Function at 0x40fd0f
Capabilities:
Create thread
Get common file path
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x828]
sub esp, 0x8a8
mov eax, dword [0x482910]
xor eax, ebp
mov dword [ebp + 0x824], eax
push ebx
push esi
xor ebx, ebx
push edi
push ebx
mov byte [ebp - 0x15], bl
call fcn.00447ce3
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x28], edx
call fcn.00447a2b
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x12]
push ebx
push eax
call fcn.00445180
lea eax, [ebp - 0x80]
push eax
push str._Y__m__d__H__M__S
lea eax, [ebp - 0x14]
push 0x104
push eax
call fcn.00448334
xor eax, eax
push esi
mov word [ebp + 0x3fc], ax
lea eax, [ebp + 0x3fe]
push ebx
push eax
call fcn.00445180
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0x34
push ebx
push 0x10
lea eax, [ebp + 0x3fc]
push eax
push ebx
call edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x3fc]
push eax
push str._sWASULogs__s.zip
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
push esi
mov word [ebp + 0x604], ax
lea eax, [ebp + 0x606]
push ebx
push eax
call fcn.00445180
add esp, 0x1c
push ebx
push 0x1c
lea eax, [ebp + 0x604]
push eax
push ebx
call edi
lea eax, [ebp + 0x604]
push eax
push str._sTempWASULogs
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
push esi
mov word [ebp + 0x1f4], ax
lea eax, [ebp + 0x1f6]
push ebx
push eax
call fcn.00445180
add esp, 0x18
push ebx
push 0x1c
lea eax, [ebp + 0x1f4]
push eax
push ebx
call edi
lea eax, [ebp + 0x1f4]
push eax
push str._sAppleApple_Software_UpdateLogs
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push ebx
lea eax, [ebp + 0x3fc]
push eax
push 3
call fcn.0040fc51
push 0x4652fc
lea eax, [ebp + 0x3fc]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp + 0x80c], 0x50
mov byte [ebp + 0x80d], 0x4b
mov byte [ebp + 0x80e], 5
mov byte [ebp + 0x80f], 6
mov byte [ebp + 0x810], bl
mov byte [ebp + 0x811], bl
mov byte [ebp + 0x812], bl
mov byte [ebp + 0x813], bl
mov byte [ebp + 0x814], bl
mov byte [ebp + 0x815], bl
mov byte [ebp + 0x816], bl
mov byte [ebp + 0x817], bl
mov byte [ebp + 0x818], bl
mov byte [ebp + 0x819], bl
mov byte [ebp + 0x81a], bl
mov byte [ebp + 0x81b], bl
mov byte [ebp + 0x81c], bl
mov byte [ebp + 0x81d], bl
mov byte [ebp + 0x81e], bl
mov byte [ebp + 0x81f], bl
mov byte [ebp + 0x820], bl
mov byte [ebp + 0x821], bl
mov dword [ebp - 0x20], ebx
call fcn.004480d1
add esp, 0x24
test eax, eax
jne 0x410093
push dword [ebp - 0x20]
lea eax, [ebp + 0x80c]
push 1
push 0x16
push eax
call fcn.00447f89
push dword [ebp - 0x20]
call fcn.00447dab
push ebx
lea eax, [ebp + 0x604]
push eax
push 3
call fcn.0040fc51
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x20
test al, al
jne 0x40ff23
call edi
mov esi, dword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
push 1
lea eax, [ebp + 0x604]
push eax
push ebx
push ebx
call esi
lea eax, [ebp + 0x604]
push eax
lea eax, [ebp + 0x1f4]
push eax
push 2
call fcn.0040fc51
add esp, 0xc
test al, al
jne 0x40ff54
call edi
push ebx
lea eax, [ebp + 0x604]
push eax
push ebx
push ebx
call esi
mov esi, eax
lea eax, [ebp + 0x604]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
cmp esi, ebx
jne 0x410088
cmp eax, ebx
jne 0x410088
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x24]
push eax
push 0x46fa00
push 1
push ebx
push 0x46fa10
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x410070
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 8
pop eax
mov word [ebp - 0x5c], ax
lea edx, [ebp - 0x1c]
push edx
sub esp, 0x10
lea eax, [ebp + 0x3fc]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov edi, esp
lea esi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1c], ebx
mov ecx, dword [eax]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x24]
test eax, eax
jl 0x410067
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x4c]
push eax
call esi
push 8
pop eax
mov word [ebp - 0x4c], ax
lea eax, [ebp + 0x604]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x3c]
push eax
call esi
push 3
pop eax
mov word [ebp - 0x3c], ax
sub esp, 0x10
mov dword [ebp - 0x34], 0x614
mov edi, esp
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x4c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x3c]
test eax, eax
jl 0x41005e
push ebx
push ebx
push dword [ebp - 0x1c]
push 0x40fc87
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41005e
mov byte [ebp - 0x15], 1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
lea eax, [ebp + 0x604]
push eax
push 3
call fcn.0040fc51
add esp, 0xc
xor eax, eax
cmp byte [ebp - 0x15], bl
setne al
dec eax
jmp 0x410096
or eax, 0xffffffff
mov ecx, dword [ebp + 0x824]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00444be5
add ebp, 0x828
leave
ret 4