Function at 0x445c70
Capabilities:
Copy file
Delete file
Get common file path
Manipulate boot configuration
Set file attributes

Disassembly:
sub esp, 0x700
lea eax, [esp + 0x300]
push esi
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x484]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x304]
lea eax, [esp + 0x604]
push edx
push str._sdllcache
push eax
call fcn.004f175f
lea ecx, [esp + 0x310]
lea edx, [esp + 0x210]
push ecx
push str._sdllcache_bk
push edx
call fcn.004f175f
lea eax, [esp + 0x31c]
lea ecx, [esp + 0x39c]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x4a8]
lea eax, [esp + 0x528]
push edx
push str._slinkinfo.dll
push eax
call fcn.004f175f
add esp, 0x30
lea ecx, [esp + 0x504]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x504]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x204]
push str.NTDETECT.COM
push eax
lea ecx, [esp + 0x10c]
push str._s_s
push ecx
call fcn.004f175f
push str.NTDETECT.COM
lea edx, [esp + 0x18]
push str.c:_s
push edx
call fcn.004f175f
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x1c
lea eax, [esp + 0x104]
lea ecx, [esp + 4]
push 1
push eax
push ecx
call esi
lea edx, [esp + 0x204]
push str.ntldr
push edx
lea eax, [esp + 0x10c]
push str._s_s
push eax
call fcn.004f175f
push str.ntldr
lea ecx, [esp + 0x18]
push str.c:_s
push ecx
call fcn.004f175f
add esp, 0x1c
lea edx, [esp + 0x104]
lea eax, [esp + 4]
push 1
push edx
push eax
call esi
cmp dword [0xe56da0], 1
jne 0x445e0d
lea ecx, [esp + 0x204]
push str.mtldr
push ecx
lea edx, [esp + 0x10c]
push str._s_s
push edx
call fcn.004f175f
push str.mtldr
lea eax, [esp + 0x18]
push str.c:_s
push eax
call fcn.004f175f
add esp, 0x1c
lea ecx, [esp + 0x104]
lea edx, [esp + 4]
push 1
push ecx
push edx
call esi
lea eax, [esp + 0x204]
push 0x5196ac
push eax
lea ecx, [esp + 0x10c]
push str._s_s
push ecx
call fcn.004f175f
push 0x5196ac
lea edx, [esp + 0x18]
push str.c:_s
push edx
call fcn.004f175f
add esp, 0x1c
lea eax, [esp + 0x104]
lea ecx, [esp + 4]
push 1
push eax
push ecx
call esi
lea edx, [esp + 0x204]
push str.bootfont.bin
push edx
lea eax, [esp + 0x10c]
push str._s_s
push eax
call fcn.004f175f
push str.bootfont.bin
lea ecx, [esp + 0x18]
push str.c:_s
push ecx
call fcn.004f175f
add esp, 0x1c
lea edx, [esp + 0x104]
lea eax, [esp + 4]
push 1
push edx
push eax
call esi
lea ecx, [esp + 0x204]
push str.ntoskrnl.exe
push ecx
lea edx, [esp + 0x10c]
push str._s_s
push edx
call fcn.004f175f
lea eax, [esp + 0x394]
push str.ntoskrnl.exe
push eax
lea ecx, [esp + 0x1c]
push str._s_s
push ecx
call fcn.004f175f
add esp, 0x20
lea edx, [esp + 0x104]
lea eax, [esp + 4]
push 1
push edx
push eax
call esi
lea ecx, [esp + 0x204]
push str.hal.dll
push ecx
lea edx, [esp + 0x10c]
push str._s_s
push edx
call fcn.004f175f
lea eax, [esp + 0x394]
push str.hal.dll
push eax
lea ecx, [esp + 0x1c]
push str._s_s
push ecx
call fcn.004f175f
add esp, 0x20
lea edx, [esp + 0x104]
lea eax, [esp + 4]
push 1
push edx
push eax
call esi
push str.smss.exe
lea ecx, [esp + 0x208]
lea edx, [esp + 0x108]
push ecx
push str._s_s
push edx
call fcn.004f175f
lea eax, [esp + 0x394]
push str.smss.exe
push eax
lea ecx, [esp + 0x1c]
push str._s_s
push ecx
call fcn.004f175f
add esp, 0x20
lea edx, [esp + 0x104]
lea eax, [esp + 4]
push 1
push edx
push eax
call esi
lea ecx, [esp + 0x204]
push str.bootvid.dll
push ecx
lea edx, [esp + 0x10c]
push str._s_s
push edx
call fcn.004f175f
lea eax, [esp + 0x394]
push str.bootvid.dll
push eax
lea ecx, [esp + 0x1c]
push str._s_s
push ecx
call fcn.004f175f
add esp, 0x20
lea edx, [esp + 0x104]
lea eax, [esp + 4]
push 1
push edx
push eax
call esi
lea ecx, [esp + 0x204]
push str.kdcom.dll
push ecx
lea edx, [esp + 0x10c]
push str._s_s
push edx
call fcn.004f175f
lea eax, [esp + 0x394]
push str.kdcom.dll
push eax
lea ecx, [esp + 0x1c]
push str._s_s
push ecx
call fcn.004f175f
add esp, 0x20
lea edx, [esp + 0x104]
lea eax, [esp + 4]
push 1
push edx
push eax
call esi
mov eax, 1
pop esi
add esp, 0x700
ret