Function at 0x401dc0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x422084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push edi
push 0x424ccc
mov dword [0x424cc8], 0x41c230
call esi
xor ebx, ebx
mov edi, 0xf
xor eax, eax
push 0x424d84
mov dword [0x424cc8], 0x41c240
mov dword [0x424ce4], 0x41c248
mov dword [0x424cfc], edi
mov dword [0x424cf8], ebx
mov byte [0x424ce8], bl
mov dword [0x424d18], edi
mov dword [0x424d14], ebx
mov byte [0x424d04], bl
mov dword [0x424d34], edi
mov dword [0x424d30], ebx
mov byte [0x424d20], bl
mov dword [0x424d50], edi
mov dword [0x424d4c], ebx
mov byte [0x424d3c], bl
mov byte [0x424d58], bl
mov dword [0x424d70], 7
mov dword [0x424d6c], ebx
mov word [0x424d5c], ax
mov dword [0x424d78], ebx
mov dword [0x424d7c], ebx
mov dword [0x424d80], 0x41c230
call esi
xor eax, eax
xor ecx, ecx
push 0x424dbc
mov dword [0x424d80], 0x41c250
mov dword [0x424d9c], ebx
mov dword [0x424da0], ebx
mov dword [0x424da4], ebx
mov dword [0x424da8], eax
mov dword [0x424dac], ecx
mov dword [0x424db0], ebx
mov dword [0x424db8], 0x41c230
call esi
xor eax, eax
xor ecx, ecx
push 0x424df4
mov dword [0x424db8], 0x41c250
mov dword [0x424dd4], ebx
mov dword [0x424dd8], ebx
mov dword [0x424ddc], ebx
mov dword [0x424de0], eax
mov dword [0x424de4], ecx
mov dword [0x424de8], ebx
mov dword [0x424df0], 0x41c230
call esi
push ebx
xor eax, eax
xor ecx, ecx
push ebx
mov dword [0x424df0], 0x41c250
mov dword [0x424e0c], ebx
mov dword [0x424e10], ebx
mov dword [0x424e14], ebx
mov dword [0x424e18], eax
mov dword [0x424e1c], ecx
mov dword [0x424e20], ebx
mov dword [0x424e44], edi
mov dword [0x424e40], ebx
mov byte [0x424e30], bl
mov dword [0x424e64], edi
mov dword [0x424e60], ebx
mov byte [0x424e50], bl
mov dword [0x424e80], edi
mov dword [0x424e7c], ebx
mov byte [0x424e6c], bl
mov dword [0x424e88], ebx
mov byte [0x424e8c], bl
mov dword [0x424e90], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [0x424e28], eax
call edi
push 0x423a80
push 0x20
mov dword [0x424e2c], eax
call fcn.00404214
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x401fca
lea ecx, [edi + 8]
push ecx
mov dword [edi], vtable.CLog.0
mov dword [edi + 4], ebx
call esi
jmp 0x401fcc
xor edi, edi
mov dword [0x424e94], edi
cmp edi, ebx
je 0x40211d
push 1
push 5
lea edx, [ebp - 0x20c]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x41c178
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00404555
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 0xc
push ebx
lea ecx, [ebp - 0x20c]
push ecx
call esi
push str.sys_
lea edx, [ebp - 0x20c]
push 0x104
push edx
call fcn.00404555
add esp, 0xc
push ebx
lea eax, [ebp - 0x20c]
push eax
call esi
push str.log_
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call fcn.00404555
add esp, 0xc
push ebx
lea edx, [ebp - 0x20c]
push edx
call esi
push str.im_upg_
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00404555
lea eax, [ebp - 0x20c]
add esp, 0xc
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402080
sub eax, edx
sar eax, 1
push ebx
mov esi, eax
call fcn.00406253
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x234], edx
push ecx
lea edx, [ebp - 0x230]
push edx
mov dword [ebp - 0x238], eax
call fcn.004046fd
lea eax, [ebp - 0x230]
push eax
mov ecx, 0x104
push str._Y__m__d__H__M__S.log
sub ecx, esi
push ecx
lea edx, [ebp + esi*2 - 0x20c]
push edx
call fcn.00405688
mov esi, dword [0x424e94]
add esp, 0x1c
lea edi, [esi + 8]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4020fd
push eax
call fcn.0040406d
add esp, 4
mov dword [esi + 4], ebx
push 0x40
lea eax, [ebp - 0x20c]
push 0x41c154
push eax
call fcn.00404603
add esp, 0xc
push edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x424cc8
mov dword [0x424e90], 0x424ce4
pop ebx
call fcn.00402f3e
mov esp, ebp
pop ebp
ret