call fcn.004f175f
add esp, 0x18
mov eax, dword [0xe56db0]
test eax, eax
jne 0x45d115
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b4]
mov edx, dword [ebp + 0x1b0]
test eax, eax
lea eax, [ebp - 0x400]
push eax
push ecx
push edx
jne 0x45d0f8
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x45d10f
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x400]
lea ecx, [ebp - 0x174]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, dword [ebp - 0x18]
inc esi
jmp 0x45cf8b
lea ecx, [ebp - 0x480]
lea edx, [ebp - 0x138]
push ecx
push str._s_rundll32.exe
push edx
mov byte [ebp - 0x138], 0
call fcn.004f175f
lea eax, [ebp - 0x138]
push eax
call fcn.004abe70
add esp, 0x10
cmp eax, 0xffffffff
je 0x45d28e
lea ecx, [ebp - 0x138]
push ecx
call fcn.0045dc50
add esp, 4
push eax
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x138]
push eax
lea eax, [ebp - 0x38]
push edx
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x200]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x400]
push eax
push 0x521584
push edx
call fcn.004f175f
mov edx, dword [0xe56d28]
mov ecx, dword [0xe56d24]
mov eax, dword [0xe56db0]
add esp, 0x18
inc edx
inc ecx
test eax, eax
mov dword [0xe56d28], edx
mov dword [0xe56d24], ecx
jne 0x45d244
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b4]
mov edx, dword [ebp + 0x1b0]
test eax, eax
lea eax, [ebp - 0x400]
push eax
push ecx
push edx
jne 0x45d227
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x45d23e
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x138]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x138]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x400]
lea ecx, [ebp - 0x174]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
jmp 0x45d294
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x480]
lea ecx, [ebp - 0x138]
push eax
push str._s_smss.exe
push ecx
mov byte [ebp - 0x138], 0
call fcn.004f175f
lea edx, [ebp - 0x138]
push edx
call fcn.004abe70
add esp, 0x10
cmp eax, 0xffffffff
je 0x45d3d5
lea eax, [ebp - 0x138]
push eax
call fcn.0045dc50
add esp, 4
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x138]
lea edx, [ebp - 0x38]
push eax
push ecx
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x400]
push eax
push 0x521584
push ecx
call fcn.004f175f
mov edx, dword [0xe56d28]
mov ecx, dword [0xe56d24]
mov eax, dword [0xe56db0]
add esp, 0x18
inc edx
inc ecx
test eax, eax
mov dword [0xe56d28], edx
mov dword [0xe56d24], ecx
jne 0x45d393
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b0]
test eax, eax
mov eax, dword [ebp + 0x1b4]
lea edx, [ebp - 0x400]
push edx
push eax
push ecx
jne 0x45d376
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x45d38d
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x138]
push 0x80
push edx
call ebx
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x400]
push ecx
lea ecx, [ebp - 0x174]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea edx, [ebp - 0x480]
lea eax, [ebp - 0x138]
push edx
push str._swinlogon.exe
push eax
mov byte [ebp - 0x138], 0
call fcn.004f175f
lea ecx, [ebp - 0x138]
push ecx
call fcn.004abe70
add esp, 0x10
cmp eax, 0xffffffff
je 0x45d516
lea edx, [ebp - 0x138]
push edx
call fcn.0045dc50
add esp, 4
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp - 0x138]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x200]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x400]
push 0x521584
push eax
call fcn.004f175f
mov edx, dword [0xe56d28]
mov ecx, dword [0xe56d24]
mov eax, dword [0xe56db0]
add esp, 0x18
inc edx
inc ecx
test eax, eax
mov dword [0xe56d28], edx
mov dword [0xe56d24], ecx
jne 0x45d4d4
mov eax, dword [0xe56dbc]
mov edx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x400]
test eax, eax
mov eax, dword [ebp + 0x1b0]
push ecx
push edx
push eax
jne 0x45d4b7
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x45d4ce
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x138]
push 0x80
push ecx
call ebx
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x400]
lea ecx, [ebp - 0x174]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0x480]
lea edx, [ebp - 0x138]
push ecx
push str._slsass.exe
push edx
mov byte [ebp - 0x138], 0
call fcn.004f175f
lea eax, [ebp - 0x138]
push eax
call fcn.004abe70
add esp, 0x10
cmp eax, 0xffffffff
je 0x45d657
lea ecx, [ebp - 0x138]
push ecx
call fcn.0045dc50
add esp, 4
push eax
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x138]
push eax
lea eax, [ebp - 0x38]
push edx
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x200]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x400]
push eax
push 0x521584
push edx
call fcn.004f175f
mov edx, dword [0xe56d28]
mov ecx, dword [0xe56d24]
mov eax, dword [0xe56db0]
add esp, 0x18
inc edx
inc ecx
test eax, eax
mov dword [0xe56d28], edx
mov dword [0xe56d24], ecx
jne 0x45d615
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b4]
mov edx, dword [ebp + 0x1b0]
test eax, eax
lea eax, [ebp - 0x400]
push eax
push ecx
push edx
jne 0x45d5f8
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x45d60f
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x138]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x138]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x400]
lea ecx, [ebp - 0x174]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea eax, [ebp - 0x480]
lea ecx, [ebp - 0x138]
push eax
push str._s_services.exe
push ecx
mov byte [ebp - 0x138], 0
call fcn.004f175f
lea edx, [ebp - 0x138]
push edx
call fcn.004abe70
add esp, 0x10
cmp eax, 0xffffffff
je 0x45d798
lea eax, [ebp - 0x138]
push eax
call fcn.0045dc50
add esp, 4
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x138]
lea edx, [ebp - 0x38]
push eax
push ecx
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x400]
push eax
push 0x521584
push ecx
call fcn.004f175f
mov edx, dword [0xe56d28]
mov ecx, dword [0xe56d24]
mov eax, dword [0xe56db0]
add esp, 0x18
inc edx
inc ecx
test eax, eax
mov dword [0xe56d28], edx
mov dword [0xe56d24], ecx
jne 0x45d756
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b0]
test eax, eax
mov eax, dword [ebp + 0x1b4]
lea edx, [ebp - 0x400]
push edx
push eax
push ecx
jne 0x45d739
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x45d750
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x138]
push 0x80
push edx
call ebx
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x400]
push ecx
lea ecx, [ebp - 0x174]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea edx, [ebp - 0x480]
lea eax, [ebp - 0x138]
push edx
push str._s_svchost.exe
push eax
mov byte [ebp - 0x138], 0
call fcn.004f175f
lea ecx, [ebp - 0x138]
push ecx
call fcn.004abe70
add esp, 0x10
cmp eax, 0xffffffff
je 0x45d8d9
lea edx, [ebp - 0x138]
push edx
call fcn.0045dc50
add esp, 4
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x38]
push eax
lea eax, [ebp - 0x138]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x200]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x400]
push 0x521584
push eax
call fcn.004f175f
mov edx, dword [0xe56d28]
mov ecx, dword [0xe56d24]
mov eax, dword [0xe56db0]
add esp, 0x18
inc edx
inc ecx
test eax, eax
mov dword [0xe56d28], edx
mov dword [0xe56d24], ecx
jne 0x45d897
mov eax, dword [0xe56dbc]
mov edx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x400]
test eax, eax
mov eax, dword [ebp + 0x1b0]
push ecx
push edx
push eax
jne 0x45d87a
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x45d891
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x138]
push 0x80
push ecx
call ebx
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x400]
lea ecx, [ebp - 0x174]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0x480]
lea edx, [ebp - 0x138]
push ecx
push str._sdllhost.exe
push edx
mov byte [ebp - 0x138], 0
call fcn.004f175f
lea eax, [ebp - 0x138]
push eax
call fcn.004abe70
add esp, 0x10
cmp eax, 0xffffffff
je 0x45da1a
lea ecx, [ebp - 0x138]
push ecx
call fcn.0045dc50
add esp, 4
push eax
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x138]
push eax
lea eax, [ebp - 0x38]
push edx
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x200]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x400]
push eax
push 0x521584
push edx
call fcn.004f175f
mov edx, dword [0xe56d28]
mov ecx, dword [0xe56d24]
mov eax, dword [0xe56db0]
add esp, 0x18
inc edx
inc ecx
test eax, eax
mov dword [0xe56d28], edx
mov dword [0xe56d24], ecx
jne 0x45d9d8
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b4]
mov edx, dword [ebp + 0x1b0]
test eax, eax
lea eax, [ebp - 0x400]
push eax
push ecx
push edx
jne 0x45d9bb
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x45d9d2
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x138]
push 0x80
push eax
call ebx
lea ecx, [ebp - 0x138]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x400]
lea ecx, [ebp - 0x174]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0x180]
call fcn.004f076e
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x16c]
call fcn.004f05fb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov ax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret