Function at 0x41effd
Capabilities:
Access the windows event log
Compare security identifiers
Delete directory
Extract resource via kernel32 functions
Get common file path
Get file attributes
Get hostname
Query or enumerate registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd7c
mov eax, dword [0x42b4d0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x466ab8], 0x565
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0xd5c], ecx
jne 0x41f049
lea eax, [ebp - 0xd58]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push dword [ebp - 0xd58]
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
or dword [0x44680c], 0xffffffff
push str.kernel32.dll
mov dword [0x446808], 0xf8686a2a
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x427814
push eax
mov dword [0x44681c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [ebp - 0xd58]
xor esi, esi
mov dword [0x44657c], eax
cmp dword [0x466ab8], 0x8fb
jne 0x41f09b
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
cmp esi, 0x2170f
jne 0x41f0af
push dword [edi]
push 0
call dword [0x44657c]
mov ebx, eax
inc esi
cmp esi, 0x2d775
jl 0x41f083
xor esi, esi
cmp dword [0x466ab8], 0x5a1
jne 0x41f0ec
push esi
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor ecx, ecx
mov dword [ebp - 0xd54], ecx
cmp dword [edi], ecx
jbe 0x41f31a
cmp dword [0x466ab8], 0xcdc
jne 0x41f11a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xd54]
mov eax, dword [ebp - 0xd5c]
or dword [0x446814], 0xffffffff
cmp dword [0x466ab8], 0x486
mov dword [0x446810], 0xf3cd9188
mov eax, dword [eax]
mov al, byte [ecx + eax]
mov byte [ebp - 0xd4a], al
jne 0x41f15d
lea eax, [ebp - 0xd48]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ecx, dword [ebp - 0xd54]
cmp dword [0x466ab8], 0x12eb
mov eax, dword [ebp - 0xd5c]
mov eax, dword [eax]
mov al, byte [eax + ecx + 1]
mov byte [ebp - 0xd4b], al
jne 0x41f1b1
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
lea eax, [ebp - 0xc08]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov ecx, dword [ebp - 0xd54]
mov eax, dword [ebp - 0xd5c]
mov eax, dword [eax]
mov dl, byte [eax + ecx + 2]
mov al, byte [eax + ecx + 3]
mov byte [ebp - 0xd4c], al
and al, 0xf0
shl al, 2
cmp dword [0x466ab8], 3
mov byte [ebp - 0xd49], dl
mov byte [ebp - 0xd4d], al
jne 0x41f224
push 0
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
push dword [ebp - 0xd58]
lea eax, [ebp - 0xd64]
xor ecx, ecx
push eax
lea eax, [ebp - 0x408]
push eax
push ecx
lea eax, [ebp - 0xd60]
push eax
lea eax, [ebp - 0x808]
push eax
push ecx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push 0
call dword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
mov al, byte [ebp - 0xd4d]
or byte [ebp - 0xd4a], al
cmp dword [0x466ab8], 0x1d3
jne 0x41f240
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
cmp dword [0x466ab8], 0x17e
jne 0x41f26e
xor eax, eax
push eax
push eax
push eax
push eax
push eax
mov dword [ebp - 0xd58], eax
lea eax, [ebp - 0xd58]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov cl, byte [ebp - 0xd4c]
mov dl, byte [ebp - 0xd4b]
mov al, cl
and al, 0xfc
shl cl, 6
or byte [ebp - 0xd49], cl
shl al, 4
or dl, al
mov al, byte [ebp - 0xd4a]
mov byte [esi + ebx], al
cmp dword [0x466ab8], 0x11d4
mov byte [ebp - 0xd4b], dl
jne 0x41f2d8
push 0
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Beep]
call dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dl, byte [ebp - 0xd4b]
mov byte [esi + ebx + 1], dl
cmp dword [0x466ab8], 0xb8f
jne 0x41f2f6
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_ObjectPrivilegeAuditAlarmW]
mov ecx, dword [ebp - 0xd54]
mov dl, byte [ebp - 0xd49]
add ecx, 4
mov byte [esi + ebx + 2], dl
add esi, 3
mov dword [ebp - 0xd54], ecx
cmp ecx, dword [edi]
jb 0x41f0fc
cmp dword [0x466ab8], 0xb6d
jne 0x41f34c
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [ebp - 0xd7c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateJobSet]
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
mov eax, dword [ebp - 0xd5c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [eax], ebx
mov dword [edi], esi
pop edi
pop esi
pop ebx
call fcn.00405707
mov esp, ebp
pop ebp
ret