Function at 0x407f00
Capabilities:
Access the windows event log
Copy file
Create directory
Get common file path
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x444e2b
mov eax, dword fs:[0]
push eax
sub esp, 0xe8c
mov eax, dword [0x461008]
xor eax, esp
mov dword [esp + 0xe84], eax
push ebx
push esi
mov eax, dword [0x461008]
xor eax, esp
push eax
lea eax, [esp + 0xe98]
mov dword fs:[0], eax
call fcn.004047e0
test al, al
jne 0x407f4d
call fcn.004048c0
cmp dword [0x463664], 0
jne 0x407f68
push 0x44bdb8
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [0x463664], eax
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
mov dword [esp + 0xea0], eax
mov eax, dword [0x4622b4]
cmp eax, 0xffffffff
jne 0x407fbb
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov cx, word [esp + 0x30]
cmp cx, 9
jne 0x407fad
mov eax, 1
jmp 0x407fb6
xor eax, eax
cmp cx, 6
sete al
mov dword [0x4622b4], eax
test eax, eax
mov dword [esp + 0x14], 0
setne bh
test bh, bh
je 0x407ffc
cmp dword [0x463bf0], 0
jne 0x407ffc
push 0x4565a8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.Wow64DisableWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x463bf0], eax
test eax, eax
je 0x407ffc
lea ecx, [esp + 0x14]
push ecx
call eax
call fcn.00415a20
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x44bdb8
push eax
lea eax, [esp + 0x46c]
push eax
call esi
push 0
lea eax, [esp + 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp word [0x4639d8], 0
jne 0x408043
push 0x104
push 0x4639d8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x454f50
lea eax, [esp + 0x468]
push eax
lea eax, [esp + 0x5c]
push eax
call esi
push 0
lea eax, [esp + 0x58]
push eax
push 0x4639d8
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
sete bl
test bl, bl
je 0x40817e
mov eax, dword [0x4622b4]
cmp eax, 0xffffffff
jne 0x4081f4
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [esp + 0x30]
cmp ax, 9
jne 0x4080aa
mov dword [0x4622b4], 1
jmp 0x4081fc
cmp ax, 6
jne 0x4080bf
mov dword [0x4622b4], 1
jmp 0x4081fc
mov dword [0x4622b4], 0
cmp word [0x464210], 0
jne 0x4080e3
push 0x104
push 0x464210
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.drivers
push 0x464210
lea eax, [esp + 0x264]
push eax
call esi
push 0x454f7c
lea eax, [esp + 0x260]
push eax
lea eax, [esp + 0x87c]
push eax
call esi
mov edx, eax
mov ecx, 0x387
call fcn.0040a670
mov bl, al
test bl, bl
je 0x40817e
push 0x454f98
push 0x464210
lea eax, [esp + 0xc8c]
push eax
call esi
mov ecx, 0x385
mov edx, eax
call fcn.0040a670
mov bl, al
test bl, bl
je 0x40817e
lea ecx, [esp + 0x54]
call fcn.00408340
lea ecx, [esp + 0x54]
call fcn.004085b0
call fcn.00404410
mov bl, al
test bl, bl
je 0x40817e
call fcn.00404300
lea ecx, [esp + 0x54]
call fcn.0040ef90
mov bl, al
test bl, bl
je 0x40817e
call fcn.0040f180
mov bl, al
test bh, bh
je 0x4081b2
cmp dword [0x463bec], 0
mov esi, dword [esp + 0x14]
jne 0x4081b2
push 0x4565a8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.Wow64RevertWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x463bec], eax
test eax, eax
je 0x4081b2
push esi
call eax
test bl, bl
jne 0x4082b2
cmp dword [esp + 0x2c], 8
mov eax, dword [esp + 0x18]
jae 0x4081c9
lea eax, [esp + 0x18]
push 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 0
push 1
push 0
push 0xc9
push 1
push 1
push dword [0x463664]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
jmp 0x4082dc
test eax, eax
je 0x4080c9
cmp word [0x464008], 0
jne 0x408219
push 0x464008
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp word [0x464210], 0
jne 0x408233
push 0x104
push 0x464210
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.drivers
push 0x464210
lea eax, [esp + 0x264]
push eax
call esi
push 0x454f7c
lea eax, [esp + 0x260]
push eax
lea eax, [esp + 0xa84]
push eax
call esi
mov edx, eax
mov ecx, 0x388
call fcn.0040a670
mov bl, al
test bl, bl
je 0x40817e
push 0x454f98
push 0x464008
lea eax, [esp + 0x674]
push eax
call esi
mov edx, eax
mov ecx, 0x385
call fcn.0040a670
push 0x454f98
push 0x464210
lea eax, [esp + 0x674]
push eax
call esi
mov ecx, 0x386
jmp 0x408139
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x454fb4
push eax
push 0
push 1
push 0
push 0xc8
push 1
push 4
push dword [0x463664]
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
jne 0x4082f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReportEvent
push 0x4566ac
call fcn.00416f00
add esp, 0xc
cmp dword [esp + 0x2c], 8
jb 0x40830c
push dword [esp + 0x18]
call fcn.0043198a
add esp, 4
mov al, bl
mov ecx, dword [esp + 0xe98]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xe84]
xor ecx, esp
call fcn.0043183b
mov esp, ebp
pop ebp
ret