Function at 0x472bf0
Capabilities:
Create directory
Delete file
Encode data using xor
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa14
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xa10], eax
push ebx
push esi
push edi
push dword [0x4e4f4c]
call fcn.004909de
push 2
push 0x32
call fcn.004909d3
add esp, 0xc
mov dword [0x4e4f4c], eax
push 0x4e5e28
push 0x32
push eax
push 0x4b34dc
push 0x4c22a0
push 0x4c22a4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x472e1a
push dword [0x4e4f4c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
cmp eax, 0x14
jl 0x472e1a
push dword [0x4e4f4c]
call esi
push 0x1ac
mov ebx, eax
lea edi, [esp + 0x21c]
lea eax, [esp + 0x870]
mov ecx, 0x195
mov esi, str.UYFA8Y5FMG9A84Y57Y4O789YGURIYHKKJGTIX48E57YX47JY5IXK734YJSYH4G78TH47Y7J84SY5S8IYW234I87YS28IJY78YS1J7YJ178YTISJ7YI81YJ87TY187YJ17YTI8S7TY3JI78Y4TK78TY7YH1J7YHF714YK74Y174YHYUHTR5FG1E5D5413ES154GD541DTF56D3RG543F1G56FRG651F23T1GD63TG1F543DE5475F73JDJK846T1TDF34515641D6541DG546RD1654EW65RF6516D4FYJ47YI847J1Y8IY41JK78Y4FK871YJ8I7Y3DIK8173YJ871IDY478TYG1J7Y48IK7YJDK47YJ71Y187YJ418Y4J8I7Y1GJ7Y47ETM85LKA84357WF74IK5G7W948573FLKVE51IUM18U18Y389Y1UIY187Y871Y71R1FR1D56G1DRT65RD363D787138IDH18I3YJ813YJD781Y3I87Y1J7DY31K7438AT83476KI873YD18I74Y781TY78TYJ78TY174Y178YJ1Y487YK17YJGFHU4JHDK4GFNH481JK7FNY4Y17NY174FYN71NFY47814YJD17Y4JF17YR7Y4H78DYH81IYG1H74YIJD7Y431I87JYD48IYJ14Y7IJG17DY4781Y4J87YI81JDFY4178YJ47J1Y47J1HY478YHT784YTJ1874HYG14J7YD1J487YF18748MFK34574S42YH871GYJ4Y1JI87Y4FJ817Y4GJ817J4Y1GI8J74Y781YTJ4
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0048fb10
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
add esp, 0xc
push 0x4c22a8
push 0x4e4f98
call esi
push str.prowt.dll
push 0x4e4f50
call esi
mov eax, dword [0x4cc1d8]
cmp eax, 0x64
je 0x472ce7
cmp eax, 0x12c
jne 0x472d0e
push str.remwt
push 0x4e4f98
call esi
push str._remwt.dll
push 0x4e4f50
call esi
push str.N7W934GJ2746J9827456T8O97YH5I4YGWTJ5DRYHTNU4Y56N78Y8Y34O879Y4O879YN4587Y3N9O73N75Y3UY435UYH345FTCX5TREX4TRE35X3TREX5T435XDCGTB34XV5TC34BT5RDXC4TB5FCT34534YUI5YM34UY5MKI34NY5KI34NUY5K34UMY5NI8374JY5UI4353F45CT3C54T3CT53C4T5XC3TB45FC34BGF5CB34RB5CT3G4BF5T3FT54V345KHJMI3YUMYI346HIM3Y48IY58H734U53J4C5TF34T5T34JH5T3DF4JT534JH5T34D5CJT34FD5T34CD5TXC34TFC5D34TG5CVTG3454KJHM34N5YHLIK3U4MYN5IUY43MI5Y45NU443JH4KNJH3Y5NUY4HK5IUNY4H32MKLI4HLM2JH34L2M3UH4N2L3KYN5H43RKUS45OG434S39472J34FHSF38274K28394FHYNHLIU4Y5LIU3Y4ML5I8Y73L4895YJL89347Y6O8Y3JIK546UHUK45YJKH6U8Y4JIHKUTY56I8JK4H7Y5678YGJ4576YH487IJ5H6Y4875YH6I45YJ684YH5KI876YF4K5J7H6YF4H75Y6HK457Y6TK54JY6TKH4Y56JTHY456HJTK4756IJ78T4658IKJTY45IH67Y4J856YG8I4H7Y564JT56HI847YH6ITK4Y5KIJ6H7G46YJG4I857H6YGJ4756YHK4IJT6HYT475J6H4Y757674UJ5Y6T84Y75K6JT4HY567HJ4
jmp 0x472d04
push str.clscwt
push 0x4e4f98
call esi
push str.clscwt.dll
push 0x4e4f50
call esi
push str.M1890U198Y171917809179H1789J1719HDYJF7Y1FHJYF173Y78RY783RY18YHR871YR3H871YJF3YF178H3YF718JFY3178SYJHY3FH1J7YG7YG7JY17G3YN178Y3G7Y178T3YH178YR78Y1J87R3HY18Y3J71YI387TYH1738YJD1H7Y3RJ871Y38RYJF7HYI3TGH7YI81YH87YH318Y3J71Y73HY17I3Y8YE7YE7HY1D873YJFTA87K437783217Y474YH73Y178YTH73Y78JRYH47814J71YJ784Y1J874FH7814J7HY64T87YJ87Y1871Y387YJF87Y781Y87J3YT781YH817Y3TH781Y38716Y781YTJ8H3Y87JYR3178Y3TH87J48R7JF47H387JDKUFR734HW25TPYN5373178YG178YGJ8Y71487YHT7Y8F1JU7YDJ87Y487IYH478Y178YD748Y178Y187RY18Y781Y7Y178TY48J1FUY4NF743847583F187YH781YH471Y78YJ7DEY4781YE87Y4R87Y1TGJ87Y4H871Y4TJ7841YI81Y74G71Y1D7UY4178Y4871HG7Y78FY4871Y4JG71Y4I871Y8RY78Y6H1T73Y8JT73Y8J71YT31J7Y87YD73Y178Y3781Y3H781YT3781YH6T78YT78Y784JD45F78748F3Y17YU47Y187Y41784YH17YT47Y4T71Y874Y17HY47H1YJ4D7Y17YH71Y4781Y4T87H1Y7Y1784DHY17Y4J17Y471Y578Y
lea eax, [esp + 0x21c]
push eax
call esi
mov ax, word [esp + 0x218]
lea ecx, [esp + 0x218]
test ax, ax
je 0x472d39
movzx edx, ax
xor edx, 1
lea ecx, [ecx + 2]
mov word [ecx - 2], dx
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x472d25
mov eax, dword [0x4e4f4c]
lea eax, [eax + ebx*2]
add eax, 0xffffffe8
push eax
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x472db8
call fcn.00472210
test eax, eax
je 0x472db1
mov dword [0x4e4f34], 1
mov dword [0x4e4f38], 1
mov dword [0x4e4f3c], 1
mov dword [0x4e4f44], 1
mov dword [0x4e4f48], 1
mov dword [0x4e4f30], 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa10]
xor ecx, esp
call fcn.0048ea75
mov esp, ebp
pop ebp
ret
mov edx, 0x4b32e4
jmp 0x472e15
lea eax, [esp + 0xc]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
test eax, eax
jne 0x472df9
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push str.WinTools
lea eax, [esp + 0x14]
push eax
call esi
push 0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x4e4f50
lea eax, [esp + 0x14]
push eax
call esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x4b3320
call fcn.004722d0
mov ecx, dword [esp + 0xa1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048ea75
mov esp, ebp
pop ebp
ret