Function at 0x41b78d
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8210
call fcn.0042f4a0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push 8
mov esi, str.iERtUtil.dll.mui
pop ecx
lea edi, [ebp - 0x4318]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x79
xor eax, eax
pop ecx
lea edi, [ebp - 0x42f6]
rep stosd dword es:[edi], eax
push 6
mov esi, str.vbscript.dll
stosw word es:[edi], ax
pop edx
lea edi, [ebp - 0x4110]
mov ecx, edx
push 0x7b
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x40f6]
push 8
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
mov esi, str.vbscript.dll.mui
lea edi, [ebp - 0x3f08]
push 0x79
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x3ee6]
mov esi, str.ieframe.dll
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
lea edi, [ebp - 0x3d00]
push 0x7c
xor eax, eax
rep movsd dword es:[edi], dword [esi]
pop ebx
lea edi, [ebp - 0x3ce8]
mov ecx, ebx
push 8
rep stosd dword es:[edi], eax
pop ecx
mov esi, str.ieframe.dll.mui
lea edi, [ebp - 0x3af8]
push 0x7a
rep movsd dword es:[edi], dword [esi]
pop ecx
lea edi, [ebp - 0x3ad8]
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, str.iertutil.dll
lea edi, [ebp - 0x38f0]
push 0x7b
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
lea edi, [ebp - 0x38d6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, str.ieui.dll
lea edi, [ebp - 0x36e8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], 1
push 0x7d
movsw word es:[edi], word [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x36d6]
mov esi, str.ieui.dll.mui
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
lea edi, [ebp - 0x34e0]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7b
xor eax, eax
pop ecx
lea edi, [ebp - 0x34c6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
mov esi, str.shdoclc.dll
lea edi, [ebp - 0x32d8]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edi, [ebp - 0x32c0]
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, str.shdocvw.dll
lea edi, [ebp - 0x30d0]
push 8
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edi, [ebp - 0x30b8]
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, str.shlwapi.dll
lea edi, [ebp - 0x2ec8]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edi, [ebp - 0x2eb0]
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, str.wininet.dll
lea edi, [ebp - 0x2cc0]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edi, [ebp - 0x2ca8]
rep stosd dword es:[edi], eax
pop ecx
mov esi, str.wininet.dll.mui
lea edi, [ebp - 0x2ab8]
push 0x7a
rep movsd dword es:[edi], dword [esi]
pop ecx
lea edi, [ebp - 0x2a98]
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, str.imgutil.dll
lea edi, [ebp - 0x28b0]
push 8
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edi, [ebp - 0x2898]
rep stosd dword es:[edi], eax
pop ecx
mov esi, str.inetcpl.cpl.mui
lea edi, [ebp - 0x26a8]
push 0x7a
rep movsd dword es:[edi], dword [esi]
pop ecx
lea edi, [ebp - 0x2688]
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, str.pngfilt.dll
lea edi, [ebp - 0x24a0]
push 5
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edi, [ebp - 0x2488]
rep stosd dword es:[edi], eax
pop ecx
mov esi, str.urlmon.dll
lea edi, [ebp - 0x2298]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, ebx
lea edi, [ebp - 0x2282]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 7
mov esi, str.urlmon.dll.mui
pop ecx
lea edi, [ebp - 0x2090]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7a
xor eax, eax
pop ecx
lea edi, [ebp - 0x2072]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
mov esi, str.jscript.dll
lea edi, [ebp - 0x1e88]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edi, [ebp - 0x1e70]
rep stosd dword es:[edi], eax
push 5
mov esi, str.mshtml.dll
pop ecx
lea edi, [ebp - 0x1c80]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, ebx
lea edi, [ebp - 0x1c6a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 7
mov esi, str.mshtml.dll.mui
pop ecx
lea edi, [ebp - 0x1a78]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7a
xor eax, eax
pop ecx
lea edi, [ebp - 0x1a5a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 5
mov esi, str.mshtml.tlb
pop ecx
lea edi, [ebp - 0x1870]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x185a]
mov esi, str.mshtmled.dll
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
lea edi, [ebp - 0x1668]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7b
xor eax, eax
pop ecx
lea edi, [ebp - 0x164e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
mov esi, str.mshtmled.dll.mui
pop ecx
lea edi, [ebp - 0x1460]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x79
xor eax, eax
pop ecx
lea edi, [ebp - 0x143e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
mov esi, str.mshtmler.dll
lea edi, [ebp - 0x1258]
push 0x7b
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x123e]
push 8
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
mov esi, str.mshtmler.dll.mui
lea edi, [ebp - 0x1050]
push 0x79
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x102e]
mov esi, str.msrating.dll
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
lea edi, [ebp - 0xe48]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7b
xor eax, eax
pop ecx
lea edi, [ebp - 0xe2e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
mov esi, str.msrating.dll.mui
pop ecx
lea edi, [ebp - 0xc40]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x79
xor eax, eax
pop ecx
lea edi, [ebp - 0xc1e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
mov esi, str.dxtmsft.dll
lea edi, [ebp - 0xa38]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edi, [ebp - 0xa20]
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, str.dxtrans.dll
lea edi, [ebp - 0x830]
push 0x7b
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edi, [ebp - 0x818]
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, str.normaliz.dll
lea edi, [ebp - 0x628]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
lea edi, [ebp - 0x60e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
mov esi, str.8ERtUtil.dll.mui
pop ecx
lea edi, [ebp - 0x8210]
rep movsd dword es:[edi], dword [esi]
push 0x79
xor eax, eax
movsw word es:[edi], word [esi]
pop ecx
lea edi, [ebp - 0x81ee]
mov esi, str.8bscript.dll
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
lea edi, [ebp - 0x8008]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7b
xor eax, eax
pop ecx
lea edi, [ebp - 0x7fee]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
mov esi, str.8bscript.dll.mui
pop ecx
lea edi, [ebp - 0x7e00]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x79
xor eax, eax
pop ecx
lea edi, [ebp - 0x7dde]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
mov esi, str.8eframe.dll
lea edi, [ebp - 0x7bf8]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edi, [ebp - 0x7be0]
rep stosd dword es:[edi], eax
push 8
mov esi, str.8eframe.dll.mui
pop ecx
lea edi, [ebp - 0x79f0]
rep movsd dword es:[edi], dword [esi]
push 0x7a
lea edi, [ebp - 0x79d0]
pop ecx
mov esi, str.8ertutil.dll
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x77e8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7b
lea edi, [ebp - 0x77ce]
pop ecx
mov esi, str.8eui.dll
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edi, [ebp - 0x75e0]
push 0x7d
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x75ce]
mov esi, str.8eui.dll.mui
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
lea edi, [ebp - 0x73d8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7b
xor eax, eax
pop ecx
lea edi, [ebp - 0x73be]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
mov esi, str.8hdoclc.dll
lea edi, [ebp - 0x71d0]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x71b8]
mov esi, str.8hdocvw.dll
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x6fc8]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edi, [ebp - 0x6fb0]
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, str.8hlwapi.dll
lea edi, [ebp - 0x6dc0]
push 8
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edi, [ebp - 0x6da8]
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, str.8ininet.dll
lea edi, [ebp - 0x6bb8]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edi, [ebp - 0x6ba0]
rep stosd dword es:[edi], eax
pop ecx
mov esi, str.8ininet.dll.mui
lea edi, [ebp - 0x69b0]
push 0x7a
rep movsd dword es:[edi], dword [esi]
pop ecx
lea edi, [ebp - 0x6990]
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, str.8mgutil.dll
lea edi, [ebp - 0x67a8]
push 8
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edi, [ebp - 0x6790]
rep stosd dword es:[edi], eax
pop ecx
mov esi, str.8netcpl.cpl.mui
lea edi, [ebp - 0x65a0]
push 0x7a
rep movsd dword es:[edi], dword [esi]
pop ecx
lea edi, [ebp - 0x6580]
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, str.8ngfilt.dll
lea edi, [ebp - 0x6398]
push 5
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edi, [ebp - 0x6380]
rep stosd dword es:[edi], eax
pop ecx
mov esi, str.8rlmon.dll
lea edi, [ebp - 0x6190]
push 7
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, ebx
lea edi, [ebp - 0x617a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
mov esi, str.8rlmon.dll.mui
lea edi, [ebp - 0x5f88]
push 0x7a
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x5f6a]
mov esi, str.8script.dll
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
lea edi, [ebp - 0x5d80]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edi, [ebp - 0x5d68]
rep stosd dword es:[edi], eax
push 5
mov esi, str.8shtml.dll
pop ecx
lea edi, [ebp - 0x5b78]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, ebx
lea edi, [ebp - 0x5b62]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 7
mov esi, str.8shtml.dll.mui
pop ecx
lea edi, [ebp - 0x5970]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7a
xor eax, eax
pop ecx
lea edi, [ebp - 0x5952]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 5
mov esi, str.8shtml.tlb
pop ecx
lea edi, [ebp - 0x5768]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x5752]
mov esi, str.8shtmled.dll
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
lea edi, [ebp - 0x5560]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7b
xor eax, eax
pop ecx
lea edi, [ebp - 0x5546]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
mov esi, str.8shtmled.dll.mui
pop ecx
lea edi, [ebp - 0x5358]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x79
xor eax, eax
pop ecx
lea edi, [ebp - 0x5336]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
mov esi, str.8shtmler.dll
lea edi, [ebp - 0x5150]
push 0x7b
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x5136]
push 8
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
mov esi, str.8shtmler.dll.mui
lea edi, [ebp - 0x4f48]
push 0x79
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x4f26]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
mov esi, str.8srating.dll
lea edi, [ebp - 0x4d40]
push 0x7b
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x4d26]
push 8
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
mov esi, str.8srating.dll.mui
lea edi, [ebp - 0x4b38]
push 0x79
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x4b16]
mov esi, str.8xtmsft.dll
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
lea edi, [ebp - 0x4930]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x4918]
mov esi, str.8xtrans.dll
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x4728]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edi, [ebp - 0x4710]
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, str.normaliz.dll
lea edi, [ebp - 0x4520]
push 0x7b
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp + 0xc]
pop ecx
lea edi, [ebp - 0x4506]
push dword [esi]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 8]
stosw word es:[edi], ax
call fcn.0041b5e7
test eax, eax
je 0x41bff4
and dword [ebp + 0xc], 0
mov ebx, 0x104
and word [ebp - 0x214], 0
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x212]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
lea eax, [ebp + eax - 0x4318]
push eax
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 0x214]
push 0x43bb44
push ebx
push eax
call fcn.0041b709
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41bff4
and word [ebp - 0x420], 0
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x41e]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
lea edi, [ebp + eax - 0x8210]
lea eax, [ebp - 0x420]
push edi
push dword [esi]
push 0x43bb44
push ebx
push eax
call fcn.0041b709
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push str..dll
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
jne 0x41bfb4
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.00407d56
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
jmp 0x41bfca
lea eax, [ebp - 0x420]
push 0
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x41bff4
mov eax, dword [esi]
mov ecx, dword [ebp - 8]
push edi
push eax
call fcn.0041c00a
test eax, eax
je 0x41bff4
add dword [ebp + 0xc], 0x208
cmp dword [ebp + 0xc], 0x3ef8
jb 0x41beef
jmp 0x41bff8
and dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
call fcn.0041c43d
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8