Function at 0x413ad0
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420d49
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x42e024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x423638
lea edx, [edi + 0x58]
lea ecx, [ebp - 0x40]
call fcn.00404f90
push 0x42ea70
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x88]
call fcn.00406350
push 0x423638
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa0]
call fcn.00404f40
add esp, 0xc
mov eax, dword [ebp - 0x74]
cmp eax, 0x10
jb 0x413b56
inc eax
push eax
push dword [ebp - 0x88]
call fcn.00404770
mov dword [ebp - 0x74], 0xf
mov dword [ebp - 0x78], 0
mov byte [ebp - 0x88], 0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x413b81
inc eax
push eax
push dword [ebp - 0x40]
call fcn.00404770
push str.temp_
lea edx, [ebp - 0xa0]
mov dword [ebp - 0x2c], 0xf
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
call fcn.00404f90
add esp, 4
mov byte [ebp - 4], 5
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 0x10
cmovae eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x413d84
test al, 0x10
je 0x413d84
push 0x42ea58
lea edx, [ebp - 0x58]
xor bh, bh
lea ecx, [ebp - 0x28]
xor bl, bl
call fcn.00406380
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xd0]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 0xc
test eax, eax
jne 0x413c7b
push 0x42ea58
lea edx, [ebp - 0xa0]
lea ecx, [ebp - 0x40]
call fcn.00406380
add esp, 4
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x28]
push 0
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 0x10
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp eax, 1
sete bh
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
movzx eax, bh
push eax
push str.cp_dll_32_:__d___d
push str.stealth_manager
call fcn.00402620
mov byte [ebp - 4], 6
add esp, 0x10
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x413c7b
inc eax
push eax
push dword [ebp - 0x40]
call fcn.00404770
cmp byte [edi + 0xc], 0
je 0x413d50
push 0x42eb90
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x70]
call fcn.00406380
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xd0]
cmp dword [ebp - 0x5c], 0x10
lea eax, [ebp - 0x70]
push ecx
cmovae eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 0xc
test eax, eax
jne 0x413d3e
push 0x42eb90
lea edx, [ebp - 0xa0]
lea ecx, [ebp - 0xb8]
call fcn.00406380
add esp, 4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb8]
cmp dword [ebp - 0xa4], 0x10
lea eax, [ebp - 0x70]
push 0
cmovae ecx, dword [ebp - 0xb8]
cmp dword [ebp - 0x5c], 0x10
push ecx
cmovae eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp eax, 1
sete bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
movzx eax, bl
push eax
push str.cp_dll_64_:__d___d
push str.stealth_manager
call fcn.00402620
mov eax, dword [ebp - 0xa4]
add esp, 0x10
cmp eax, 0x10
jb 0x413d3e
inc eax
push eax
push dword [ebp - 0xb8]
call fcn.00404770
mov eax, dword [ebp - 0x5c]
cmp eax, 0x10
jb 0x413d50
inc eax
push eax
push dword [ebp - 0x70]
call fcn.00404770
test bh, bh
je 0x413d5c
test bl, bl
je 0x413d5c
mov bl, 1
jmp 0x413d5e
xor bl, bl
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x413d70
inc eax
push eax
push dword [ebp - 0x28]
call fcn.00404770
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jmp 0x413d98
push str.cp_dll_no_temp
push str.stealth_manager
call fcn.00402620
add esp, 8
xor bl, bl
mov eax, dword [ebp - 0x44]
cmp eax, 0x10
jb 0x413daa
inc eax
push eax
push dword [ebp - 0x58]
call fcn.00404770
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
cmp ecx, 0x10
jb 0x413dd4
inc ecx
push ecx
push dword [ebp - 0xa0]
call fcn.00404770
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e02b
mov esp, ebp
pop ebp
ret