Function at 0x4736e4
Capabilities:
Create directory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4b
push 0
push 0
dec ecx
jne 0x4736ec
push ecx
push ebx
push esi
push edi
mov ebx, 0x4819dc
mov esi, 0x4819e8
xor eax, eax
push ebp
push 0x473fa9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1f0]
mov eax, 0x472f34
call fcn.0040698c
mov edx, dword [ebp - 0x1f0]
mov eax, dword [ebx]
call fcn.0043da78
mov eax, dword [ebx]
mov eax, dword [eax + 0x364]
lea edx, [eax + 0x84]
mov eax, 0x472f3c
call fcn.0040698c
mov eax, dword [ebx]
mov eax, dword [eax + 0x36c]
lea edx, [eax + 0x84]
mov eax, 0x472f44
call fcn.0040698c
mov eax, dword [ebx]
mov eax, dword [eax + 0x368]
lea edx, [eax + 0x84]
mov eax, 0x472f4c
call fcn.0040698c
mov eax, dword [ebx]
mov eax, dword [eax + 0x370]
lea edx, [eax + 0x84]
mov eax, 0x472f54
call fcn.0040698c
lea edx, [ebp - 0x1f4]
mov eax, 0x472f5c
call fcn.0040698c
mov edx, dword [ebp - 0x1f4]
mov eax, dword [ebx]
mov eax, dword [eax + 0x374]
call fcn.0043da78
lea edx, [ebp - 0x1f8]
mov eax, 0x472f64
call fcn.0040698c
mov edx, dword [ebp - 0x1f8]
mov eax, dword [ebx]
mov eax, dword [eax + 0x378]
call fcn.0043da78
lea edx, [ebp - 0x1fc]
mov eax, 0x472f6c
call fcn.0040698c
mov edx, dword [ebp - 0x1fc]
mov eax, dword [ebx]
mov eax, dword [eax + 0x380]
call fcn.0043da78
lea edx, [ebp - 0x200]
mov eax, 0x472f74
call fcn.0040698c
mov edx, dword [ebp - 0x200]
mov eax, dword [ebx]
mov eax, dword [eax + 0x384]
call fcn.0043da78
mov eax, dword [ebx]
mov eax, dword [eax + 0x384]
lea edx, [eax + 0x84]
mov eax, 0x472f7c
call fcn.0040698c
mov eax, dword [ebx]
mov eax, dword [eax + 0x37c]
xor edx, edx
call fcn.0043d968
mov word [0x4819e4], 0
mov eax, esi
xor ecx, ecx
mov edx, 0x9c
call fcn.00403678
mov dword [esi], 0x9c
push esi
call sub.kernel32.dll_GetVersionExA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x473894
mov eax, esi
xor ecx, ecx
mov edx, 0x9c
call fcn.00403678
mov dword [esi], 0x9c
push esi
call sub.kernel32.dll_GetVersionExA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x473894
xor eax, eax
mov dword [esi], eax
push 0x481a84
call sub.kernel32.dll_GetSystemInfo
mov dword [0x481ac4], 0x63
cmp dword [esi + 0x10], 2
jne 0x4739c4
mov eax, dword [esi + 4]
sub eax, 4
je 0x4738c9
dec eax
je 0x4738d8
dec eax
je 0x473982
jmp 0x473a27
mov dword [0x481ac4], 0xa
jmp 0x473a27
mov eax, dword [esi + 8]
sub eax, 1
jb 0x4738ea
je 0x4738f9
dec eax
je 0x473908
jmp 0x473a27
mov dword [0x481ac4], 0xb
jmp 0x473a27
mov dword [0x481ac4], 0xc
jmp 0x473a27
push 0x59
call sub.user32.dll_GetSystemMetrics
test al, al
je 0x47393a
call fcn.00474d24
test al, al
je 0x47392b
mov dword [0x481ac4], 0x11
jmp 0x473a27
mov dword [0x481ac4], 0xd
jmp 0x473a27
cmp byte [esi + 0x9a], 1
jne 0x47395b
call fcn.00474d24
test al, al
je 0x47395b
mov dword [0x481ac4], 0xe
jmp 0x473a27
call fcn.00474d24
test al, al
je 0x473973
mov dword [0x481ac4], 0x10
jmp 0x473a27
mov dword [0x481ac4], 0xf
jmp 0x473a27
mov eax, dword [esi + 8]
sub eax, 1
jae 0x473a27
cmp byte [esi + 0x9a], 1
jne 0x4739b8
call fcn.00474d24
test al, al
je 0x4739ac
mov dword [0x481ac4], 0x16
jmp 0x473a27
mov dword [0x481ac4], 0x14
jmp 0x473a27
mov dword [0x481ac4], 0x15
jmp 0x473a27
mov eax, dword [esi + 8]
sub eax, 1
jb 0x4739d8
sub eax, 9
je 0x4739f9
sub eax, 0x50
je 0x473a1d
jmp 0x473a27
movzx eax, byte [esi + 0x14]
cmp al, 0x42
je 0x4739e4
cmp al, 0x43
jne 0x4739ed
xor eax, eax
mov dword [0x481ac4], eax
jmp 0x473a27
mov dword [0x481ac4], 1
jmp 0x473a27
movzx eax, byte [esi + 0x14]
cmp al, 0x41
je 0x473a05
cmp al, 0x42
jne 0x473a11
mov dword [0x481ac4], 2
jmp 0x473a27
mov dword [0x481ac4], 3
jmp 0x473a27
mov dword [0x481ac4], 4
mov eax, dword [0x481ac4]
sub eax, 2
jb 0x473a40
sub eax, 8
je 0x473a7a
sub eax, 0x59
je 0x473ab0
jmp 0x473ae6
mov eax, dword [0x481aac]
mov edx, dword [eax]
call dword [edx + 0xfc]
mov eax, dword [0x481aac]
cmp dword [eax + 0x294], 1
jne 0x473ae6
mov eax, dword [0x481aac]
call fcn.00456ee0
mov eax, dword [0x47d46c]
mov eax, dword [eax]
call fcn.0045aa80
jmp 0x473f7e
mov eax, dword [0x481ab8]
mov edx, dword [eax]
call dword [edx + 0xfc]
mov eax, dword [0x481ab8]
cmp dword [eax + 0x294], 1
jne 0x473ae6
mov eax, dword [0x481ab8]
call fcn.00456ee0
mov eax, dword [0x47d46c]
mov eax, dword [eax]
call fcn.0045aa80
jmp 0x473f7e
mov eax, dword [0x481abc]
mov edx, dword [eax]
call dword [edx + 0xfc]
mov eax, dword [0x481abc]
cmp dword [eax + 0x294], 1
jne 0x473ae6
mov eax, dword [0x481abc]
call fcn.00456ee0
mov eax, dword [0x47d46c]
mov eax, dword [eax]
call fcn.0045aa80
jmp 0x473f7e
cmp dword [esi + 0x10], 2
jne 0x473b2b
call fcn.00474c18
test al, al
jne 0x473b2b
mov eax, dword [0x481aa8]
mov edx, dword [eax]
call dword [edx + 0xfc]
mov eax, dword [0x481aa8]
cmp dword [eax + 0x294], 1
jne 0x473b2b
mov eax, dword [0x481aa8]
call fcn.00456ee0
mov eax, dword [0x47d46c]
mov eax, dword [eax]
call fcn.0045aa80
jmp 0x473f7e
lea eax, [ebp - 0x204]
mov edx, dword [0x47d250]
mov ecx, 0x105
call fcn.00404f2c
mov edx, dword [ebp - 0x204]
mov eax, 0x481ac0
mov ecx, 0x473fc0
call fcn.00404fcc
mov eax, dword [0x481ac0]
call fcn.00472a98
test al, al
jne 0x473b76
push 0
mov eax, dword [0x481ac0]
call fcn.00405180
push eax
call sub.kernel32.dll_CreateDirectoryA
xor eax, eax
push ebp
push 0x473bdf
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x481ac0]
push 0x473fd0
push 0x473fdc
lea eax, [ebp - 0x208]
mov edx, 3
call fcn.00405040
mov edx, dword [ebp - 0x208]
lea eax, [ebp - 0x1ec]
call fcn.00403448
lea eax, [ebp - 0x1ec]
call fcn.004031d8
call fcn.00402e2c
lea eax, [ebp - 0x1ec]
call fcn.00403510
call fcn.00402e2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x473be9
mov eax, dword [0x47d46c]
mov eax, dword [eax]
call fcn.0045a7e8
mov eax, 0x473ff0
call fcn.004730d4
xor eax, eax
call fcn.004730d4
lea eax, [ebp - 4]
mov edx, 0x474014
call fcn.00404d54
mov eax, dword [0x481ac4]
cmp eax, 0x16
ja case.0x473c21.5
jmp dword [eax*4 + 0x473c28]
lea eax, [ebp - 0x20c]
mov ecx, 0x474030
mov edx, dword [ebp - 4]
call fcn.00404fcc
mov eax, dword [ebp - 0x20c]
call fcn.004730d4
jmp case.0x473c21.5
lea eax, [ebp - 0x210]
mov ecx, 0x474048
mov edx, dword [ebp - 4]
call fcn.00404fcc
mov eax, dword [ebp - 0x210]
call fcn.004730d4
jmp case.0x473c21.5
lea eax, [ebp - 0x214]
mov ecx, 0x47405c
mov edx, dword [ebp - 4]
call fcn.00404fcc
mov eax, dword [ebp - 0x214]
call fcn.004730d4
jmp case.0x473c21.5
lea eax, [ebp - 0x218]
mov ecx, 0x474074
mov edx, dword [ebp - 4]
call fcn.00404fcc
mov eax, dword [ebp - 0x218]
call fcn.004730d4
jmp case.0x473c21.5
lea eax, [ebp - 0x21c]
mov ecx, 0x474088
mov edx, dword [ebp - 4]
call fcn.00404fcc
mov eax, dword [ebp - 0x21c]
call fcn.004730d4
jmp case.0x473c21.5
lea eax, [ebp - 0x220]
mov ecx, 0x47409c
mov edx, dword [ebp - 4]
call fcn.00404fcc
mov eax, dword [ebp - 0x220]
call fcn.004730d4
jmp case.0x473c21.5
lea eax, [ebp - 0x224]
mov ecx, 0x4740b0
mov edx, dword [ebp - 4]
call fcn.00404fcc
mov eax, dword [ebp - 0x224]
call fcn.004730d4
jmp case.0x473c21.5
lea eax, [ebp - 0x228]
mov ecx, 0x4740c8
mov edx, dword [ebp - 4]
call fcn.00404fcc
mov eax, dword [ebp - 0x228]
call fcn.004730d4
jmp case.0x473c21.5
lea eax, [ebp - 0x22c]
mov ecx, 0x4740dc
mov edx, dword [ebp - 4]
call fcn.00404fcc
mov eax, dword [ebp - 0x22c]
call fcn.004730d4
jmp case.0x473c21.5
lea eax, [ebp - 0x230]
mov ecx, 0x4740fc
mov edx, dword [ebp - 4]
call fcn.00404fcc
mov eax, dword [ebp - 0x230]
call fcn.004730d4
jmp case.0x473c21.5
lea eax, [ebp - 0x234]
mov ecx, 0x474114
mov edx, dword [ebp - 4]
call fcn.00404fcc
mov eax, dword [ebp - 0x234]
call fcn.004730d4
jmp case.0x473c21.5
lea eax, [ebp - 0x238]
mov ecx, 0x47412c
mov edx, dword [ebp - 4]
call fcn.00404fcc
mov eax, dword [ebp - 0x238]
call fcn.004730d4
jmp case.0x473c21.5
lea eax, [ebp - 0x23c]
mov ecx, 0x474148
mov edx, dword [ebp - 4]
call fcn.00404fcc
mov eax, dword [ebp - 0x23c]
call fcn.004730d4
jmp case.0x473c21.5
lea eax, [ebp - 0x240]
mov ecx, 0x474170
mov edx, dword [ebp - 4]
call fcn.00404fcc
mov eax, dword [ebp - 0x240]
call fcn.004730d4
jmp case.0x473c21.5
lea eax, [ebp - 0x244]
mov ecx, 0x474190
mov edx, dword [ebp - 4]
call fcn.00404fcc
mov eax, dword [ebp - 0x244]
call fcn.004730d4
jmp case.0x473c21.5
lea eax, [ebp - 0x248]
mov ecx, 0x4741ac
mov edx, dword [ebp - 4]
call fcn.00404fcc
mov eax, dword [ebp - 0x248]
call fcn.004730d4
lea eax, [ebp - 0x250]
mov edx, dword [0x47d250]
mov ecx, 0x105
call fcn.00404f2c
mov ecx, dword [ebp - 0x250]
lea eax, [ebp - 0x24c]
mov edx, 0x4741cc
call fcn.00404fcc
mov eax, dword [ebp - 0x24c]
call fcn.004730d4
lea eax, [ebp - 0x258]
mov edx, dword [0x47d200]
mov ecx, 0x105
call fcn.00404f2c
mov ecx, dword [ebp - 0x258]
lea eax, [ebp - 0x254]
mov edx, 0x4741ec
call fcn.00404fcc
mov eax, dword [ebp - 0x254]
call fcn.004730d4
call fcn.0040ac2c
fstp qword [ebp - 0x18]
wait
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov edx, dword [0x47d2f8]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.0040b858
call fcn.0040ac58
fstp qword [ebp - 0x20]
wait
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 0x474208
call fcn.0040b858
push 0x474220
push dword [ebp - 8]
push 0x474238
push dword [ebp - 0xc]
lea eax, [ebp - 0x25c]
mov edx, 4
call fcn.00405040
mov eax, dword [ebp - 0x25c]
call fcn.004730d4
xor eax, eax
call fcn.004730d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473fb0
lea eax, [ebp - 0x25c]
mov edx, 0x1c
call fcn.00404ce0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ce0
ret