Function at 0x412f84
Capabilities:
Create directory
Get common file path
Get file attributes
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x538]
sub rsp, 0x630
mov rax, qword [0x004e30d8]
xor esi, esi
mov rdi, rdx
test rax, rax
jne 0x412fd0
lea rdx, [0x0047b0a0]
mov ecx, 0x200000
call fcn.0042267c
mov qword [0x004e30d8], rax
test rax, rax
je 0x412fd3
mov word [rax], si
cmp qword [0x004ee5f0], rsi
jne 0x412ffa
xor ecx, ecx
mov edx, 0x22000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x004ee5f0], rax
or ebx, 0xffffffff
mov dword [0x004ee5f8], esi
test rdi, rdi
je 0x413021
cmp word [rdi], si
je 0x413021
mov rdx, rdi
lea rcx, [0x004e1ad0]
call fcn.00403ec4
jmp 0x413124
mov rax, qword [0x004e1ad8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rdi, qword [0x004e1ad8]
test rdi, rdi
je 0x413065
mov edx, dword [0x004e1ae4]
mov rcx, rdi
call fcn.004293f8
mov rdi, qword [0x004e1ad8]
mov rcx, rax
jmp 0x413067
mov ecx, esi
mov dword [0x004e1ae0], ecx
test rdi, rdi
je 0x4130c3
lea eax, [rcx + 0xb]
cmp eax, dword [0x004e1ae4]
jae 0x4130c3
movaps xmm0, xmmword [0x00490d70]
mov ecx, ecx
movups xmmword [rdi + rcx*2], xmm0
mov eax, dword [0x00490d80]
mov dword [rdi + rcx*2 + 0x10], eax
movzx eax, word [reloc.WS2_32.dll_WSAStartup]
mov word [rdi + rcx*2 + 0x14], ax
mov eax, dword [0x004e1ae0]
add eax, 0xb
mov dword [0x004e1ae0], eax
mov ecx, eax
mov rax, qword [0x004e1ad8]
mov word [rax + rcx*2], si
mov rdi, qword [0x004e1ad8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, ebx
jne 0x4130df
mov rcx, qword [0x004e1ad8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [0x004e1ad8]
test rcx, rcx
je 0x413124
mov edx, dword [0x004e1ae0]
lea eax, [rdx + 8]
cmp eax, dword [0x004e1ae4]
jae 0x413124
movups xmm0, xmmword [str.Crashes]
movdqu xmmword [rcx + rdx*2], xmm0
mov eax, dword [0x004e1ae0]
add eax, 8
mov dword [0x004e1ae0], eax
mov ecx, eax
mov rax, qword [0x004e1ad8]
mov word [rax + rcx*2], si
mov rcx, qword [0x004e1ad8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, ebx
jne 0x413144
mov rcx, qword [0x004e1ad8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, str.MT5WEBSETUP64
lea rcx, [0x004e1cf0]
call fcn.00403ec4
lea rdx, str.MetaTrader_Web_Setup
lea rcx, [0x004e1f10]
call fcn.00403ec4
mov eax, 0xd78
mov dword [0x004e3068], 0x1f4
mov dword [0x004e306c], eax
mov dword [0x004e3070], 0x25de
mov dword [0x004ee648], eax
mov rax, qword [0x004e2138]
test rax, rax
je 0x4131a4
mov dword [0x004e2140], esi
mov word [rax], si
cmp qword [0x004e30d0], rsi
jne 0x4131bb
xor ecx, ecx
call fcn.004370d4
mov qword [0x004e30d0], rax
lea rdx, str.27_Sep_2022
lea rcx, [0x004e3078]
call fcn.00403ec4
cmp dword [0x004e29c0], 1
jb 0x4131ec
mov rax, qword [0x004e29b8]
test rax, rax
je 0x4131ec
cmp word [rax], si
jne 0x413409
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x200
call fcn.00424830
mov r8d, 0x100
lea rdx, [rsp + 0x30]
lea rcx, str.CLIENTNAME
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
or rdi, 0xffffffffffffffff
test eax, eax
jne 0x41323e
mov r8d, 0x100
lea rdx, [rsp + 0x30]
lea rcx, str.COMPUTERNAME
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x413315
lea rdx, [rsp + 0x30]
lea rcx, [0x004e29b0]
call fcn.00403ec4
mov r8d, 0x100
lea rdx, [rsp + 0x30]
lea rcx, str.USERDOMAIN
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x413315
mov rdx, qword [0x004e29b8]
test rdx, rdx
je 0x413315
mov ecx, dword [0x004e29c0]
lea eax, [rcx + 1]
cmp eax, dword [0x004e29c4]
jae 0x4132bd
movzx eax, word [0x0048d7b8]
mov word [rdx + rcx*2], ax
mov eax, dword [0x004e29c0]
inc eax
mov dword [0x004e29c0], eax
mov ecx, eax
mov rax, qword [0x004e29b8]
mov word [rax + rcx*2], si
mov rdx, qword [0x004e29b8]
test rdx, rdx
je 0x413315
lea rax, [rsp + 0x30]
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], si
jne 0x4132ca
test ebx, ebx
je 0x413315
mov ecx, dword [0x004e29c0]
lea eax, [rcx + rbx]
cmp eax, dword [0x004e29c4]
jae 0x413315
lea rcx, [rdx + rcx*2]
mov r8d, ebx
add r8, r8
lea rdx, [rsp + 0x30]
call fcn.00424180
mov ecx, dword [0x004e29c0]
mov rax, qword [0x004e29b8]
add ecx, ebx
mov dword [0x004e29c0], ecx
mov word [rax + rcx*2], si
mov dword [rsp + 0x28], 0x100
lea r9, [rsp + 0x30]
lea r8, str.MQL5.Login
mov dword [rsp + 0x20], 0x1fe
lea rdx, str.SOFTWAREMetaQuotes_SoftwareSettings
mov rcx, 0xffffffff80000001
call fcn.00404704
test al, al
je 0x413409
cmp word [rsp + 0x30], si
je 0x413409
mov rdx, qword [0x004e29b8]
test rdx, rdx
je 0x413409
mov ecx, dword [0x004e29c0]
lea eax, [rcx + 5]
cmp eax, dword [0x004e29c4]
jae 0x4133b4
movsd xmm0, qword [str._for]
movsd qword [rdx + rcx*2], xmm0
movzx eax, word [0x00492ef0]
mov word [rdx + rcx*2 + 8], ax
mov eax, dword [0x004e29c0]
add eax, 5
mov dword [0x004e29c0], eax
mov ecx, eax
mov rax, qword [0x004e29b8]
mov word [rax + rcx*2], si
mov rdx, qword [0x004e29b8]
test rdx, rdx
je 0x413409
lea rax, [rsp + 0x30]
inc rdi
cmp word [rax + rdi*2], si
jne 0x4133be
test edi, edi
je 0x413409
mov ecx, dword [0x004e29c0]
lea eax, [rcx + rdi]
cmp eax, dword [0x004e29c4]
jae 0x413409
lea rcx, [rdx + rcx*2]
mov r8d, edi
add r8, r8
lea rdx, [rsp + 0x30]
call fcn.00424180
mov ecx, dword [0x004e29c0]
mov rax, qword [0x004e29b8]
add ecx, edi
mov dword [0x004e29c0], ecx
mov word [rax + rcx*2], si
mov ebx, 0x400
lea rcx, [rbp + 0x130]
mov r8d, ebx
xor edx, edx
call fcn.00424830
lea rcx, [rbp + 0x130]
call fcn.00412cd8
lea rdx, [rbp + 0x130]
lea rcx, [0x004e2bd0]
call fcn.00403ec4
lea r11, [rsp + 0x630]
mov ecx, ebx
mov rbx, qword [r11 + 0x10]
lea rdi, [rbp + 0x130]
mov rsi, qword [r11 + 0x18]
xor eax, eax
rep stosb byte [rdi], al
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret