Function at 0x40d3e8
Capabilities:
Get common file path
Get file size
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x858
push esi
push edi
xor eax, eax
cmp dword [ebp + 0xc], 0
mov byte [ebp - 0x858], 0
mov ecx, 0xc2
lea edi, [ebp - 0x857]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, str.NULL
mov ecx, eax
je 0x40d41c
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test esi, esi
je 0x40d425
mov eax, esi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push ecx
push eax
lea eax, [ebp - 0x858]
push str.___Start_in_MoveFileOnReboot:__s_to__s___
push eax
call edi
lea eax, [ebp - 0x858]
push eax
call fcn.0040b31c
add esp, 0x14
test esi, esi
jne 0x40d455
xor eax, eax
jmp 0x40d66f
push 5
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 4], eax
call fcn.0040a676
test eax, eax
jne 0x40d66c
push ebx
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x324]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
call esi
cmp dword [ebp + 0xc], 0
je 0x40d49d
push ebx
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 0xc]
call esi
jmp 0x40d4c7
push dword [ebp + 8]
call fcn.0040d3d7
test eax, eax
pop ecx
lea eax, [ebp - 0x11c]
je 0x40d4b7
push str.DIRNUL
jmp 0x40d4bc
push 0x420c10
push 0x41e88c
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x54c]
push str._hs_hs_r_n
push eax
call edi
mov esi, str._Rename__r_n
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0x10
movsw word es:[edi], word [esi]
mov dword [ebp + 0xc], eax
push ebx
lea eax, [ebp - 0x220]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.WinInit.Ini
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor esi, esi
push esi
push 0x8000080
push 4
push esi
push esi
push 0xc0000000
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0xc], ebx
je 0x40d66b
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov eax, dword [ebp + 0xc]
push esi
lea eax, [edi + eax + 0xa]
push eax
push esi
push 4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov dword [ebp - 8], eax
je 0x40d653
push esi
push esi
push esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
cmp ebx, esi
je 0x40d647
lea eax, [ebp - 0x18]
push eax
push ebx
call fcn.00412a50
cmp eax, esi
pop ecx
pop ecx
jne 0x40d5ad
lea eax, [ebp - 0x18]
push eax
lea eax, [ebx + edi]
push 0x41e88c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
add edi, eax
mov eax, edi
jmp 0x40d5ff
mov ecx, dword [0x426e6c]
cmp ecx, esi
je 0x40d5d6
push ecx
push eax
call fcn.00412a50
push dword [0x426e6c]
mov dword [ebp + 8], eax
call fcn.004129c0
mov esi, eax
add esp, 0xc
add esi, dword [ebp + 8]
jmp 0x40d5e3
push 0xa
push eax
call fcn.00413af0
pop ecx
mov esi, eax
pop ecx
inc esi
mov eax, ebx
sub eax, esi
add eax, edi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push esi
push eax
call fcn.00413bb0
sub esi, ebx
add esp, 0xc
mov eax, esi
xor esi, esi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x54c]
push ecx
add eax, ebx
push eax
call fcn.00412190
mov eax, dword [0x426e6c]
add esp, 0xc
cmp eax, esi
je 0x40d624
push eax
call fcn.00411d89
pop ecx
lea eax, [ebp - 0x54c]
push eax
call fcn.0041cdd5
pop ecx
push ebx
mov dword [0x426e6c], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add edi, dword [ebp + 0xc]
mov dword [ebp - 4], 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0xc]
push esi
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret