Function at 0x47b030
Capabilities:
Create directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
mov esi, dword [0x6349f0]
xor eax, eax
push ebp
push 0x47b53f
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00463b20
mov eax, dword [0x635008]
movzx eax, byte [eax]
xor al, 1
mov edx, dword [esi]
mov byte [edx + 4], al
mov al, 1
call fcn.0047a740
mov eax, 0x47b558
call fcn.0047a53c
xor ebx, ebx
call fcn.00403424
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x47b564
call sub.kernel32.dll_CreateFileA_1
mov eax, dword [0x635008]
cmp byte [eax], 0
je 0x47b0cc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
call fcn.00405858
mov edi, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
jmp 0x47b0d8
mov edi, 0x47b578
mov dword [ebp - 0xc], 0xb
mov eax, 0x47b58c
call fcn.00464358
mov eax, 0x47b58c
call fcn.00464358
mov eax, 0x47b58c
call fcn.00464358
mov eax, 0x47b58c
call fcn.00464358
push 0x20
lea eax, [ebp - 0x10]
call fcn.00423630
lea eax, [ebp - 0x10]
mov edx, 0x47b5a4
call fcn.00405694
mov eax, dword [ebp - 0x10]
call fcn.00405858
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x14]
call fcn.00423630
lea eax, [ebp - 0x14]
mov edx, 0x47b5a4
call fcn.00405694
mov eax, dword [ebp - 0x14]
call fcn.00405858
push eax
call sub.kernel32.dll_DeleteFileA
push 0
lea eax, [ebp - 0x18]
call fcn.00423630
lea eax, [ebp - 0x18]
mov edx, 0x47b5a4
call fcn.00405694
mov eax, dword [ebp - 0x18]
call fcn.00405858
push eax
call sub.kernel32.dll_CreateDirectoryA
mov eax, 0x7d0
call fcn.0040344c
add ax, 0x3e9
push eax
mov eax, dword [0x634eec]
mov eax, dword [eax]
push eax
mov eax, 0x7d0
call fcn.0040344c
mov ecx, eax
add cx, 0x7d0
movzx edx, word [ebp - 0xc]
mov eax, edi
call fcn.004781fc
test eax, eax
jne 0x47b50c
call fcn.0047afa8
mov eax, dword [0x634df4]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x34], al
mov eax, dword [0x634f54]
mov eax, dword [eax]
mov edx, dword [esi]
mov dword [edx + 0x30], eax
mov eax, dword [0x634bb8]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x24], al
mov eax, dword [0x634c10]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x25], al
mov eax, dword [0x634f00]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x26], al
mov eax, dword [0x634cf8]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x27], al
mov eax, dword [0x634d4c]
mov eax, dword [eax]
mov edx, dword [esi]
mov dword [edx + 0x28], eax
mov eax, dword [0x634a8c]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x2c], al
mov eax, dword [0x634a34]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x2d], al
mov eax, dword [0x63511c]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x35], al
call fcn.00477e9c
movzx eax, ax
mov edx, dword [esi]
mov dword [edx + 0x10], eax
call fcn.00477e94
movzx eax, ax
mov edx, dword [esi]
mov dword [edx + 0x14], eax
mov eax, dword [0x634998]
movzx eax, byte [eax + 0x64]
mov edx, dword [esi]
mov byte [edx + 0x18], al
call sub.kernel32.dll_GetCurrentProcessId
mov edx, dword [esi]
mov dword [edx], eax
mov eax, dword [0x635004]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x19], al
mov eax, dword [0x634f5c]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x1a], al
mov eax, dword [0x634d94]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x1b], al
mov eax, dword [0x634c7c]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x36], al
mov eax, dword [esi]
mov byte [eax + 0x1c], 0
mov eax, dword [0x634988]
mov eax, dword [eax]
call fcn.0042267c
mov edx, dword [esi]
mov dword [edx + 0x20], eax
push 0x13880
mov ecx, 0x4d36ac
mov eax, 0x47b5b4
xor edx, edx
call fcn.00464e90
push 0x13880
mov ecx, 0x4e6f2c
mov eax, 0x47b5bc
xor edx, edx
call fcn.00464e90
push 0x47b5c8
call sub.kernel32.dll_DeleteFileW
push 0x47b5f8
call sub.kernel32.dll_DeleteFileW
push 0x20
push 0x47b628
call sub.kernel32.dll_SetFileAttributesW
push 0x47b628
call sub.kernel32.dll_DeleteFileW
push 0x20
push 0x47b688
call sub.kernel32.dll_SetFileAttributesW
push 0x47b688
call sub.kernel32.dll_DeleteFileW
mov eax, 0x47b6f4
call fcn.00479bcc
mov eax, 0x47b70c
call fcn.00479bcc
mov eax, 0x47b724
call fcn.00479bcc
lea edx, [ebp - 0x1c]
mov eax, dword [0x634998]
mov eax, dword [eax + 0x5c]
call fcn.00422800
cmp dword [ebp - 0x1c], 0
je 0x47b356
mov eax, dword [0x634998]
mov eax, dword [eax + 0x5c]
call fcn.00479bcc
mov eax, 0x47b73c
call fcn.0042337c
mov eax, dword [0x634f84]
cmp byte [eax], 0
je 0x47b380
mov ecx, 0x47b748
mov eax, 0x504dac
mov edx, 0x9000
call fcn.004647c4
jmp 0x47b3c0
push 0x20
push 0x47b758
call sub.kernel32.dll_SetFileAttributesW
push 0x20
push 0x47b76c
call sub.kernel32.dll_SetFileAttributesW
push 0x47b784
call sub.kernel32.dll_DeleteFileA
push 0x47b790
call sub.kernel32.dll_DeleteFileA
mov ecx, 0x47b748
mov eax, 0x4fa7ac
mov edx, 0xa600
call fcn.004647c4
mov edx, 0x47b79c
mov eax, 0x47b7a8
mov ecx, 0xa
call fcn.004236ec
mov ecx, 0x47b7b8
mov eax, 0x50ddac
mov edx, 0x4000
call fcn.004647c4
mov ecx, 0x47b7dc
mov eax, 0x511dac
mov edx, 0x8000
call fcn.004647c4
mov ecx, 0x47b80c
mov eax, 0x519dac
mov edx, 0x8000
call fcn.004647c4
mov ecx, 0x47b83c
mov eax, str.DDS_
mov edx, 0x10080
call fcn.004647c4
mov ecx, 0x47b858
mov eax, 0x48fe78
mov edx, 0xcaa0
call fcn.004647c4
mov ecx, 0x47b870
mov eax, str.MAXFILE_C3_00001MOTI
mov edx, 0x56f0
call fcn.004647c4
mov ecx, 0x47b888
mov eax, 0x49c918
mov edx, 0xd916
call fcn.004647c4
mov ecx, 0x47b8a0
mov eax, str.MAXFILE_C3_00001PHY
mov edx, 0x13d09
call fcn.004647c4
mov eax, dword [0x635008]
cmp byte [eax], 0
je 0x47b4e7
mov eax, dword [ebp - 8]
mov edx, eax
mov eax, 0x47b6f4
call fcn.0047964c
mov eax, dword [ebp - 8]
mov edx, eax
mov eax, 0x47b70c
call fcn.0047964c
mov eax, dword [ebp - 8]
mov edx, eax
mov eax, 0x47b724
call fcn.0047964c
lea edx, [ebp - 0x20]
mov eax, dword [0x634998]
mov eax, dword [eax + 0x5c]
call fcn.00422800
cmp dword [ebp - 0x20], 0
je 0x47b4d3
mov eax, dword [ebp - 8]
mov edx, eax
mov eax, dword [0x634998]
mov eax, dword [eax + 0x5c]
call fcn.0047964c
mov ecx, 0x47b8b4
mov eax, 0x521dac
mov edx, 0x1167d
call fcn.004647c4
mov eax, dword [ebp - 4]
call fcn.0047a3e0
mov ebx, eax
test bl, bl
je 0x47b502
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x634974]
mov dword [edx], eax
mov eax, dword [0x634a40]
mov byte [eax], 1
jmp 0x47b51c
push 0x10
push 0
push 0x47b8cc
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b546
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret