Function at 0x41d6d9
Capabilities:
Create directory
Get common file path
Get program files directory
Get startup folder

Disassembly:
push 0x254
mov eax, 0x47de12
call fcn.00478470
mov ebx, ecx
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x26
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
lea esi, [ebx + 0xb4]
push eax
mov ecx, esi
call fcn.00401f9a
push 2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0xc]
call fcn.00401f9a
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x3c]
call fcn.00401f9a
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
lea ecx, [ebx + 0x24]
push eax
call fcn.00401f9a
push 0xffffffffffffffff
push str._x86_
mov ecx, esi
call fcn.0041c83d
cmp eax, 0xffffffff
je 0x41d7e7
and dword [ebp - 0x238], 0
xor ecx, ecx
dec eax
mov word [ebp - 0x248], cx
push eax
push ecx
push esi
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], 7
call fcn.00405cf6
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebx + 0xcc]
call fcn.004034a9
lea ecx, [ebp - 0x248]
call fcn.00401ef9
jmp 0x41d7f3
push esi
lea ecx, [ebx + 0xcc]
call fcn.0040a649
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x28
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x54]
call fcn.00401f9a
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x1a
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x6c]
call fcn.00401f9a
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x1c
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x84]
call fcn.00401f9a
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x23
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x9c]
call fcn.00401f9a
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0xe4]
call fcn.00401f9a
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x19
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0xfc]
call fcn.00401f9a
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0xb
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x114]
call fcn.00401f9a
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x16
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x12c]
call fcn.00401f9a
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 2
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x144]
call fcn.00401f9a
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x17
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x15c]
call fcn.00401f9a
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x24
push eax
call esi
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.004019d1
and dword [ebp - 4], 0
push str.System32Tasks
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00402ac2
add esp, 0xc
lea ecx, [ebx + 0x1bc]
push eax
call fcn.004034a9
lea ecx, [ebp - 0x248]
call fcn.00401ef9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00401ef9
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.004019d1
push str.Tasks
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 1
push eax
call fcn.00402ac2
add esp, 0xc
lea ecx, [ebx + 0x1d4]
push eax
call fcn.004034a9
lea ecx, [ebp - 0x230]
call fcn.00401ef9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.00401ef9
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 7
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x1ec]
call fcn.00401f9a
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x18
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x204]
call fcn.00401f9a
push str.System32
lea edi, [ebx + 0x24]
lea eax, [ebp - 0x230]
push edi
push eax
call fcn.00402ae9
add esp, 0xc
lea esi, [ebx + 0x27c]
mov ecx, esi
push eax
call fcn.004034a9
lea ecx, [ebp - 0x230]
call fcn.00401ef9
push str.SysWOW64
lea eax, [ebp - 0x230]
push edi
push eax
call fcn.00402ae9
add esp, 0xc
lea edi, [ebx + 0x294]
mov ecx, edi
push eax
call fcn.004034a9
lea ecx, [ebp - 0x230]
call fcn.00401ef9
push str.drivers
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.00402ae9
add esp, 0xc
lea ecx, [ebx + 0x24c]
push eax
call fcn.004034a9
lea ecx, [ebp - 0x230]
call fcn.00401ef9
push str.drivers
lea eax, [ebp - 0x230]
push edi
push eax
call fcn.00402ae9
add esp, 0xc
lea ecx, [ebx + 0x264]
push eax
call fcn.004034a9
lea ecx, [ebp - 0x230]
call fcn.00401ef9
mov ecx, ebx
call fcn.0041d50f
push 0x480d48
lea ecx, [ebp - 0x248]
call fcn.004019d1
lea eax, [ebp - 0x248]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0040404d
pop ecx
pop ecx
lea esi, [ebx + 0x234]
push eax
mov ecx, esi
call fcn.004034a9
lea ecx, [ebp - 0x230]
call fcn.00401ef9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.00401ef9
cmp dword [esi + 0x14], 8
jb 0x41dbdd
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, ebx
call fcn.0041df51
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.004155a9
push eax
lea ecx, [ebx + 0x2c4]
call fcn.004034a9
lea ecx, [ebp - 0x230]
call fcn.00401ef9
lea eax, [ebp - 0x260]
mov ecx, ebx
push eax
call fcn.0040f716
push eax
lea ecx, [ebx + 0x2ac]
call fcn.004034a9
lea ecx, [ebp - 0x260]
call fcn.00401ef9
call fcn.0047842b
ret