Function at 0x404474
Capabilities:
Create directory
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x40447c
push ebx
push esi
push edi
mov eax, 0x404434
call fcn.00403cb8
xor eax, eax
push ebp
push 0x40479f
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4047b0
mov eax, 0x40671c
call fcn.004041b4
mov ebx, eax
test ebx, ebx
jne 0x4044ba
push 0
call sub.kernel32.dll_ExitProcess_1
mov edx, 0x406728
mov eax, ebx
mov ecx, dword [0x40671c]
call fcn.004025bc
mov esi, 1
mov eax, 0x40682c
call fcn.004035bc
mov edi, 0xa
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.0040417c
mov ecx, dword [ebp - 0x14]
mov eax, 0x40682c
mov edx, 0x4047bc
call fcn.00403750
mov eax, dword [0x40682c]
call fcn.00403858
mov edx, eax
mov eax, 0x406720
call fcn.004041b4
mov ebx, eax
test ebx, ebx
je 0x40476e
mov eax, 0x406724
mov edx, dword [0x406720]
call fcn.004039a4
mov eax, 0x406724
call fcn.004038b0
mov edx, eax
mov eax, ebx
mov ecx, dword [0x406720]
call fcn.004025bc
lea edx, [ebp - 0x18]
mov eax, dword [0x406724]
call fcn.00404294
mov edx, dword [ebp - 0x18]
mov eax, 0x406724
call fcn.00403610
mov eax, 0x406830
mov edx, 0x406729
mov ecx, pe_nt_image_headers32
call fcn.004036ec
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, 0x4047c8
call fcn.004041fc
mov ecx, dword [ebp - 0x20]
mov edx, 0x4047dc
mov eax, dword [0x406830]
call fcn.00404328
mov edx, dword [ebp - 0x1c]
mov eax, 0x406830
call fcn.00403610
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x4047c8
call fcn.004041fc
lea eax, [ebp - 0x28]
mov edx, 0x4047f0
call fcn.0040370c
mov ecx, dword [ebp - 0x28]
mov edx, 0x404804
mov eax, dword [0x406830]
call fcn.00404328
mov edx, dword [ebp - 0x24]
mov eax, 0x406830
call fcn.00403610
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x30]
mov eax, 0x404818
call fcn.004041fc
mov ecx, dword [ebp - 0x30]
mov edx, 0x404828
mov eax, dword [0x406830]
call fcn.00404328
mov edx, dword [ebp - 0x2c]
mov eax, 0x406830
call fcn.00403610
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
call fcn.004043d4
mov ecx, dword [ebp - 0x38]
mov edx, 0x404838
mov eax, dword [0x406830]
call fcn.00404328
mov edx, dword [ebp - 0x34]
mov eax, 0x406830
call fcn.00403610
cmp byte [0x406728], 0
je 0x404748
mov eax, dword [0x406830]
call fcn.00403858
mov ebx, eax
mov edx, ebx
lea eax, [ebp - 0x3c]
call fcn.004036b0
mov eax, dword [ebp - 0x3c]
call fcn.00404158
test al, al
jne 0x404690
push 0
push ebx
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x404690
lea edx, [ebp - 0x40]
mov eax, 0x404818
call fcn.004041fc
mov edx, dword [ebp - 0x40]
mov eax, 0x406830
call fcn.00403610
call fcn.00402748
push dword [0x406830]
push 0x40484c
imul eax, esi, 0x1388
call fcn.00402b8c
lea edx, [ebp - 0x44]
call fcn.0040417c
push dword [ebp - 0x44]
push 0x404858
mov eax, 0x406830
mov edx, 4
call fcn.004037c4
mov edx, dword [0x406830]
mov eax, 0x406834
call fcn.004029dc
mov edx, 1
mov eax, 0x406834
call fcn.00402cb0
call fcn.00402560
call fcn.0040259c
test eax, eax
jne 0x404775
push 0
mov eax, 0x406724
call fcn.004038b0
mov edx, eax
mov ecx, dword [0x406720]
mov eax, 0x406834
call fcn.00402ad8
call fcn.00402560
mov eax, 0x406834
call fcn.00402af8
call fcn.00402560
push 1
push 0
push 0
mov eax, dword [0x406830]
call fcn.00403858
push eax
push 0x404860
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x404775
push 0
lea edx, [ebp - 0x48]
xor eax, eax
call fcn.004026e8
mov eax, dword [ebp - 0x48]
push eax
mov eax, 0x406724
call fcn.004038b0
xor ecx, ecx
pop edx
call fcn.00403e9c
test al, al
jmp 0x404775
push 0
call sub.kernel32.dll_ExitProcess_1
inc esi
dec edi
jne 0x4044e0
push 0
call sub.kernel32.dll_ExitProcess_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4047a6
lea eax, [ebp - 0x48]
mov edx, 0xe
call fcn.004035e0
ret