Function at 0x401410
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff2a4
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, 0x443e20
call fcn.0042c210
mov edx, dword [0x46b1cc]
xor eax, eax
mov dword [ebp - 0xc58], edx
push esi
or ecx, 0xffffffff
mov edi, 0x46a8a0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0xc37]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [0x46a884], 0
pop esi
je 0x401471
inc dword [0x46b1d0]
xor eax, eax
push esi
lea edi, [ebp - 0xc37]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x430]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x46b1cc], 1
pop esi
jne 0x4014df
cmp dword [0x43c188], 4
jl 0x40154e
cmp byte [0x46a87d], 0
je 0x4014ca
mov dword [ebp - 0xc58], 6
jmp 0x40154e
cmp byte [0x46a87e], 0
je 0x40154e
mov dword [ebp - 0xc58], 7
jmp 0x40154e
mov eax, dword [0x46b1cc]
cmp eax, 4
je 0x4014ee
cmp eax, 9
jne 0x40151b
mov edx, dword [0x46a898]
xor eax, eax
push esi
mov edi, edx
or ecx, 0xffffffff
lea esi, [ebp - 0xc37]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
cmp dword [0x46b1cc], 8
jne 0x40154e
xor eax, eax
push esi
or ecx, 0xffffffff
mov edi, 0x46b1d4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x430]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov byte [0x46a87d], 0
mov byte [0x46a87e], 0
cmp ebx, 0x30d40
jl 0x40159c
xor eax, eax
mov dword [ebp - 0xc54], eax
xor eax, eax
mov edx, dword [ebx*4 + 0x375dfc]
push esi
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0xc50]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4015d0
mov dword [ebp - 0xc54], ebx
mov eax, dword [ebx*4 + 0x4392fc]
push esi
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
lea esi, [ebp - 0xc50]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov edi, esi
test esi, esi
je 0x4015e7
call fcn.00418828
push esi
call fcn.0042db24
pop ecx
call fcn.00418844
mov eax, dword [0x46b1cc]
push eax
call fcn.004013a8
pop ecx
mov dword [ebp - 0x434], eax
lea edx, [ebp - 0xc58]
push edx
push 2
call dword [0x46b5d4]
mov ebx, eax
call fcn.00418828
mov eax, ebx
dec eax
je 0x401629
dec eax
je 0x4017ec
sub eax, 9
je 0x4017b0
jmp 0x401804
push 0
mov edx, dword [0x46a898]
push edx
call fcn.0042d8f0
add esp, 8
test al, 5
je 0x401676
push 0x20
push 1
mov ecx, dword [0x46a898]
push ecx
call fcn.0042d8f0
add esp, 0xc
inc eax
jne 0x401676
call fcn.00418844
mov eax, dword [0x46a898]
push eax
push str.Cannot_Change_File_Attributes
call fcn.00418598
add esp, 8
mov ebx, 2
jmp 0x401804
test edi, edi
je 0x401804
test byte [ebp + 0x10], 1
je 0x401804
push 0x4439de
mov eax, dword [0x46a898]
push eax
call fcn.0042dfd0
add esp, 8
mov esi, eax
test eax, eax
jne 0x4017a7
push 2
push 0x4439e2
mov edx, dword [0x46a898]
push edx
call fcn.0042be6c
add esp, 0xc
test eax, eax
je 0x401783
mov ecx, dword [0x46a898]
xor eax, eax
mov edi, ecx
push esi
or ecx, 0xffffffff
lea esi, [ebp - 0xd5c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0xd5c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push str..sc
push eax
call fcn.0042bd64
add esp, 8
push 0
lea edx, [ebp - 0xd5c]
push edx
mov ecx, dword [0x46a898]
push ecx
call sub.KERNEL32.DLL_CopyFileA
test eax, eax
je 0x401783
lea eax, [ebp - 0xd5c]
push eax
mov edx, dword [0x46a898]
push edx
call fcn.00417790
add esp, 8
lea edx, [ebp - 0xd5c]
lea eax, [ebp - 4]
push 0x4439ea
mov word [ebp - 0x18], 8
call fcn.0043862c
inc dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00422350
test al, al
je 0x401762
lea edx, [ebp - 0xd5c]
jmp 0x401768
mov edx, dword [0x46a898]
push edx
call fcn.0042dfd0
add esp, 8
mov esi, eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004386a0
call fcn.00418844
test esi, esi
jne 0x4017a7
mov ecx, dword [0x46a898]
push ecx
push str.Cannot_Open_File_to_Remove_Virus._You_might_need_to_scan_this_file_in_DOS_Safe_mode.
call fcn.00418598
add esp, 8
mov ebx, 2
jmp 0x401804
mov byte [0x46a880], 1
jmp 0x401804
mov byte [0x46a885], 1
cmp byte [0x46a881], 0
je 0x4017cc
push 0
push 0xd
call dword [0x46b5d4]
jmp 0x401804
push 0
mov eax, dword [0x46a898]
push eax
call fcn.00417790
add esp, 8
test eax, eax
je 0x401804
push 0
push 0xd
call dword [0x46b5d4]
jmp 0x401804
test edi, edi
je 0x401804
push 0x443a43
mov edx, dword [0x46a898]
push edx
call fcn.0042dfd0
add esp, 8
call fcn.00418844
mov eax, ebx
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret