Function at 0x404500
Capabilities:
Check os version
Copy file
Get common file path

Disassembly:
mov eax, 0x111c
call fcn.00408610
mov eax, dword [0x40d018]
xor eax, esp
mov dword [esp + 0x1118], eax
push ebx
push esi
xor eax, eax
push 0x3fe
push eax
lea ecx, [esp + 0x52a]
push ecx
mov word [esp + 0x52c], ax
call sub.MSVCR90.dll_memset
xor edx, edx
push 0x3fe
push edx
lea eax, [esp + 0x936]
push eax
mov word [esp + 0x938], dx
call sub.MSVCR90.dll_memset
xor ecx, ecx
push 0x3fe
push ecx
lea edx, [esp + 0xd42]
push edx
mov word [esp + 0xd44], cx
call sub.MSVCR90.dll_memset
xor eax, eax
push 0x3fe
push eax
lea ecx, [esp + 0x14e]
push ecx
mov word [esp + 0x150], ax
call sub.MSVCR90.dll_memset
mov ecx, dword [0x40d550]
add esp, 0x30
xor ebx, ebx
test ecx, ecx
jne 0x4045c1
push 0xe60
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x4045b7
mov esi, eax
call fcn.00403000
jmp 0x4045b9
xor eax, eax
mov ecx, eax
mov dword [0x40d550], ecx
lea esi, [ecx + 0x618]
mov eax, esi
push edi
lea edi, [eax + 2]
lea ecx, [ecx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4045d0
sub eax, edi
sar eax, 1
mov edi, dword [sym.imp.MSVCR90.dll_wcscpy_s]
jne 0x404606
call fcn.004031a0
push eax
push 0x104
push esi
call edi
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push esi
lea edx, [esp + 0x128]
push 0x200
push edx
call edi
mov esi, dword [sym.imp.MSVCR90.dll_wcscat_s]
push str.DATAPROT
lea eax, [esp + 0x134]
push 0x200
push eax
call esi
add esp, 0x18
push 0x200
lea ecx, [esp + 0xd28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.System32driversBkpDrv.sys
lea edx, [esp + 0xd28]
push 0x200
push edx
call esi
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
pop edi
test eax, eax
jne 0x40468c
pop esi
pop ebx
mov ecx, dword [esp + 0x1118]
xor ecx, esp
call fcn.00407c9c
add esp, 0x111c
ret
mov eax, dword [esp + 0x10]
cmp eax, 5
jne 0x40472e
mov eax, dword [esp + 0x14]
cmp eax, 1
jne 0x4046dc
lea ecx, [esp + 0x120]
push ecx
push str._sBkpDrv.xp
lea edx, [esp + 0x528]
call fcn.004067c0
lea edx, [esp + 0x128]
push edx
push str._sBkpDrv.sys
lea edx, [esp + 0x930]
call fcn.004067c0
add esp, 0x10
jmp 0x404782
cmp eax, 2
jne 0x40479c
lea edx, [esp + 0x120]
push edx
push str._sBkpDrv.srv
lea edx, [esp + 0x528]
call fcn.004067c0
lea eax, [esp + 0x128]
push eax
push str._sBkpDrv.sys
lea edx, [esp + 0x930]
call fcn.004067c0
add esp, 0x10
push 0
lea ecx, [esp + 0x924]
push ecx
lea edx, [esp + 0x528]
push edx
jmp 0x404794
cmp eax, 6
jne 0x40479c
lea edx, [esp + 0x520]
cmp dword [0x40d55c], ebx
je 0x404751
lea eax, [esp + 0x120]
push eax
push str._sBkpDrv64.Sys
jmp 0x40475e
lea ecx, [esp + 0x120]
push ecx
push str._sBkpDrv32.Sys
call fcn.004067c0
add esp, 8
lea edx, [esp + 0x120]
push edx
push str._sBkpDrv.sys
lea edx, [esp + 0x928]
call fcn.004067c0
add esp, 8
push 0
lea eax, [esp + 0x924]
push eax
lea ecx, [esp + 0x528]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
mov ecx, dword [esp + 0x1120]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00407c9c
add esp, 0x111c
ret