Function at 0x44ab40
Capabilities:
Copy file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5d49bd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x16c
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edi
call fcn.005c006c
mov ecx, dword [eax + 4]
call fcn.0059cc63
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x70]
push eax
mov dword [esp + 0x184], edi
call fcn.00495af0
mov esi, dword [eax]
mov ebx, 0x5ecde8
lea ecx, [esp + 0x48]
mov dword [esp + 0x3c], 0x5ecdf0
mov dword [esp + 0x40], ebx
call fcn.004018e0
mov dword [esp + 0x10], 1
push edi
lea ecx, [esp + 0x40]
mov byte [esp + 0x184], 2
call fcn.00401950
push edi
lea ecx, [esp + 0x44]
mov dword [esp + 0x184], 3
call fcn.00401a40
mov ecx, dword [esp + 0x3c]
mov edi, 0x5ecdd4
push esi
mov byte [esp + 0x184], 4
mov edx, dword [ecx + 4]
mov dword [esp + edx + 0x40], edi
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 4]
lea ecx, [eax - 0xc]
mov dword [esp + eax + 0x3c], ecx
mov edx, dword [esp + 0x40]
mov eax, dword [edx + 4]
lea ecx, [esp + eax + 0x40]
call fcn.0048f9c0
lea ecx, [esp + 0x6c]
mov byte [esp + 0x180], 6
call fcn.0059d7fd
mov ecx, dword [esp + 0x3c]
push str.Msxml3
mov edx, dword [ecx + 4]
lea ecx, [esp + edx + 0x40]
call fcn.0048fc00
mov eax, dword [esp + 0x3c]
push str.msxml3a.dll
mov ecx, dword [eax + 4]
lea ecx, [esp + ecx + 0x40]
call fcn.0048fb10
lea edx, [esp + 0x74]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], 0x5ecdf0
mov dword [esp + 0x18], ebx
call fcn.004018e0
mov dword [esp + 0x10], 3
push 0
lea ecx, [esp + 0x18]
mov byte [esp + 0x184], 7
call fcn.00401950
push 0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x184], 8
call fcn.00401a40
mov eax, dword [esp + 0x14]
mov byte [esp + 0x180], 9
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x14], edi
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 4]
lea edx, [esp + 0x74]
push edx
lea ecx, [eax - 0xc]
mov dword [esp + eax + 0x14], ecx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 4]
lea ecx, [esp + ecx + 0x18]
call fcn.0048f9c0
mov edx, dword [esp + 0x14]
push str.msxml3a.dll
mov byte [esp + 0x184], 0xa
mov eax, dword [edx + 4]
lea ecx, [esp + eax + 0x18]
call fcn.0048fb10
mov ecx, dword [0x677e28]
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
mov byte [esp + 0x184], 0xb
mov ecx, dword [eax + 4]
lea ecx, [esp + ecx + 0x18]
call fcn.0048fe30
lea ecx, [esp + 0x10]
call fcn.0059d7fd
mov edx, dword [esp + 0x14]
push 0
mov eax, dword [edx + 4]
mov eax, dword [esp + eax + 0x1c]
push eax
call fcn.0055b320
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 8
test eax, eax
je 0x44ad98
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
mov eax, dword [edx + 4]
lea ecx, [esp + eax + 0x18]
call fcn.0048fe30
lea ecx, [esp + 0x10]
call fcn.0059d7fd
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
mov edx, dword [ecx + 4]
mov ecx, dword [esp + 0x40]
mov esi, dword [esp + edx + 0x1c]
mov edx, dword [ecx + 4]
lea ecx, [esp + edx + 0x40]
call fcn.0048fe30
lea ecx, [esp + 0xc]
call fcn.0059d7fd
mov eax, dword [esp + 0x3c]
push 0
push esi
mov ecx, dword [eax + 4]
mov eax, dword [esp + ecx + 0x48]
push eax
call ebx
mov esi, eax
jmp 0x44ad9d
mov esi, 1
mov edx, dword [esp + 0x3c]
push str.msxml3r.dll
mov eax, dword [edx + 4]
lea ecx, [esp + eax + 0x40]
call fcn.0048fc00
mov ecx, dword [esp + 0x14]
push str.msxml3r.dll
mov edx, dword [ecx + 4]
lea ecx, [esp + edx + 0x18]
call fcn.0048fc00
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
mov edx, dword [ecx + 4]
lea ecx, [esp + edx + 0x18]
call fcn.0048fe30
lea ecx, [esp + 0xc]
call fcn.0059d7fd
mov eax, dword [esp + 0x14]
push 0
mov ecx, dword [eax + 4]
mov eax, dword [esp + ecx + 0x1c]
push eax
call fcn.0055b320
add esp, 8
test eax, eax
je 0x44ae5b
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
mov ecx, dword [eax + 4]
lea ecx, [esp + ecx + 0x18]
call fcn.0048fe30
lea ecx, [esp + 0xc]
call fcn.0059d7fd
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
mov eax, dword [edx + 4]
mov edx, dword [esp + 0x40]
mov edi, dword [esp + eax + 0x1c]
mov eax, dword [edx + 4]
lea ecx, [esp + eax + 0x40]
call fcn.0048fe30
lea ecx, [esp + 0x10]
call fcn.0059d7fd
mov ecx, dword [esp + 0x3c]
push 0
push edi
mov edx, dword [ecx + 4]
mov eax, dword [esp + edx + 0x48]
push eax
call ebx
and esi, eax
jmp 0x44ae5e
and esi, 1
mov eax, dword [esp + 0x3c]
push str.msxml3.dll
mov ecx, dword [eax + 4]
lea ecx, [esp + ecx + 0x40]
call fcn.0048fc00
mov edx, dword [esp + 0x14]
push str.msxml3.dll
mov eax, dword [edx + 4]
lea ecx, [esp + eax + 0x18]
call fcn.0048fc00
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
mov eax, dword [edx + 4]
lea ecx, [esp + eax + 0x18]
call fcn.0048fe30
lea ecx, [esp + 0xc]
call fcn.0059d7fd
mov ecx, dword [esp + 0x14]
push 0
mov edx, dword [ecx + 4]
mov eax, dword [esp + edx + 0x1c]
push eax
call fcn.0055b320
add esp, 8
test eax, eax
je 0x44af1c
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
mov edx, dword [ecx + 4]
lea ecx, [esp + edx + 0x18]
call fcn.0048fe30
lea ecx, [esp + 0xc]
call fcn.0059d7fd
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x68]
push edx
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x40]
mov edi, dword [esp + ecx + 0x1c]
mov ecx, dword [eax + 4]
lea ecx, [esp + ecx + 0x40]
call fcn.0048fe30
lea ecx, [esp + 0x68]
call fcn.0059d7fd
mov edx, dword [esp + 0x3c]
push 0
push edi
mov eax, dword [edx + 4]
mov eax, dword [esp + eax + 0x48]
push eax
call ebx
and esi, eax
jmp 0x44af1f
and esi, 1
test esi, esi
mov edi, 1
je 0x44af63
lea ecx, [esp + 0x14]
call fcn.00403630
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.DllRegisterServer
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
jne 0x44af65
mov ecx, dword [str.The_Microsoft_XML_Parser_3.0_was_successfully_installed]
push edi
push edi
push ecx
call fcn.005ab679
test edi, edi
lea ecx, [esp + 0x64]
mov byte [esp + 0x180], 0xa
sete bl
call fcn.0059d7fd
lea ecx, [esp + 0x14]
mov byte [esp + 0x180], 6
call fcn.00401b70
lea ecx, [esp + 0x3c]
mov byte [esp + 0x180], 0
call fcn.00401b70
mov dword [esp + 0x180], 0xffffffff
call fcn.005c006c
mov ecx, dword [eax + 4]
call fcn.0059cc78
mov ecx, dword [esp + 0x178]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x178
ret