Function at 0x4011a1
Capabilities:
Create directory
Create thread
Get common file path
Link many functions at runtime

Disassembly:
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
mov dword [0x404ba0], eax
push 0x40113a
call sub.kernel32.dll_SetUnhandledExceptionFilter
push 0
push 0
push 0
push 0x401148
push 0
push 0
call sub.kernel32.dll_CreateThread
push section..data
call fcn.00401112
push 0x403ba0
push 1
call section..text
cmp al, 1
jne 0x4014c7
push 0x403fa0
push 2
call section..text
cmp al, 1
jne 0x4014c7
mov al, byte [0x403fa0]
or al, 0x20
cmp al, 0x6c
jne 0x40121e
mov dword [0x404ba8], 0
mov dword [0x404bac], 0
jmp 0x401257
cmp al, 0x74
jne 0x401238
mov dword [0x404ba8], 0
mov dword [0x404bac], 1
jmp 0x401257
cmp al, 0x78
jne 0x401252
mov dword [0x404ba8], 1
mov dword [0x404bac], 2
jmp 0x401257
jmp 0x4014c7
push 0x4043a0
push 3
call section..text
cmp al, 1
jne 0x4014c7
cmp dword [0x404ba8], 1
jne 0x4012de
push 0x4047a0
push 4
call section..text
cmp eax, 1
jne 0x401296
push 0x4047a0
push 0x4033a0
call sub.kernel32.dll_lstrcpyA
jmp 0x4012d2
push 0x4033a0
push 0x400
call sub.kernel32.dll_GetCurrentDirectoryA
push 0x403276
push 0x4033a0
call sub.kernel32.dll_lstrcatA
push 0x4043a0
push 0x4033a0
call sub.kernel32.dll_lstrcatA
push 0x403274
push 0x4033a0
call sub.kernel32.dll_lstrcatA
push 0
push 0x4033a0
call 0x4014e2
push 0x4047a0
push 0x4043a0
push 0x403fa0
push 0x403ba0
push 0x4031fd
push 0x4037a0
call sub.user32.dll_wsprintfA
add esp, 0x18
push 0x4037a0
call fcn.00401112
push 0x403ba0
call sub.kernel32.dll_LoadLibraryA
or eax, eax
je 0x4014bb
mov dword [0x404bb0], eax
push 0x403279
push dword [0x404bb0]
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x4014af
mov dword [0x404bb4], eax
push 0x403285
push dword [0x404bb0]
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x4014af
mov dword [0x404bb8], eax
push 0x403290
push dword [0x404bb0]
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x4014af
mov dword [0x404bbc], eax
push 0x40329c
push dword [0x404bb0]
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x4014af
mov dword [0x404bc0], eax
push 0x4032a9
push dword [0x404bb0]
call sub.kernel32.dll_GetProcAddress
mov dword [0x404bc4], eax
mov dword [0x404bc8], 0x4043a0
push dword [0x404ba8]
pop dword [0x404bcc]
xor eax, eax
mov dword [0x404bd4], eax
mov dword [0x404bd8], eax
mov dword [0x404bdc], eax
mov dword [0x404be0], eax
push 0x404bc8
call dword [0x404bb4]
or eax, eax
je 0x4014a2
mov dword [0x404be4], eax
cmp dword [0x404bc4], 0
je 0x40140c
push 0x401198
push dword [0x404be4]
call dword [0x404bc4]
push 0x404be8
push dword [0x404be4]
call dword [0x404bb8]
or eax, eax
jne 0x401496
push 0x404cec
push 0x403268
push 0x4037a0
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0x4037a0
call fcn.00401112
push 0x40116a
push dword fs:[0]
mov dword fs:[0], esp
mov dword [0x404e2c], ebp
mov dword [0x404e28], esp
mov dword [0x404e24], 0x401487
push 0x404cec
push 0x4033a0
push dword [0x404bac]
push dword [0x404be4]
call dword [0x404bbc]
pop dword fs:[0]
add esp, 4
jmp 0x40140c
push dword [0x404be4]
call dword [0x404bc0]
push dword [0x404bb0]
call sub.kernel32.dll_FreeLibrary
jmp 0x4014db
push 0x4032fe
call fcn.00401112
jmp 0x4014db
push 0x4032e4
call fcn.00401112
jmp 0x4014db
push 0x403044
call fcn.00401112
push 0x4032bc
call fcn.00401112
push 0
call sub.kernel32.dll_ExitProcess
jmp dword [sym.imp.kernel32.dll_CreateDirectoryA]