Function at 0x4017e0
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x400
lea eax, [ebp - 0x908]
mov esi, ecx
push 0
push eax
call fcn.0040bf00
add esp, 0xc
lea eax, [ebp - 0x108]
push pe_nt_image_headers32
push 0
push eax
call fcn.0040bf00
add esp, 0xc
lea eax, [ebp - 0x508]
push 0x400
push 0
push eax
call fcn.0040bf00
add esp, 0xc
test esi, esi
je 0x401ae2
cmp dword [esi + 4], 4
jne 0x401ae2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x401ae2
push 7
mov edx, str.symlink
call fcn.00408b60
add esp, 4
test eax, eax
je 0x401ae2
cmp dword [eax + 4], 5
jne 0x401ae2
mov ebx, dword [eax + 8]
mov dword [ebp - 0xd14], ebx
test ebx, ebx
je 0x401ae2
mov edi, dword [ebx + 8]
mov dword [ebp - 0xd0c], edi
xor edi, edi
mov ecx, dword [ebp - 0xd0c]
mov dword [ebp - 0xd10], edi
test ecx, ecx
je 0x401ae2
nop dword [eax + eax]
cmp edi, dword [ebx + 8]
jae 0x401ad3
mov eax, dword [ebx + 4]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x401ad3
cmp dword [eax + 4], 4
jne 0x401ad3
mov esi, dword [eax + 8]
test esi, esi
je 0x401ad3
push 3
mov edx, 0x42dd54
mov ecx, esi
call fcn.00408b60
add esp, 4
test eax, eax
je 0x401acd
xor edx, edx
lea ecx, [eax + 8]
cmp dword [eax + 4], 2
cmovne ecx, edx
test ecx, ecx
je 0x401acd
mov eax, dword [ecx]
test eax, eax
je 0x401acd
push eax
mov edx, 0x200
lea ecx, [ebp - 0x908]
call fcn.004085d0
xor eax, eax
add esp, 4
mov word [ebp - 0x50a], ax
cmp ax, word [ebp - 0x908]
je 0x401acd
push 0x200
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x908]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
lea ecx, [ebp - 0x908]
mov word [ebp - 0x10a], ax
mov edx, 0x200
lea eax, [ebp - 0x508]
push eax
call fcn.004075c0
add esp, 4
mov edx, str.dest
mov ecx, esi
push 4
call fcn.00408b60
add esp, 4
test eax, eax
je 0x401ac4
xor edx, edx
lea ecx, [eax + 8]
cmp dword [eax + 4], 2
cmovne ecx, edx
test ecx, ecx
je 0x401ac4
mov eax, dword [ecx]
test eax, eax
je 0x401ac4
push eax
mov edx, 0x80
lea ecx, [ebp - 0x108]
call fcn.004085d0
xor eax, eax
add esp, 4
mov word [ebp - 0xa], ax
cmp ax, word [ebp - 0x108]
je 0x401acd
push 0x200
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
lea ecx, [ebp - 0x108]
mov word [ebp - 0x10a], ax
mov edx, 0x80
lea eax, [ebp - 0x508]
push eax
call fcn.004075c0
add esp, 4
lea eax, [ebp - 0xd08]
push 0x400
push 0
push eax
call fcn.0040bf00
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x1ff
push eax
lea eax, [ebp - 0xd08]
push eax
call fcn.0040e084
xor eax, eax
lea esi, [ebp - 0xd08]
mov word [ebp - 0x90a], ax
xor ecx, ecx
mov ax, word [ebp - 0xd08]
add esp, 0xc
cmp cx, ax
je 0x401aad
mov ebx, 0x2f
movzx ecx, ax
lea edi, [ebx + 0x2d]
nop dword [eax]
cmp bx, cx
je 0x401a7a
cmp di, cx
jne 0x401a91
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0xd08]
push eax
call fcn.00415817
add esp, 4
mov word [esi], bx
movzx eax, word [esi + 2]
add esi, 2
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x401a70
mov edi, dword [ebp - 0xd10]
mov ebx, dword [ebp - 0xd14]
push ecx
lea edx, [ebp - 0x908]
lea ecx, [ebp - 0x108]
call fcn.00407740
add esp, 4
jmp 0x401acd
xor eax, eax
mov word [ebp - 0x108], ax
mov ecx, dword [ebp - 0xd0c]
inc edi
mov dword [ebp - 0xd10], edi
cmp edi, ecx
jb 0x4018b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a851
mov esp, ebp
pop ebp
ret