Function at 0x468de0
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ef495
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x68
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x13d8], 0
mov eax, dword [edi + 0x13dc]
je 0x4695a3
test al, 8
je 0x4695a3
push 0
push 0xffffffffffffffff
push str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
call fcn.005d6a80
lea eax, [ebp - 0x64]
mov dword [ebp - 4], 0
push eax
push 0x6c4f48
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x64], 0
call fcn.005d66b0
test al, al
je 0x469593
cmp dword [ebp - 0x64], 0
je 0x469593
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x48]
movq qword [ebp - 0x48], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x68], 0
lea ecx, [ebp - 0x70]
movq qword [ebp - 0x70], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3c]
movq qword [ebp - 0x2c], xmm0
movups xmmword [ebp - 0x3c], xmm0
call fcn.005d9320
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 4
push eax
push str.BrandOEMData
lea ecx, [ebp - 0x24]
call fcn.005d6740
test al, al
je 0x468f71
lea ecx, [ebp - 0x20]
call fcn.005dc3a0
cmp eax, 0x40
jl 0x468f71
lea edx, [ebp - 0x20]
push ecx
mov ecx, edx
call fcn.00477530
test eax, eax
je 0x468f71
push 0xb
push 1
push 1
push 1
push str.BrandOEM
lea ecx, [ebp - 0x20]
call fcn.005daa70
test eax, eax
je 0x468f71
push 1
push 0x637f9c
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005d9070
lea ecx, [ebp - 0x3c]
call fcn.005d9210
cmp eax, 5
jbe 0x468f71
push 2
lea esi, [edi + 0x114]
call fcn.005d9220
push eax
mov ecx, esi
call fcn.005dc4c0
test al, al
jne 0x469195
sub esp, 8
mov dword [ebp - 0x4c], 0
xorps xmm0, xmm0
lea esi, [edi + 0x114]
mov ecx, esi
movq qword [ebp - 0x54], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._key.uvkey
call fcn.005dc190
push eax
push str.users_
lea ecx, [ebp - 0x54]
call fcn.005dc520
lea edx, [ebp - 0x54]
mov byte [ebp - 4], 5
push 0xfde9
mov ecx, edx
call fcn.00477490
test eax, eax
jne 0x468fd3
mov esi, dword [edi + 0x13dc]
jmp 0x469569
sub esp, 0xc
lea ecx, [ebp - 0x54]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.https:__www.carifred.com_uvk_custom_label_download.php_file
call fcn.005da510
push 0
push 0
push 0
push ecx
push 6
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x74], 0
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005b40e0
push eax
lea ecx, [ebp - 0x74]
call fcn.005b0bd0
push 6
mov byte [ebp - 4], 6
call fcn.005b0b60
test eax, eax
jne 0x469051
nop dword [eax]
push 3
push 1
mov ecx, edi
call fcn.0043d720
test eax, eax
jne 0x46955b
push 6
lea ecx, [ebp - 0x74]
call fcn.005b0b60
test eax, eax
je 0x469030
push 5
lea ecx, [ebp - 0x74]
call fcn.005b0b60
test eax, eax
jne 0x46955b
push 4
lea ecx, [ebp - 0x74]
call fcn.005b0b60
cmp eax, 3
jne 0x46955b
push 0x1b5
push ecx
push 2
lea ecx, [ebp - 0x74]
call fcn.005b0b60
push eax
lea ecx, [ebp - 0x74]
call fcn.005b0b50
push eax
lea ecx, [ebp - 0x20]
call fcn.005d9f40
lea edx, [ebp - 0x20]
push ecx
mov ecx, edx
call fcn.00477530
test eax, eax
je 0x46955b
push 9
push 1
push 1
push 1
push 0x6dc684
lea ecx, [ebp - 0x20]
call fcn.005daa70
test eax, eax
je 0x46955b
push 1
push 0x637f9c
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005d9070
lea ecx, [ebp - 0x3c]
call fcn.005d9210
cmp eax, 5
jbe 0x46955b
push 2
call fcn.005d9220
push eax
mov ecx, esi
call fcn.005dc4c0
test al, al
je 0x46955b
push 0
push 0
push 5
lea ecx, [ebp - 0x3c]
call fcn.005d9220
push eax
push 0x637f9c
push 4
call fcn.005d9220
push eax
push 0x637f9c
push 3
call fcn.005d9220
push eax
push 0x637f9c
push 2
call fcn.005d9220
push eax
push 0x637f9c
push 1
call fcn.005d9220
push eax
push str.BrandOEM
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea edx, [ebp - 0x20]
push 0xfde9
mov ecx, edx
call fcn.00477490
push 0
lea ecx, [ebp - 0x20]
call fcn.005dc190
push eax
push 1
push str.BrandOEMData
lea ecx, [ebp - 0x24]
call fcn.005d5f20
lea ecx, [ebp - 0x74]
call fcn.005b0bc0
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 4
call fcn.005dc430
push 1
lea ecx, [ebp - 0x3c]
call fcn.005d9220
push eax
lea ecx, [edi + 0x108]
call fcn.005dc510
push 2
lea ecx, [ebp - 0x3c]
call fcn.005d9220
push eax
mov ecx, esi
call fcn.005dc510
or dword [edi + 0x13dc], 2
lea ecx, [ebp - 0x3c]
push 3
call fcn.005d9220
push eax
lea ecx, [edi + 0x120]
call fcn.005dc510
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._Repair_Tool
push 1
lea ecx, [ebp - 0x3c]
call fcn.005d9220
push eax
lea ecx, [edi + 0x143c]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 4
lea ecx, [ebp - 0x3c]
call fcn.005d9220
push eax
push 0x624284
lea ecx, [edi + 0x150]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc200
push 5
lea ecx, [ebp - 0x3c]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
call fcn.004695d0
mov byte [ebp - 0x75], al
test al, al
je 0x469273
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [edi + 0x12c]
call fcn.005dc4e0
jmp 0x46942a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 4
lea ecx, [ebp - 0x3c]
call fcn.005d9220
push eax
push 0x624284
lea ecx, [edi + 0x174]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x70]
call fcn.005dc200
push 5
lea ecx, [ebp - 0x3c]
call fcn.005d9220
push eax
lea ecx, [ebp - 0x70]
call fcn.005dc190
push eax
call fcn.004695d0
test al, al
je 0x4692f8
push 0
lea ecx, [ebp - 0x48]
mov byte [ebp - 0x75], 2
call fcn.005dc190
push eax
lea ecx, [ebp - 0x70]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [edi + 0x12c]
call fcn.005dc4e0
jmp 0x46942a
sub esp, 8
mov dword [ebp - 0x4c], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x3c]
movq qword [ebp - 0x54], xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push 4
call fcn.005d9220
push eax
push 0x6287bc
mov ecx, esi
call fcn.005dc190
push eax
push str.users_
lea ecx, [ebp - 0x54]
call fcn.005dc520
lea edx, [ebp - 0x54]
mov byte [ebp - 4], 7
push 0xfde9
mov ecx, edx
call fcn.00477490
test eax, eax
jne 0x469368
mov esi, dword [edi + 0x13dc]
lea ecx, [ebp - 0x54]
call fcn.005dc430
or esi, 0x40
jmp 0x469571
sub esp, 0xc
lea ecx, [ebp - 0x54]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.https:__www.carifred.com_uvk_custom_label_download.php_file
call fcn.005da510
push 0
push 0
push 0
push ecx
push 2
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x74], 0
call fcn.005dc190
xor edx, edx
mov ecx, eax
call fcn.005b40e0
push eax
lea ecx, [ebp - 0x74]
call fcn.005b0bd0
push 6
mov byte [ebp - 4], 8
call fcn.005b0b60
test eax, eax
jne 0x4693e2
push 3
push 1
mov ecx, edi
call fcn.0043d720
test eax, eax
jne 0x469540
push 6
lea ecx, [ebp - 0x74]
call fcn.005b0b60
test eax, eax
je 0x4693c1
push 5
lea ecx, [ebp - 0x74]
call fcn.005b0b60
test eax, eax
jne 0x469540
push 4
lea ecx, [ebp - 0x74]
call fcn.005b0b60
cmp eax, 3
jb 0x469540
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [edi + 0x12c]
call fcn.005dc4e0
lea ecx, [ebp - 0x74]
mov byte [ebp - 0x75], 3
call fcn.005b0bc0
lea ecx, [ebp - 0x54]
call fcn.005dc430
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
mov dword [ebp - 0x74], esi
mov byte [ebp - 4], 9
test esi, esi
je 0x469473
xorps xmm0, xmm0
lea ecx, [edi + 0x12c]
movups xmmword [esi], xmm0
call fcn.005dc190
lea ecx, [ebp - 0x74]
mov dword [esi], vtable.Gdiplus::Bitmap.0
push ecx
push eax
mov dword [ebp - 0x74], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromFile]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x74]
mov dword [esi + 4], eax
jmp 0x469475
xor esi, esi
push esi
lea ecx, [edi + 0xfc]
mov byte [ebp - 4], 4
call fcn.004037c0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6c9ea4
lea ecx, [edi + 0x150]
call fcn.005dc190
push eax
lea ecx, [edi + 0x146c]
call fcn.005dc200
cmp byte [ebp - 0x75], 1
jne 0x4694dc
lea ecx, [edi + 0x146c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4694dc
mov esi, dword [edi + 0x13dc]
jmp 0x469571
push 2
lea ecx, [edi + 0x146c]
call fcn.005dc190
push eax
call fcn.005771e0
movaps xmm0, xmmword [0x6edd80]
lea eax, [ebp - 0x60]
push ecx
push eax
lea ecx, [edi + 0x146c]
mov dword [ebp - 0x50], 0x100
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x4c], 0
call fcn.005dc190
lea ecx, [edi + 0x12c]
mov esi, eax
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0058c760
mov esi, dword [edi + 0x13dc]
test al, al
jne 0x469571
or esi, 0x80
jmp 0x469571
mov esi, dword [edi + 0x13dc]
lea ecx, [ebp - 0x74]
call fcn.005b0bc0
lea ecx, [ebp - 0x54]
call fcn.005dc430
or esi, 0x40
jmp 0x469571
mov esi, dword [edi + 0x13dc]
lea ecx, [ebp - 0x74]
call fcn.005b0bc0
lea ecx, [ebp - 0x54]
call fcn.005dc430
lea ecx, [ebp - 0x3c]
call fcn.005d9280
lea ecx, [ebp - 0x70]
call fcn.005dc430
lea ecx, [ebp - 0x48]
call fcn.005dc430
lea ecx, [ebp - 0x20]
call fcn.005dc430
jmp 0x469599
mov esi, dword [edi + 0x13dc]
lea ecx, [ebp - 0x24]
call fcn.005d69e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret