Function at 0x40bf20
Capabilities:
Create directory
Write file on windows

Disassembly:
push 0x4a0
mov eax, 0x44f05c
call fcn.0044b8c8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x488], ecx
call fcn.00432c20
mov esi, eax
xor ebx, ebx
mov dword [ebp - 0x474], esi
cmp esi, ebx
jne 0x40bf4f
xor eax, eax
jmp 0x40bf73
mov dword [ebp - 0x470], 1
call fcn.004337d0
cmp eax, ebx
je 0x40bf7d
mov eax, dword [ebp - 0x474]
call fcn.00433260
mov eax, dword [ebp - 0x470]
call fcn.0044b912
ret 4
xor ebx, ebx
push 0x50
lea eax, [ebp - 0x464]
push ebx
push eax
call fcn.00437620
add esp, 0xc
push 0x3ff
lea eax, [ebp - 0x413]
push ebx
push eax
mov byte [ebp - 0x414], bl
call fcn.00437620
add esp, 0xc
push dword [ebp - 0x474]
lea eax, [ebp - 0x414]
lea esi, [ebp - 0x464]
call fcn.00433730
pop ecx
test eax, eax
jne 0x40c2db
mov dword [ebp - 0x4ac], ebx
mov dword [ebp - 0x4a8], ebx
mov dword [ebp - 0x4a4], ebx
mov dword [ebp - 0x49c], ebx
mov dword [ebp - 0x498], ebx
mov dword [ebp - 0x494], ebx
push ebx
lea eax, [ebp - 0x4ac]
mov dword [ebp - 4], ebx
push eax
lea ebx, [ebp - 0x414]
call fcn.0041ebc0
lea ecx, [ebp - 0x46c]
push ecx
mov ecx, eax
call fcn.00404da4
lea eax, [ebp - 0x46c]
mov byte [ebp - 4], 1
call fcn.004068ee
mov eax, dword [ebp - 0x46c]
mov ecx, dword [eax - 0xc]
xor esi, esi
cmp ecx, esi
je 0x40c2e6
lea edx, [ecx - 1]
cmp edx, esi
jl 0x40c324
cmp edx, ecx
jg 0x40c324
movzx ecx, word [eax + edx*2]
push 0x2f
pop edx
cmp dx, cx
jne 0x40c0c0
mov eax, dword [eax - 0xc]
lea ecx, [ebp - 0x46c]
dec eax
push ecx
call fcn.0040cc34
mov ecx, dword [ebp - 0x488]
lea eax, [ebp - 0x484]
push eax
call fcn.00404da4
mov byte [ebp - 4], 2
push dword [ebp - 0x46c]
lea ecx, [ebp - 0x484]
push 0x456f90
call fcn.00406d57
pop ecx
pop ecx
push esi
push dword [ebp - 0x484]
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp eax, esi
je 0x40c0ae
cmp eax, 0xb7
jne 0x40c308
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x484]
add eax, 0xfffffff0
jmp 0x40c29f
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x478], eax
mov byte [ebp - 4], 3
push dword [ebp - 0x46c]
lea eax, [ebp - 0x478]
push dword [ebp - 0x488]
push str._s_s
push eax
call fcn.00404457
mov eax, dword [ebp - 0x478]
add eax, 0xfffffff0
add esp, 0x10
mov dword [ebp - 0x48c], eax
call fcn.00404e00
lea edi, [eax + 0x10]
mov dword [ebp - 0x47c], edi
mov byte [ebp - 4], 4
mov ebx, dword [edi - 0xc]
xor ecx, ecx
mov byte [ebp - 0x465], 0
mov eax, edi
test ebx, ebx
jle 0x40c194
lea edi, [ecx + ecx]
cmp word [edi + eax], 0x2f
jne 0x40c15a
cmp byte [ebp - 0x465], 0
jne 0x40c153
push ebx
lea esi, [ebp - 0x47c]
mov byte [ebp - 0x465], 1
call fcn.0040503f
push 0x5c
pop ecx
mov word [edi + eax], cx
lea ecx, [edi + 2]
sar ecx, 1
cmp ecx, ebx
jl 0x40c12d
cmp byte [ebp - 0x465], 0
je 0x40c18e
test ebx, ebx
js 0x40c324
mov edi, dword [ebp - 0x47c]
cmp ebx, dword [edi - 8]
jg 0x40c324
xor eax, eax
mov dword [edi - 0xc], ebx
mov word [edi + ebx*2], ax
jmp 0x40c194
mov edi, dword [ebp - 0x47c]
cmp dword [edi - 4], 1
jle 0x40c1af
push dword [edi - 0xc]
lea eax, [ebp - 0x47c]
push eax
call fcn.00404f5f
mov edi, dword [ebp - 0x47c]
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x40c1df
lea esi, [ebp - 0x47c]
call fcn.00406c56
push 0
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x40c1df
cmp eax, 0xb7
jne 0x40c32e
push dword [ebp - 0x474]
call fcn.00433b50
xor esi, esi
pop ecx
cmp eax, esi
jne 0x40c28d
push 0x457030
push dword [ebp - 0x478]
lea eax, [ebp - 0x480]
push eax
mov dword [ebp - 0x480], esi
call fcn.0043a2fc
add esp, 0xc
cmp dword [ebp - 0x480], esi
je 0x40c345
push 0x80000
call fcn.0043803c
pop ecx
mov ebx, eax
jmp 0x40c246
push dword [ebp - 0x480]
push esi
push 1
push ebx
call fcn.0043a49a
add esp, 0x10
cmp esi, eax
jne 0x40c25b
mov eax, dword [ebp - 0x474]
push ebx
call fcn.00433d10
mov esi, eax
pop ecx
test esi, esi
jg 0x40c230
jmp 0x40c262
and dword [ebp - 0x470], 0
push ebx
call fcn.004380d0
pop ecx
push dword [ebp - 0x480]
call fcn.0043a581
mov ebx, dword [ebp - 0x474]
pop ecx
call fcn.00433fa0
cmp dword [ebp - 0x470], 0
je 0x40c335
lea eax, [edi - 0x10]
call fcn.0040507e
mov eax, dword [ebp - 0x48c]
mov byte [ebp - 4], 1
call fcn.0040507e
mov esi, dword [ebp - 0x474]
call fcn.00433830
mov edi, eax
mov eax, dword [ebp - 0x46c]
add eax, 0xfffffff0
call fcn.0040507e
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x4ac]
call fcn.0041ead0
test edi, edi
je 0x40bf7b
jmp 0x40bf62
mov dword [ebp - 0x470], ebx
jmp 0x40bf62
mov dword [ebp - 0x470], esi
add eax, 0xfffffff0
call fcn.0040507e
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x4ac]
call fcn.0041ead0
jmp 0x40bf62
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x470], esi
add eax, 0xfffffff0
call fcn.0040507e
mov eax, dword [ebp - 0x46c]
jmp 0x40c2ec
push 0x80070057
call fcn.004050e3
and dword [ebp - 0x470], 0
lea eax, [edi - 0x10]
call fcn.0040507e
mov eax, dword [ebp - 0x478]
jmp 0x40c314
mov ebx, dword [ebp - 0x474]
mov dword [ebp - 0x470], esi
call fcn.00433fa0
jmp 0x40c335