Function at 0x4719a0
Capabilities:
Create directory
Delete file
Encode data using xor
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa14
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0xa10], eax
push ebx
push esi
push edi
push dword [0x4ddf34]
call fcn.0048f74e
push 2
push 0x32
call fcn.0048f743
add esp, 0xc
mov dword [0x4ddf34], eax
push 0x4ded80
push 0x32
push eax
push 0x4ad29c
push 0x4bbf58
push 0x4bbf5c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x471bca
push dword [0x4ddf34]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
cmp eax, 0x14
jl 0x471bca
push dword [0x4ddf34]
call esi
push 0x12c
mov ebx, eax
lea edi, [esp + 0x21c]
lea eax, [esp + 0x8f0]
mov ecx, 0x1b5
mov esi, str.BV5TVWMU85YHT89VWH5T89YHWV548VUWV5KH3V7895YHKT7YH5890YJT78905YJC893YH5789YHTM9YDJ589OYUDH58HGCE7895HGMC78DJGR64NGV9J6475F73JDJK84SDH9V57TSNB5HV8M7E5H4HTE789J5HT78E4HJ5F78GHERJ85HTV8MFK34574S4278EJHT5789EH5TK8HECV548ETHJ589EH5K897EHT8HCVE0T78H8E7H4K578CH78054HT8JE45YUT9KJGVFYE578HV8E7HT78K4H78TCVFH54780JYHTF78E4HJT5784H8JT7HE8KCVFHJT78E95K7438AT83476HKHE478HT9JCVFE578GHT789EJ4H5T78JHV54789EVE4HKTE7895THK9V58H89W0V59M3YHE4SKFHMSUF78OCN4H87MYT78948573FLKVE5W54YNV78WMY578WYT78CKJ5W87TY4978WRTGMJTG5JCWG5F789HJG47Y5FJ378CYHT789K3HCF8973YH9F8C5H57WF74IK5G7W84WYFI78WHM89JC5TGJC78YW789YTJ8O4YS7OJMYT47VSYK4UNYHVFSK74YHGVM78E54H89MC7H785YHNVM8J7HC78EHG5F78E4YH5F78EYT578YFEJT785HTMHCE895YHJC57MHYE789TJG58OEYUT59K8UVT895HJT89VHG78EYHNCF7S7ETM85LKA843RE7NHF3784YC78EG457NTVHE5TMHEOK578THEY789K5JTMYH789EOV5NHO78E4HTJM8HV57MYHJM785HGJ87VJT78E5HYTK789JVYH58O7VF7WE4YG6S8NCJ89EK47
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0048e880
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
add esp, 0xc
push 0x4bbf60
push 0x4ddef0
call esi
push str.prowt.dll
push 0x4ddea8
call esi
mov eax, dword [0x4c5198]
cmp eax, 0x64
je 0x471a97
cmp eax, 0x12c
jne 0x471abe
push str.remwt
push 0x4ddef0
call esi
push str._remwt.dll
push 0x4ddea8
call esi
push str.SKMVU85EMUV85M4Y9V8WY89WYVP89MYRE89YV98M4TYVS89YT489SYT98YN6TG56EC3W234SC32SX23SC56VRU3NC7AYOM58YUP8NB4Y6789QYBV4OT89NTV84YM9TV8YAP9M8TYMVA94YTP9KA84YP9TMCQY4P89TYNRKUS45OG434S4T89VYN4978YTMV8954YUWTVP9M84YTP4S984U089W098JV478A5NB78V4H578AT64785H9T8473HJT5784YJ89JY8TYJ89FYTUFUGHUVNFUHURHVF8EJ54Y9836J798375CKJT7839J78TGF893J7CFY98J374YRT98EK7JTY897CHT89J3C45YT948J7TY894T6JVEYTJV38YT8O3EJ74YT938EJ7Y5489EH9Y7YE878MT54P98YUT49M856YU098K4FY5T89OYKTFRO85ULEG48J7EYJ784YF7E8YTF78JEY4T87JYF839472J34FHSF9O4756YEJ7G6Y78ETHF96485JTE785YKFE7YJ5987EJT6FHT5E786T5JFHE5TJ8EHTG5E8J7G6TI78ET48ETJ4FTH5E78T4J5HET54I8J85Y8338274K28394F4TYJ6FHER786H4UE7T45J3786Y5KJ374YTF8HE67FTEJ97T5JE7854JTF8E79T5Y9E78T54KJ9F783T589J7ETK9D57JT9E8745HTF9678EJ578E4TKF8J7T89O3K7TJ4D873TJ58D73T5978J3TYD87TD5Y8947T54H783HTG4Y5783J5F4Y9378T459K8D73YJ4T893J84H5YHG7WET4Y8WJ74YT87T78WG4J87Y58JF
jmp 0x471ab4
push str.clscwt
push 0x4ddef0
call esi
push str.clscwt.dll
push 0x4ddea8
call esi
push str.UMHT38O5MV70T35098WYHT89SM0589TYHS9OJG4TOSY50789KCWJ035V5IWCWMU8TM78W34Y70TVYWK78TY0S9K78C4YTS89034YT98KVS89YUKT9JSYO547TSNNF743847583F54YHTVSY5OS7M5YH09TVWK5YT678WK5C978WY057KCYT09JD45F78748F35YT0K9YWT895YKTVE058YTE079YHET0K95K8Y0978KTCY05YJTV9854YUT8905YKT9E54YBN98E4YKJT8YE07895YJT890B54YT9KVY8E4TA87K4377832YT7895VK5YH078EKYF059EYT05789YT7BVN5Y0789TKJV89EYTKVUE5K8CDU85YJTV78YJ578YTJB98DYTK98EYUVCR438HY09MC8W54Y0TWKC589Y0JTV8HW25TPYN53739354YKV890Y5KMVWTY05489YKTC895YU89W0TV895Y0TWKM89CY590T8WKY589TYWVJY540TV8KM5089VYTM89W5YT9387JDKUFR7340JY50W7TYKD54YW89054LTKV89W5YU0J89WY7M5YV78W0TY57887J48R7JF47HJWCY58TWK8954YT89W0CYK59TYW095KT8WY5089VYWJ895YT9KV8WJY5489TVW589K590JB0T89YW89VYWJ85YT78WVHN5YJV78W5YJT78YWC857TYWC785YT78WYJ78RFYW784YHTF47TJS7F4YDUIAMHPCORHPITVRET
lea eax, [esp + 0x21c]
push eax
call esi
mov ax, word [esp + 0x218]
lea ecx, [esp + 0x218]
test ax, ax
je 0x471ae9
movzx edx, ax
xor edx, 1
lea ecx, [ecx + 2]
mov word [ecx - 2], dx
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x471ad5
mov eax, dword [0x4ddf34]
lea eax, [eax + ebx*2]
add eax, 0xffffffe8
push eax
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x471b68
call fcn.00470fb0
test eax, eax
je 0x471b61
mov dword [0x4dde90], 1
mov dword [0x4dde94], 1
mov dword [0x4dde98], 1
mov dword [0x4ddea0], 1
mov dword [0x4ddea4], 1
mov dword [0x4dde8c], 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa10]
xor ecx, esp
call fcn.0048d925
mov esp, ebp
pop ebp
ret
mov edx, 0x4ad0a4
jmp 0x471bc5
lea eax, [esp + 0xc]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
test eax, eax
jne 0x471ba9
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push str.WinTools
lea eax, [esp + 0x14]
push eax
call esi
push 0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x4ddea8
lea eax, [esp + 0x14]
push eax
call esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x4ad0e0
call fcn.00471070
mov ecx, dword [esp + 0xa1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048d925
mov esp, ebp
pop ebp
ret