Function at 0x412170
Capabilities:
Check if file exists
Copy file
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4129d6
mov eax, dword fs:[0]
push eax
sub esp, 0x308
mov eax, dword [0x41a288]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
mov dword [ebp - 0x2dc], eax
mov dword [ebp - 0x2d8], 0
call dword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x4121ec
call fcn.004025ce
add eax, 0x20
push eax
push 0x418590
lea eax, [ebp - 0x2d8]
push 0x418594
push eax
call fcn.00402e79
push 0x418598
call fcn.004026aa
add esp, 0x14
mov ebx, dword [0x41b490]
dec ebx
mov dword [ebp - 0x2c4], ebx
je 0x412923
push 0x30
lea eax, [ebp - 0x30c]
push 0
push eax
call fcn.00409f00
xor ecx, ecx
mov dword [ebp - 0x2e4], ebx
mov eax, ebx
mov dword [ebp - 4], 0
mov edx, 0x18
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00401ebb
add esp, 0x10
mov dword [ebp - 0x2e0], eax
lea ecx, [ebx + ebx*2]
shl ecx, 3
push ecx
push 0
push eax
call fcn.00409f00
xor ecx, ecx
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x2d0], ebx
add esp, 0xc
mov dword [ebp - 0x2cc], edi
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 0x2c8], ecx
mov dword [ebp - 4], 2
xor esi, esi
mov dword [ebp - 0x2b8], esi
cmp esi, dword [ebp - 0x2c4]
jge 0x412744
mov eax, dword [ebp - 0x2e0]
lea ecx, [esi + esi*2]
shl ecx, 3
push 0x104
mov dword [ebp - 0x2bc], ecx
mov byte [ebp - 4], 3
mov dword [ecx + eax + 8], 0xffffffff
call fcn.00401ebb
mov ecx, dword [ebp - 0x2e0]
add esp, 4
mov edx, dword [ebp - 0x2bc]
mov dword [ebp - 4], 2
push 0
mov dword [edx + ecx + 0xc], eax
mov eax, dword [ebp - 0x2e0]
push 0x418548
push 0x104
push dword [edx + eax + 0xc]
mov eax, dword [0x41b498]
push 0xffffffffffffffff
push dword [eax + esi*4 + 4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [ebp - 0x2bc]
push dword [ecx + eax + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41232d
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [ebp - 0x2bc]
push dword [ecx + eax + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x412711
mov eax, dword [0x41b498]
push dword [eax + esi*4 + 4]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push 0x208
mov dword [ebp - 0x2d4], eax
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.00409f00
add esp, 0xc
xor esi, esi
lea ebx, [ebx]
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41859c
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
lea eax, [ebp - 0x21c]
push eax
push 0x4185a4
push 0x104
push eax
call fcn.00401ed3
add esp, 0x14
lea eax, [ebp - 0x21c]
push dword [ebp - 0x2d4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4123cc
inc esi
cmp esi, 0x3e7
jl 0x412360
mov ecx, dword [ebp - 0x2b8]
lea eax, [ebp - 0x21c]
push 0
push eax
mov eax, dword [0x41b498]
push dword [eax + ecx*4 + 4]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
xor eax, eax
mov dword [ebp - 0x2a0], 7
mov dword [ebp - 0x2a4], 0
mov word [ebp - 0x2b4], ax
cmp word [ebp - 0x21c], ax
jne 0x412414
xor ecx, ecx
jmp 0x41242f
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412420
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.004015c0
lea eax, [ebp - 0x2b4]
mov byte [ebp - 4], 5
cmp eax, edi
jae 0x412589
cmp ebx, eax
ja 0x412589
mov ecx, eax
mov eax, 0x2aaaaaab
sub ecx, ebx
imul ecx
mov ecx, dword [ebp - 0x2c0]
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, ecx
jne 0x41251f
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jae 0x41251f
sub edi, ebx
mov eax, 0x2aaaaaab
imul edi
mov eax, 0xaaaaaaa
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
cmp eax, 1
jae 0x4124c4
push str.vector_T__too_long
call fcn.00401e5f
lea edi, [ecx + 1]
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x2c0]
sub ecx, ebx
imul ecx
mov eax, 0xaaaaaaa
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, ecx
shr edx, 1
sub eax, edx
cmp eax, ecx
jae 0x4124f3
xor ecx, ecx
jmp 0x4124f5
add ecx, edx
cmp ecx, edi
jae 0x4124fb
mov ecx, edi
push ecx
lea ecx, [ebp - 0x2d0]
call fcn.00401700
mov ecx, dword [ebp - 0x2c8]
mov edi, dword [ebp - 0x2cc]
mov ebx, dword [ebp - 0x2d0]
mov dword [ebp - 0x2c0], ecx
lea eax, [esi + esi*2]
lea esi, [ebx + eax*8]
test edi, edi
je 0x4126b8
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp dword [esi + 0x14], 8
jae 0x41255b
mov eax, dword [esi + 0x10]
inc eax
je 0x412565
add eax, eax
push eax
push esi
push edi
call fcn.00401ef0
add esp, 0xc
jmp 0x412565
mov eax, dword [esi]
mov dword [edi], eax
mov dword [esi], 0
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
jmp 0x4126b8
mov eax, dword [ebp - 0x2c0]
cmp edi, eax
jne 0x412639
mov ecx, eax
mov eax, 0x2aaaaaab
sub ecx, edi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jae 0x412639
sub edi, ebx
mov eax, 0x2aaaaaab
imul edi
mov eax, 0xaaaaaaa
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
cmp eax, 1
jae 0x4125de
push str.vector_T__too_long
call fcn.00401e5f
lea esi, [ecx + 1]
mov eax, 0x2aaaaaab
mov ecx, dword [ebp - 0x2c0]
sub ecx, ebx
imul ecx
mov eax, 0xaaaaaaa
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, ecx
shr edx, 1
sub eax, edx
cmp eax, ecx
jae 0x41260d
xor ecx, ecx
jmp 0x41260f
add ecx, edx
cmp ecx, esi
jae 0x412615
mov ecx, esi
push ecx
lea ecx, [ebp - 0x2d0]
call fcn.00401700
mov ecx, dword [ebp - 0x2c8]
mov edi, dword [ebp - 0x2cc]
mov ebx, dword [ebp - 0x2d0]
mov dword [ebp - 0x2c0], ecx
test edi, edi
je 0x4126b8
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp dword [ebp - 0x2a0], 8
jae 0x412677
mov eax, dword [ebp - 0x2a4]
inc eax
je 0x412689
add eax, eax
push eax
lea eax, [ebp - 0x2b4]
push eax
push edi
call fcn.00401ef0
add esp, 0xc
jmp 0x412689
mov eax, dword [ebp - 0x2b4]
mov dword [edi], eax
mov dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x2a4]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x2a0]
mov dword [edi + 0x14], eax
xor eax, eax
mov dword [ebp - 0x2a0], 7
mov dword [ebp - 0x2a4], 0
mov word [ebp - 0x2b4], ax
add edi, 0x18
mov byte [ebp - 4], 2
cmp dword [ebp - 0x2a0], 8
mov dword [ebp - 0x2cc], edi
jb 0x4126dc
push dword [ebp - 0x2b4]
call fcn.004028c0
add esp, 4
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [ebp - 0x2bc]
push 0
push 0x418548
push 0x104
push dword [ecx + eax + 0xc]
lea eax, [ebp - 0x21c]
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, dword [ebp - 0x2b8]
inc esi
jmp 0x412276
mov ebx, dword [ebp - 0x2c4]
push str.mapi32.dll
mov dword [ebp - 0x2b8], 0xff
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41278f
push str.MAPISendMail
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 9
lea ecx, [ebp - 0x30c]
push ecx
push 0
push 0
call eax
push esi
mov dword [ebp - 0x2b8], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jle 0x4127fd
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x2bc], 0
mov esi, dword [ebp - 0x2d0]
cmp esi, edi
je 0x4127c6
lea ecx, [ecx]
cmp dword [esi + 0x14], 8
jb 0x4127ba
mov eax, dword [esi]
jmp 0x4127bc
mov eax, esi
push eax
call ebx
add esi, 0x18
cmp esi, edi
jne 0x4127b0
mov eax, dword [ebp - 0x2e0]
mov esi, dword [ebp - 0x2bc]
push dword [esi + eax + 0xc]
call fcn.00402899
mov eax, dword [ebp - 0x2e0]
add esp, 4
mov dword [esi + eax + 0xc], 0
add esi, 0x18
dec dword [ebp - 0x2c4]
mov dword [ebp - 0x2bc], esi
jne 0x4127a3
push dword [ebp - 0x2e0]
call fcn.00402899
push 0
mov dword [ebp - 0x2e0], 0
call fcn.00402899
add esp, 8
mov dword [ebp - 0x2e0], 0
cmp dword [ebp - 0x2b8], 0
je 0x4128c8
push 0x104
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x2dc]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.SCANUTILITY.exe
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebp - 0x2b8]
or bl, 0xff
cmp eax, 0xff
jg 0x41287c
mov bl, al
push 0x80
lea eax, [ebp - 0x29c]
push 0
push eax
call fcn.00409f00
movzx eax, bl
push eax
push str._oerror000E7D_02x
lea eax, [ebp - 0x29c]
push 0x40
push eax
call fcn.00401ed3
add esp, 0x1c
lea eax, [ebp - 0x29c]
push 5
push 0
push eax
lea eax, [ebp - 0x21c]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x2d8]
test eax, eax
je 0x4128db
push eax
call fcn.00402d2f
add esp, 4
mov ebx, dword [ebp - 0x2d0]
test ebx, ebx
je 0x412923
mov esi, ebx
cmp ebx, edi
je 0x41291a
jmp 0x4128f0
cmp dword [esi + 0x14], 8
jb 0x412900
push dword [esi]
call fcn.004028c0
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
add esi, 0x18
cmp esi, edi
jne 0x4128f0
push ebx
call fcn.004028c0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00401ec4
mov esp, ebp
pop ebp
ret 0x10