Function at 0x476aa8
Capabilities:
Create directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040580c
mov esi, dword [0x6519d8]
xor eax, eax
push ebp
push 0x476faa
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0046388c
mov eax, dword [0x651fd8]
movzx eax, byte [eax]
xor al, 1
mov edx, dword [esi]
mov byte [edx + 4], al
mov al, 1
call fcn.004761b8
mov eax, 0x476fc4
call fcn.00475fb4
xor ebx, ebx
call fcn.00403424
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x476fd0
call sub.kernel32.dll_CreateFileA_1
mov eax, dword [0x651fd8]
cmp byte [eax], 0
je 0x476b44
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
call fcn.0040581c
mov edi, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
jmp 0x476b50
mov edi, 0x476fe4
mov dword [ebp - 0xc], 0xb
mov eax, 0x476ff8
call fcn.00463fac
mov eax, 0x476ff8
call fcn.00463fac
mov eax, 0x476ff8
call fcn.00463fac
mov eax, 0x476ff8
call fcn.00463fac
push 0x20
lea eax, [ebp - 0x10]
call fcn.00423328
lea eax, [ebp - 0x10]
mov edx, 0x477010
call fcn.00405658
mov eax, dword [ebp - 0x10]
call fcn.0040581c
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x14]
call fcn.00423328
lea eax, [ebp - 0x14]
mov edx, 0x477010
call fcn.00405658
mov eax, dword [ebp - 0x14]
call fcn.0040581c
push eax
call sub.kernel32.dll_DeleteFileA
push 0
lea eax, [ebp - 0x18]
call fcn.00423328
lea eax, [ebp - 0x18]
mov edx, 0x477010
call fcn.00405658
mov eax, dword [ebp - 0x18]
call fcn.0040581c
push eax
call sub.kernel32.dll_CreateDirectoryA
mov eax, 0x7d0
call fcn.0040344c
add ax, 0x3e9
push eax
mov eax, dword [0x651ec4]
mov eax, dword [eax]
push eax
mov eax, 0x7d0
call fcn.0040344c
mov ecx, eax
add cx, 0x7d0
movzx edx, word [ebp - 0xc]
mov eax, edi
call fcn.0047510c
test eax, eax
jne 0x476f77
call fcn.00476a20
mov eax, dword [0x651dd0]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x34], al
mov eax, dword [0x651f28]
mov eax, dword [eax]
mov edx, dword [esi]
mov dword [edx + 0x30], eax
mov eax, dword [0x651ba0]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x24], al
mov eax, dword [0x651bf8]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x25], al
mov eax, dword [0x651ed8]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x26], al
mov eax, dword [0x651cd8]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x27], al
mov eax, dword [0x651d2c]
mov eax, dword [eax]
mov edx, dword [esi]
mov dword [edx + 0x28], eax
mov eax, dword [0x651a74]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x2c], al
mov eax, dword [0x651a1c]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x2d], al
mov eax, dword [0x6520e8]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x35], al
call fcn.00474dac
movzx eax, ax
mov edx, dword [esi]
mov dword [edx + 0x10], eax
call fcn.00474da4
movzx eax, ax
mov edx, dword [esi]
mov dword [edx + 0x14], eax
mov eax, dword [0x65197c]
movzx eax, byte [eax + 0x64]
mov edx, dword [esi]
mov byte [edx + 0x18], al
call sub.kernel32.dll_GetCurrentProcessId
mov edx, dword [esi]
mov dword [edx], eax
mov eax, dword [0x651fd4]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x19], al
mov eax, dword [0x651f30]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x1a], al
mov eax, dword [0x651d74]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x1b], al
mov eax, dword [0x651c64]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x36], al
mov eax, dword [esi]
mov byte [eax + 0x1c], 0
mov eax, dword [0x65196c]
mov eax, dword [eax]
call fcn.00422214
mov edx, dword [esi]
mov dword [edx + 0x20], eax
push 0x13880
mov ecx, 0x4f0a0c
mov eax, 0x477020
xor edx, edx
call fcn.00464ae4
push 0x13880
mov ecx, 0x50428c
mov eax, 0x477028
xor edx, edx
call fcn.00464ae4
push 0x477034
call sub.kernel32.dll_DeleteFileW
push 0x477064
call sub.kernel32.dll_DeleteFileW
push 0x20
push 0x477094
call sub.kernel32.dll_SetFileAttributesW
push 0x477094
call sub.kernel32.dll_DeleteFileW
push 0x20
push 0x4770f4
call sub.kernel32.dll_SetFileAttributesW
push 0x4770f4
call sub.kernel32.dll_DeleteFileW
mov eax, 0x477160
call fcn.0047576c
mov eax, 0x477178
call fcn.0047576c
mov eax, 0x477190
call fcn.0047576c
lea edx, [ebp - 0x1c]
mov eax, dword [0x65197c]
mov eax, dword [eax + 0x5c]
call fcn.00422398
cmp dword [ebp - 0x1c], 0
je 0x476dce
mov eax, dword [0x65197c]
mov eax, dword [eax + 0x5c]
call fcn.0047576c
mov eax, 0x4771a8
call fcn.00423050
mov eax, dword [0x651f54]
cmp byte [eax], 0
je 0x476df8
mov ecx, 0x4771b4
mov eax, 0x52210c
mov edx, 0x9000
call fcn.00464418
jmp 0x476e38
push 0x20
push 0x4771c4
call sub.kernel32.dll_SetFileAttributesW
push 0x20
push 0x4771d8
call sub.kernel32.dll_SetFileAttributesW
push 0x4771f0
call sub.kernel32.dll_DeleteFileA
push 0x4771fc
call sub.kernel32.dll_DeleteFileA
mov ecx, 0x4771b4
mov eax, 0x517b0c
mov edx, 0xa600
call fcn.00464418
mov ecx, 0x477208
mov eax, 0x48e1d8
mov edx, 0x1f000
call fcn.00464418
mov ecx, 0x477218
mov eax, 0x52b10c
mov edx, 0x4000
call fcn.00464418
mov ecx, 0x47723c
mov eax, 0x52f10c
mov edx, 0x8000
call fcn.00464418
mov ecx, 0x47726c
mov eax, 0x53710c
mov edx, 0x8000
call fcn.00464418
mov ecx, 0x47729c
mov eax, str.DDS_
mov edx, 0x10080
call fcn.00464418
mov ecx, 0x4772b8
mov eax, 0x4ad1d8
mov edx, 0xcaa0
call fcn.00464418
mov ecx, 0x4772d0
mov eax, str.MAXFILE_C3_00001MOTI
mov edx, 0x56f0
call fcn.00464418
mov ecx, 0x4772e8
mov eax, 0x4b9c78
mov edx, 0xd916
call fcn.00464418
mov ecx, 0x477300
mov eax, str.MAXFILE_C3_00001PHY
mov edx, 0x13d09
call fcn.00464418
mov eax, dword [0x651fd8]
cmp byte [eax], 0
je 0x476f5f
mov eax, dword [ebp - 8]
mov edx, eax
mov eax, 0x477160
call fcn.004751ec
mov eax, dword [ebp - 8]
mov edx, eax
mov eax, 0x477178
call fcn.004751ec
mov eax, dword [ebp - 8]
mov edx, eax
mov eax, 0x477190
call fcn.004751ec
lea edx, [ebp - 0x20]
mov eax, dword [0x65197c]
mov eax, dword [eax + 0x5c]
call fcn.00422398
cmp dword [ebp - 0x20], 0
je 0x476f4b
mov eax, dword [ebp - 8]
mov edx, eax
mov eax, dword [0x65197c]
mov eax, dword [eax + 0x5c]
call fcn.004751ec
mov ecx, 0x477314
mov eax, 0x53f10c
mov edx, 0x1167d
call fcn.00464418
mov eax, dword [ebp - 4]
call fcn.00475e58
mov ebx, eax
test bl, bl
je 0x476f87
mov eax, dword [0x651a28]
mov byte [eax], 1
jmp 0x476f87
push 0x10
push 0
push 0x47732c
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476fb1
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.004053b0
lea eax, [ebp - 4]
call fcn.0040538c
ret