Function at 0x472bf0
Capabilities:
Create directory
Delete file
Encode data using xor
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa14
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xa10], eax
push ebx
push esi
push edi
push dword [0x4e4f4c]
call fcn.004909de
push 2
push 0x32
call fcn.004909d3
add esp, 0xc
mov dword [0x4e4f4c], eax
push 0x4e5e28
push 0x32
push eax
push 0x4b34dc
push 0x4c22a0
push 0x4c22a4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x472e25
push dword [0x4e4f4c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
cmp eax, 0x14
jl 0x472e25
push dword [0x4e4f4c]
call esi
mov ecx, 0x1ad
lea edi, [esp + 0x218]
mov esi, str.KJYHVSIHVSIU8SV98S8VS7SV8VS7S878SV7SDF87S8VF8S7VDF8SWD78FS8F8S97DF9SDFVSD7RE8475F73JDJK84F8VS7DV8SDF87SD8FV7S89SDVF8S9VD9F87VSDFV7S9F8S98E8MFK34574S42TFSJSEJVTSVT89S7F9VSDF78SWT7GFS8G7FS87EGDFSF7SW9RTV9E34RVS9DFV98SD7FV7SDF7VS98DF78DV9SDFV98SD7F9S8K7438AT83476CV53489WVRVW7R9W8E7RT98ST89SRT9S7TFSDF8V79WE48RTVW8RT87SW9ERWTJDTSD8RT7JD8ET79WE8RT8RJT8D7J8VT7VDJMN8RT7VE89R7T98D78T78R9D7T98D78RT7VD87RT89D7R89TVDJTD7VJ4J5E9NN9EH89SD78NF97MS897SDF98NS98FN7SD7948573FLKVE5JVS7F98JS98JG9D78JGKWE49J57GJ89E7G5K9E795K8GF7E98GJYD9KGJY57WF74IK5G7W67D87Y659D65Y98EDKY65J98DY5T9YDJKD5J89YK6DJ8TY5KD8J5TJY7D97T5JK9DTK598J7DHOT9GYDHOD9JYRT98YDR98K7DJR89T7D89OKTJY9OY8RGJ9ODY79OKD7RK98GJYRF98JY7ETM85LKA843G9O8KYJ89FGYJMT98YJRYT77H68G5RYJ6YK9OR54J8G6YRJ856YTR856Y9R8Y56JTO8RGI7Y6O8RY56JGRY6IY6TJ8RY6H5T7IJ8RY5H6T7IJRGI87IHR8IJ5H66JIY5TJRY6R8Y6HT8IJR6GY76RTG8IJRY68GYR867YHTG
mov ebx, eax
rep movsd dword es:[edi], dword [esi]
push 0x14a
lea eax, [esp + 0x8d2]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0048fb10
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
add esp, 0xc
push 0x4c22a8
push 0x4e4f98
call esi
push str.prowt.dll
push 0x4e4f50
call esi
mov eax, dword [0x4cc1d8]
cmp eax, 0x64
je 0x472ce9
cmp eax, 0x12c
jne 0x472d10
push str.remwt
push 0x4e4f98
call esi
push str._remwt.dll
push 0x4e4f50
call esi
push str.FH483MFY5843Y75G693875Y6GY29375Y672Y549G7M6Y2745YG62845JKYD7H26YFH4H7286JGY57YH6OK2YIJW4DR875YH48I37JY568HINGWK6MNYHF78I5K3YJD5876Y3985K7F6JH7Y45G6J7ME785J6HYEJUY56G67EYH6GIE7U5EYN6H8IJY7F6EIYM6EI87JYHI75I8J6YGJI8E76Y5HI87Y6E57I8Y6G7YH5E6I754YIT6JDGKYHIY67Y5HGY76K5JD74Y678YT745Y68J47Y6478TGI756YI57GMJ7DY456J7GY875YG87DH56GJ6H8IKJ75YH687YH8I7YHJG8885H8IJE4H68475JY68MH5476NN78HN75GH47856YHMK_t_t_t_t_t_38274K28394F39472J34FHSFRKUS45OG434S7YHJG8885H8IJE4H68475JY68MH5476NN78HN75GH47856YHMK7YHJG8885H8IJE4H68475JY68MH5476NN78HN75GH47856YHMK7YHJG8885H8IJE4H68475JY68MH5476NN78HN75GH47856YHMK7YHJG8885H8IJE4H68475JY68MH5476NN78HN75GH47856YHMK7YHJG8885H8IJE4H68475JY68MH5476NN78HN75GH47856YHMK7YHJG8885H8IJE4H68475JY68MH5476NN78HN75GH47856YHMK7YHJG8885H8IJE4H68475JY68MH5476NN78HN75GH47856YHM7YHJG8885H8IJE4H6847
jmp 0x472d06
push str.clscwt
push 0x4e4f98
call esi
push str.clscwt.dll
push 0x4e4f50
call esi
push str.9NF478933W7Y695JW7TH4Y5O84KJ3HO9NF743847583F87EKOJY6OE47H6Y978G5JY689EWY45K0TJY5OE4YHMGOTY54JTGH75E46JGYEO86MYJD45F78748F3HGJI8EJY5KT4E74H5TK87JY6GK98E7J4Y659KG8EJY7546987KGJEY56987KGTA87K4377832JEY549O8JE7YG548O6YJE54J7Y6EG8Y45TIO8EJY5T8OROKJ9FY56E8JY4596J8EGY568YE587YFHTE845TYJHEJ875Y6JHI7EY546JHGEI5T7IGYE48I5JTHEGI8J57HY78FJW98FY48OW57F9W34F5Y7OJ4983Y75J9OS454F78W34MJ5Y3WJ945YFW5J3479OWK43Y5O89RWY43J8H5UIWFY598O7YWM985647YHW25TPYN5373T398JK457Y689OJF7EY45689OKFEJ7YH549867YGKE387JDKUFR734JH78456YFK0EJ7569O8KE475Y6TJ9KGJ8Y56G87KGFJHE568YGTJO8E547U69KOGEFJ7U659O87J48R7JF47HTEU9J86YO9E8UG6K59OU49EGU589TYGEO9K845Y6O97KE485YH68ERY45J6GYRJEO895YG6O8JR4Y56H8JGRY5TIJHTGI86HYTR5J7YRI8JY6KJG8RYTJK8YKJ85YHTR87Y6TJG8RY6JT8RYHJT7RGJYHH756YHGJR87YTHIJH6YGRH5IJR7Y6IG8JTHYH6RJGTRU6YIKRHY856GJIR7Y56TJ7GKHJRH56RY75KJ7TRY67GFH6I8
lea eax, [esp + 0x21c]
push eax
call esi
mov ax, word [esp + 0x218]
lea ecx, [esp + 0x218]
test ax, ax
je 0x472d44
movzx edx, ax
nop word [eax + eax]
xor edx, 1
lea ecx, [ecx + 2]
mov word [ecx - 2], dx
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x472d30
mov eax, dword [0x4e4f4c]
lea eax, [eax + ebx*2]
add eax, 0xffffffe8
push eax
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x472dc3
call fcn.00472210
test eax, eax
je 0x472dbc
mov dword [0x4e4f34], 1
mov dword [0x4e4f38], 1
mov dword [0x4e4f3c], 1
mov dword [0x4e4f44], 1
mov dword [0x4e4f48], 1
mov dword [0x4e4f30], 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa10]
xor ecx, esp
call fcn.0048ea75
mov esp, ebp
pop ebp
ret
mov edx, 0x4b32e4
jmp 0x472e20
lea eax, [esp + 0xc]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
test eax, eax
jne 0x472e04
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push str.WinTools
lea eax, [esp + 0x14]
push eax
call esi
push 0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x4e4f50
lea eax, [esp + 0x14]
push eax
call esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x4b3320
call fcn.004722d0
mov ecx, dword [esp + 0xa1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048ea75
mov esp, ebp
pop ebp
ret