rep movsb is like memcpy

When looking at assembly and you see

rep movsb

It can be thought of as a string or memory copy.
It's copying from whatever is as register ESI to register EDI
ESI = the existing malicious code to copy
EDI = the empty virtually allocated memory to copy the malicious code to