Function at 0x49aaa3
Capabilities:
Create directory
Get common file path
Get program files directory
Get startup folder

Disassembly:
push 0x254
mov eax, 0x54e8bf
call fcn.0053655e
mov ebx, ecx
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x26
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
lea esi, [ebx + 0xb4]
push eax
mov ecx, esi
call fcn.0040261b
push 2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0xc]
call fcn.0040261b
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x3c]
call fcn.0040261b
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
lea ecx, [ebx + 0x24]
push eax
call fcn.0040261b
push 0xffffffffffffffff
push str._x86_
mov ecx, esi
call fcn.0047b1ae
cmp eax, 0xffffffff
je 0x49abb1
and dword [ebp - 0x238], 0
xor ecx, ecx
dec eax
mov word [ebp - 0x248], cx
push eax
push ecx
push esi
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], 7
call fcn.0040aade
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebx + 0xcc]
call fcn.004035f6
lea ecx, [ebp - 0x248]
call fcn.0040257a
jmp 0x49abbd
push esi
lea ecx, [ebx + 0xcc]
call fcn.0040fcd6
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x28
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x54]
call fcn.0040261b
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x1a
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x6c]
call fcn.0040261b
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x1c
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x84]
call fcn.0040261b
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x23
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x9c]
call fcn.0040261b
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0xe4]
call fcn.0040261b
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x19
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0xfc]
call fcn.0040261b
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0xb
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x114]
call fcn.0040261b
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x16
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x12c]
call fcn.0040261b
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 2
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x144]
call fcn.0040261b
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x17
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x15c]
call fcn.0040261b
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x24
push eax
call esi
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00401cd4
and dword [ebp - 4], 0
push str.System32Tasks
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.004030d5
add esp, 0xc
lea ecx, [ebx + 0x1bc]
push eax
call fcn.004035f6
lea ecx, [ebp - 0x248]
call fcn.0040257a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.0040257a
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00401cd4
push str.Tasks
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 1
push eax
call fcn.004030d5
add esp, 0xc
lea ecx, [ebx + 0x1d4]
push eax
call fcn.004035f6
lea ecx, [ebp - 0x230]
call fcn.0040257a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.0040257a
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 7
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x1ec]
call fcn.0040261b
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push eax
push 0x18
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebx + 0x204]
call fcn.0040261b
push str.System32
lea edi, [ebx + 0x24]
lea eax, [ebp - 0x230]
push edi
push eax
call fcn.00404630
add esp, 0xc
lea esi, [ebx + 0x27c]
mov ecx, esi
push eax
call fcn.004035f6
lea ecx, [ebp - 0x230]
call fcn.0040257a
push str.SysWOW64
lea eax, [ebp - 0x230]
push edi
push eax
call fcn.00404630
add esp, 0xc
lea edi, [ebx + 0x294]
mov ecx, edi
push eax
call fcn.004035f6
lea ecx, [ebp - 0x230]
call fcn.0040257a
push str.drivers
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.00404630
add esp, 0xc
lea ecx, [ebx + 0x24c]
push eax
call fcn.004035f6
lea ecx, [ebp - 0x230]
call fcn.0040257a
push str.drivers
lea eax, [ebp - 0x230]
push edi
push eax
call fcn.00404630
add esp, 0xc
lea ecx, [ebx + 0x264]
push eax
call fcn.004035f6
lea ecx, [ebp - 0x230]
call fcn.0040257a
mov ecx, ebx
call fcn.0049a8ae
push str.clntmp
lea ecx, [ebp - 0x248]
call fcn.00401cd4
lea eax, [ebp - 0x248]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00406d34
pop ecx
pop ecx
lea esi, [ebx + 0x234]
push eax
mov ecx, esi
call fcn.004035f6
lea ecx, [ebp - 0x230]
call fcn.0040257a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.0040257a
cmp dword [esi + 0x14], 8
jb 0x49afa7
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, ebx
call fcn.0049ba83
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.0045cd08
push eax
lea ecx, [ebx + 0x2c4]
call fcn.004035f6
lea ecx, [ebp - 0x230]
call fcn.0040257a
lea eax, [ebp - 0x260]
mov ecx, ebx
push eax
call fcn.0044ef0f
push eax
lea ecx, [ebx + 0x2ac]
call fcn.004035f6
lea ecx, [ebp - 0x260]
call fcn.0040257a
call fcn.00536508
ret