Function at 0x404760
Capabilities:
Create directory
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x4538f7
mov eax, dword fs:[0]
push eax
sub esp, 0x330
mov eax, dword [0x467340]
xor eax, esp
mov dword [esp + 0x328], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x467340]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
mov eax, dword [esp + 0x354]
push 0x206
xor ebx, ebx
lea edx, [esp + 0x13a]
xor ecx, ecx
push ebx
push edx
mov dword [esp + 0x24], eax
mov word [esp + 0x140], cx
call fcn.004375f0
add esp, 0xc
push 1
push 0x1c
lea eax, [esp + 0x13c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor ecx, ecx
lea eax, [esp + 0x134]
mov dword [esp + 0xf8], 7
mov dword [esp + 0xf4], ebx
mov word [esp + 0xe4], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x404801
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x138]
lea esi, [esp + 0xe4]
call fcn.004070b0
mov dword [esp + 0x34c], ebx
cmp dword [esp + 0xf4], ebx
jne 0x4048cd
push 0xf
push str..Bootsetup.cpp
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.00406050
push ebx
lea edx, [esp + 0x3c]
push edx
mov ecx, 0xa2
lea edx, [esp + 0x24]
mov byte [esp + 0x354], 1
call fcn.0041f600
add eax, 0x28
push str.Get_Special_floder_path_failed_
push eax
mov byte [esp + 0x354], 2
call fcn.00407a60
add esp, 8
lea ecx, [esp + 0x38]
mov byte [esp + 0x34c], 1
call fcn.0041f890
cmp dword [esp + 0x34], 0x10
jb 0x4048b2
mov eax, dword [esp + 0x20]
push eax
call fcn.004308f5
add esp, 4
cmp dword [esp + 0xf8], 8
jb 0x404b5d
mov ecx, dword [esp + 0xe4]
push ecx
jmp 0x404b55
push 1
push 0x45bbbc
lea eax, [esp + 0xe8]
call fcn.00406ee0
push 6
push 0x45bbc0
lea eax, [esp + 0xe8]
call fcn.00406ee0
mov eax, dword [esp + 0xe4]
mov edi, 8
cmp dword [esp + 0xf8], edi
jae 0x40490f
lea eax, [esp + 0xe4]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
push eax
call esi
push 0xa
push str.Bootsetup
lea eax, [esp + 0xe8]
call fcn.00406ee0
mov eax, dword [esp + 0xe4]
cmp dword [esp + 0xf8], edi
jae 0x404943
lea eax, [esp + 0xe4]
push ebx
push eax
call esi
push 0xb
push str.2.1.11.3341
lea ecx, [esp + 0x104]
mov dword [esp + 0x11c], 0xf
mov dword [esp + 0x118], ebx
mov byte [esp + 0x108], bl
call fcn.00406050
mov byte [esp + 0x34c], 3
mov ecx, dword [esp + 0x114]
mov edx, dword [esp + 0x100]
mov eax, edx
cmp ecx, 0x10
jae 0x404997
lea eax, [esp + 0x100]
mov esi, dword [esp + 0x110]
lea edi, [eax + esi]
cmp edi, ebx
je 0x4049cb
mov eax, edx
cmp ecx, 0x10
jae 0x4049b3
lea eax, [esp + 0x100]
cmp eax, edi
ja 0x4049cb
mov eax, edx
cmp ecx, 0x10
jae 0x4049c5
lea eax, [esp + 0x100]
add eax, esi
cmp edi, eax
jbe 0x4049de
call fcn.004315e0
mov ecx, dword [esp + 0x114]
mov edx, dword [esp + 0x100]
lea ebp, [esp + 0xfc]
cmp ecx, 0x10
jb 0x404b85
mov esi, edx
cmp edx, ebx
je 0x404a21
mov eax, edx
cmp ecx, 0x10
jae 0x404a02
lea eax, [esp + 0x100]
cmp eax, esi
ja 0x404a21
mov eax, edx
cmp ecx, 0x10
jae 0x404a14
lea eax, [esp + 0x100]
mov edx, dword [esp + 0x110]
add eax, edx
cmp esi, eax
jbe 0x404a26
call fcn.004315e0
mov edx, dword [esp + 0x18]
push edi
push ebp
push esi
lea eax, [esp + 0x108]
push eax
push edx
lea eax, [esp + 0x12c]
xor ecx, ecx
push eax
mov dword [esp + 0x148], 7
mov dword [esp + 0x144], ebx
mov word [esp + 0x134], cx
call fcn.00407ce0
push 1
push 0x45bbbc
lea eax, [esp + 0xe8]
mov byte [esp + 0x354], 4
call fcn.00406ee0
push ebx
lea ecx, [esp + 0x11c]
push ecx
or eax, 0xffffffff
lea esi, [esp + 0xe8]
call fcn.00406dd0
mov eax, dword [esp + 0xe4]
mov esi, 8
cmp dword [esp + 0xf8], esi
jae 0x404aae
lea eax, [esp + 0xe4]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
push 0x45bbbc
lea eax, [esp + 0xe8]
call fcn.00406ee0
mov ecx, dword [esp + 0x18]
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xe8]
call fcn.00406820
cmp dword [esp + 0x130], esi
jb 0x404af5
mov edx, dword [esp + 0x11c]
push edx
call fcn.004308f5
add esp, 4
xor eax, eax
cmp dword [esp + 0x114], 0x10
mov dword [esp + 0x130], 7
mov dword [esp + 0x12c], ebx
mov word [esp + 0x11c], ax
jb 0x404b2b
mov ecx, dword [esp + 0x100]
push ecx
call fcn.004308f5
add esp, 4
mov dword [esp + 0x114], 0xf
mov dword [esp + 0x110], ebx
mov byte [esp + 0x100], bl
cmp dword [esp + 0xf8], esi
jb 0x404b5d
mov edx, dword [esp + 0xe4]
push edx
call fcn.004308f5
add esp, 4
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x328]
xor ecx, esp
call fcn.00430900
add esp, 0x33c
ret
lea esi, [esp + 0x100]
jmp 0x4049f4