Function at 0x401470
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x514
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x219]
mov byte [esp + 0x218], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x21c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
mov esi, 0x407270
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x31d]
mov byte [esp + 0x31c], bl
rep stosd dword es:[edi], eax
mov edx, dword [esi]
lea ecx, [esp + 0x31c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x218]
push edx
push eax
push 0x409480
push ecx
call ebp
lea edx, [esp + 0x32c]
push edx
call fcn.00404340
add esp, 0x14
test eax, eax
jne 0x401637
add esi, 4
cmp esi, 0x407388
jl 0x4014c3
mov ecx, 0x40
lea edi, [esp + 0x421]
mov byte [esp + 0x420], bl
mov byte [esp + 0x10], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x114], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x420]
push ecx
push 0x104
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [esp + 0x420]
push 0x103
lea eax, [esp + 0x14]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
mov byte [esp + 0x113], bl
mov ebp, dword [sym.imp.MSVCRT.dll_strncat]
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0xf], 0x5c
je 0x4015cb
push 0x103
lea ecx, [esp + 0x14]
push 0x4094e0
push ecx
call ebp
add esp, 0xc
mov byte [esp + 0x113], bl
push 0x103
lea edx, [esp + 0x14]
push str.gwtemp_
push edx
call ebp
lea eax, [esp + 0x1c]
push ebx
push eax
mov byte [esp + 0x127], bl
call dword [sym.imp.MSVCRT.dll__access]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x401603
lea ecx, [esp + 0x10]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea edx, [esp + 0x10]
push edx
call fcn.00403a50
lea eax, [esp + 0x14]
push eax
call fcn.004012f0
mov eax, dword [esp + 0x538]
add esp, 8
mov edi, 0x40a024
mov esi, eax
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40166f
xor esi, esi
jmp 0x40167b
lea eax, [esp + 0x31c]
push eax
push str.__s__doesnt_belong_here.
push 4
call fcn.004051f0
add esp, 0xc
push ebx
push str.fail
push str.Runtime_environment_check_failed__dll_hijack_risks.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x514
ret 0x10
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
mov esi, eax
lea eax, [esp + 0x10]
push 0x103
lea ecx, [esp + 0x118]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
push 0x103
lea edx, [esp + 0x124]
push str.gwupdater.dll
push edx
mov byte [esp + 0x22f], bl
call ebp
add esp, 0x18
lea eax, [esp + 0x114]
mov byte [esp + 0x217], bl
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
je 0x4016ef
push str.GWClientInstall
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4016ef
push 1
lea ecx, [esp + 0x14]
push esi
push ecx
call eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x514
ret 0x10