Function at 0x473280
Capabilities:
Create directory
Query environment variable
Set environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4c9a9e
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x50b384]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50b384]
xor eax, esp
push eax
lea eax, [esp + 0xb4]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], esi
cmp byte [0x50cd34], bl
je 0x4735d0
push ebx
lea eax, [esp + 0x98]
push eax
mov byte [esp + 0x22], bl
call fcn.00471f60
mov edx, dword [str.acro_rd_dir]
mov ebp, 7
xor ecx, ecx
mov eax, edx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov word [esp + 0x28], cx
lea edi, [eax + 2]
jmp 0x473310
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x473310
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x2c]
call fcn.00401ce4
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x80]
push ecx
mov byte [esp + 0xc8], 1
call fcn.00438b60
add esp, 0xc
mov edi, 8
mov byte [esp + 0xbc], 3
cmp dword [esp + 0x3c], edi
jb 0x47336f
mov edx, dword [esp + 0x28]
push edx
call fcn.0048e976
add esp, 4
mov ecx, dword [esp + 0x7c]
xor eax, eax
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov word [esp + 0x28], ax
cmp dword [esp + 0x90], edi
jae 0x47338f
lea ecx, [esp + 0x7c]
mov eax, dword [esp + 0x98]
cmp dword [esp + 0xac], edi
jae 0x4733a6
lea eax, [esp + 0x98]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
test eax, eax
jne 0x4733c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x47356b
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ebx
push ebx
push str.TEMP
call ebp
lea ecx, [esp + 0x1c]
push ecx
inc eax
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x24], ebx
call fcn.00429500
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
sub esi, eax
sar esi, 1
push esi
push eax
push str.TEMP
mov byte [esp + 0xc8], 4
call ebp
push ebx
push ebx
push 0x4f1740
call ebp
lea edx, [esp + 0x1c]
inc eax
push edx
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], ebx
call fcn.00429500
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
sub edi, ebx
sar edi, 1
push edi
push ebx
push 0x4f1740
mov byte [esp + 0xc8], 5
call ebp
mov eax, dword [esp + 0x7c]
mov ebp, 8
cmp dword [esp + 0x90], ebp
jae 0x473454
lea eax, [esp + 0x7c]
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x47351b
mov eax, dword [esp + 0x7c]
cmp dword [esp + 0x90], ebp
jae 0x473479
lea eax, [esp + 0x7c]
mov ebp, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push eax
push 0x4f1740
call ebp
test eax, eax
je 0x473521
call fcn.004707d0
mov dword [0x50cd38], eax
test eax, eax
je 0x473521
push 0x4ea4c0
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x64]
push ecx
call fcn.00409c6f
add esp, 0xc
mov ecx, dword [esp + 0x20]
push eax
mov byte [esp + 0xc0], 6
call fcn.004721d0
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1b], al
mov byte [esp + 0xbc], 5
call fcn.0040199c
cmp byte [esp + 0x1b], 0
je 0x473521
push 0x4d0ef8
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x64]
push eax
call fcn.00409c6f
push eax
mov byte [esp + 0xcc], 7
call fcn.00410113
add esp, 0x10
lea ecx, [esp + 0x5c]
call fcn.0040199c
mov byte [esp + 0x1a], 1
jmp 0x473521
mov ebp, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp esi, 1
mov esi, dword [esp + 0x44]
jbe 0x473532
push esi
push str.TEMP
call ebp
cmp edi, 1
jbe 0x47353f
push ebx
push 0x4f1740
call ebp
test ebx, ebx
je 0x47354c
push ebx
call fcn.0048e976
add esp, 4
test esi, esi
je 0x473559
push esi
call fcn.0048e976
add esp, 4
mov esi, dword [esp + 0x20]
xor ebx, ebx
lea ebp, [ebx + 7]
lea edi, [ebx + 8]
cmp byte [esp + 0x1a], bl
jne 0x473572
mov byte [0x50cd34], 0
cmp dword [esp + 0x90], edi
jb 0x473588
mov ecx, dword [esp + 0x7c]
push ecx
call fcn.0048e976
add esp, 4
xor edx, edx
mov dword [esp + 0x90], ebp
mov dword [esp + 0x8c], ebx
mov word [esp + 0x7c], dx
mov dword [esp + 0xbc], 0xffffffff
cmp dword [esp + 0xac], edi
jb 0x4735c1
mov eax, dword [esp + 0x98]
push eax
call fcn.0048e976
add esp, 4
cmp byte [0x50cd34], 0
jne 0x4736e0
jmp 0x4735d8
mov ebp, 7
lea edi, [ebp + 1]
call fcn.00446db0
cmp eax, 4
jl 0x473613
push 1
push str.TempLow
lea ecx, [esp + 0x64]
push 0x1c
push ecx
call fcn.00470ba0
add esp, 0x10
push eax
mov ecx, esi
mov dword [esp + 0xc0], edi
mov dword [esp + 0x18], 1
call fcn.004721d0
test al, al
je 0x47366a
push ebx
push str.TempAdobeAcrobat10.0
lea edx, [esp + 0x48]
push 0x1c
push edx
call fcn.00470ba0
add esp, 0x10
or dword [esp + 0x14], 2
push eax
mov ecx, esi
mov dword [esp + 0xc0], 9
call fcn.00472020
test al, al
je 0x47366a
push 1
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call fcn.00471f60
or dword [esp + 0x14], 4
push eax
mov ecx, esi
mov dword [esp + 0xc0], 0xa
call fcn.004721d0
test byte [esp + 0x14], 4
je 0x473698
and dword [esp + 0x14], 0xfffffffb
cmp dword [esp + 0x3c], edi
jb 0x473689
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0048e976
add esp, 4
xor edx, edx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov word [esp + 0x28], dx
test byte [esp + 0x14], 2
je 0x4736c6
and dword [esp + 0x14], 0xfffffffd
cmp dword [esp + 0x58], edi
jb 0x4736b7
mov eax, dword [esp + 0x44]
push eax
call fcn.0048e976
add esp, 4
xor ecx, ecx
mov dword [esp + 0x58], ebp
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], cx
test byte [esp + 0x14], 1
je 0x4736e0
cmp dword [esp + 0x74], edi
jb 0x4736e0
mov edx, dword [esp + 0x60]
push edx
call fcn.0048e976
add esp, 4
mov al, 1
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0048ebcd
add esp, 0xac
ret