Function at 0x476570
Capabilities:
Create directory
Create process on windows

Disassembly:
mov eax, 0x1118
call fcn.004a5d20
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x1114], eax
mov eax, dword [esp + 0x111c]
push ebx
push esi
push edi
mov dword [esp + 0x14], eax
mov ebx, ecx
mov eax, dword [esp + 0x1130]
push 0x4bf544
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.kernel32.dll_FreeLibrary]
mov esi, eax
test esi, esi
jne 0x4765d7
push 0x4bf544
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4765f1
push 0x4c0888
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x4765ee
lea ecx, [esp + 0xc]
push ecx
call eax
push esi
call edi
xor eax, eax
push 0xc6
push eax
mov word [esp + 0x60], ax
lea eax, [esp + 0x62]
push eax
call fcn.0048e770
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x934], ax
lea eax, [esp + 0x936]
push eax
call fcn.0048e770
add esp, 0x18
lea eax, [esp + 0x920]
push 0x4def98
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x920]
push 0x4ae418
push eax
call esi
push dword [esp + 0x10]
lea eax, [esp + 0x924]
push eax
call esi
lea eax, [esp + 0x920]
push eax
call fcn.00496c1b
lea eax, [esp + 0x924]
push eax
call fcn.00492273
mov eax, dword [0x4bf7b0]
movq xmm0, qword [0x4bf7a8]
mov dword [esp + 0x130], eax
mov ax, word [0x4bf7b4]
push 0x7f2
mov word [esp + 0x138], ax
lea eax, [esp + 0x13a]
push 0
push eax
movq qword [esp + 0x134], xmm0
call fcn.0048e770
add esp, 0x14
lea eax, [esp + 0x120]
push dword [esp + 0x14]
push eax
call esi
push 0xa
push 0x64
lea eax, [esp + 0x60]
push eax
push 0
call fcn.004926bc
add esp, 4
push eax
call fcn.0048f5fe
add esp, 0x10
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x124]
push eax
call esi
push 0x4af95c
lea eax, [esp + 0x124]
push eax
call esi
push 0xa
push 0x64
lea eax, [esp + 0x60]
push eax
push dword [esp + 0x1138]
call fcn.0048f5fe
add esp, 0x10
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x124]
push eax
call esi
push 0x4b49c8
lea eax, [esp + 0x124]
push eax
call esi
cmp ebx, 0x80000000
jne 0x476747
push 0x4ae5a0
jmp 0x476772
cmp ebx, 0x80000002
jne 0x476756
push 0x4ae508
jmp 0x476772
cmp ebx, 0x80000001
jne 0x476765
push 0x4ae540
jmp 0x476772
cmp ebx, 0x80000003
jne 0x47677c
push 0x4ae578
lea eax, [esp + 0x124]
push eax
call esi
push dword [esp + 0x18]
lea eax, [esp + 0x124]
push eax
call esi
push 0x4b4920
lea eax, [esp + 0x124]
push eax
call esi
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x120]
mov dword [esp + 0x30], eax
mov eax, dword [InitializeSListHead]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
push eax
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0x4addfc
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [esp + 0x58]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x476852
push 0x4bf544
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x47683c
push 0x4bf544
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x476852
push 0x4c08a8
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x47684f
push ebx
call eax
push esi
call edi
mov ecx, dword [esp + 0x1120]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0x1118
ret