Function at 0x476a94
Capabilities:
Create directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040580c
mov esi, dword [0x6519d8]
xor eax, eax
push ebp
push 0x476f96
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0046388c
mov eax, dword [0x651fd8]
movzx eax, byte [eax]
xor al, 1
mov edx, dword [esi]
mov byte [edx + 4], al
mov al, 1
call fcn.004761a4
mov eax, 0x476fb0
call fcn.00475fa0
xor ebx, ebx
call fcn.00403424
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x476fbc
call sub.kernel32.dll_CreateFileA_1
mov eax, dword [0x651fd8]
cmp byte [eax], 0
je 0x476b30
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
call fcn.0040581c
mov edi, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
jmp 0x476b3c
mov edi, 0x476fd0
mov dword [ebp - 0xc], 0xb
mov eax, 0x476fe4
call fcn.00463fac
mov eax, 0x476fe4
call fcn.00463fac
mov eax, 0x476fe4
call fcn.00463fac
mov eax, 0x476fe4
call fcn.00463fac
push 0x20
lea eax, [ebp - 0x10]
call fcn.00423328
lea eax, [ebp - 0x10]
mov edx, 0x476ffc
call fcn.00405658
mov eax, dword [ebp - 0x10]
call fcn.0040581c
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x14]
call fcn.00423328
lea eax, [ebp - 0x14]
mov edx, 0x476ffc
call fcn.00405658
mov eax, dword [ebp - 0x14]
call fcn.0040581c
push eax
call sub.kernel32.dll_DeleteFileA
push 0
lea eax, [ebp - 0x18]
call fcn.00423328
lea eax, [ebp - 0x18]
mov edx, 0x476ffc
call fcn.00405658
mov eax, dword [ebp - 0x18]
call fcn.0040581c
push eax
call sub.kernel32.dll_CreateDirectoryA
mov eax, 0x7d0
call fcn.0040344c
add ax, 0x3e9
push eax
mov eax, dword [0x651ec4]
mov eax, dword [eax]
push eax
mov eax, 0x7d0
call fcn.0040344c
mov ecx, eax
add cx, 0x7d0
movzx edx, word [ebp - 0xc]
mov eax, edi
call fcn.004750f8
test eax, eax
jne 0x476f63
call fcn.00476a0c
mov eax, dword [0x651dd0]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x34], al
mov eax, dword [0x651f28]
mov eax, dword [eax]
mov edx, dword [esi]
mov dword [edx + 0x30], eax
mov eax, dword [0x651ba0]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x24], al
mov eax, dword [0x651bf8]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x25], al
mov eax, dword [0x651ed8]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x26], al
mov eax, dword [0x651cd8]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x27], al
mov eax, dword [0x651d2c]
mov eax, dword [eax]
mov edx, dword [esi]
mov dword [edx + 0x28], eax
mov eax, dword [0x651a74]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x2c], al
mov eax, dword [0x651a1c]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x2d], al
mov eax, dword [0x6520e8]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x35], al
call fcn.00474d98
movzx eax, ax
mov edx, dword [esi]
mov dword [edx + 0x10], eax
call fcn.00474d90
movzx eax, ax
mov edx, dword [esi]
mov dword [edx + 0x14], eax
mov eax, dword [0x65197c]
movzx eax, byte [eax + 0x64]
mov edx, dword [esi]
mov byte [edx + 0x18], al
call sub.kernel32.dll_GetCurrentProcessId
mov edx, dword [esi]
mov dword [edx], eax
mov eax, dword [0x651fd4]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x19], al
mov eax, dword [0x651f30]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x1a], al
mov eax, dword [0x651d74]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x1b], al
mov eax, dword [0x651c64]
movzx eax, byte [eax]
mov edx, dword [esi]
mov byte [edx + 0x36], al
mov eax, dword [esi]
mov byte [eax + 0x1c], 0
mov eax, dword [0x65196c]
mov eax, dword [eax]
call fcn.00422214
mov edx, dword [esi]
mov dword [edx + 0x20], eax
push 0x13880
mov ecx, 0x4f0a0c
mov eax, 0x47700c
xor edx, edx
call fcn.00464ae4
push 0x13880
mov ecx, 0x50428c
mov eax, 0x477014
xor edx, edx
call fcn.00464ae4
push 0x477020
call sub.kernel32.dll_DeleteFileW
push 0x477050
call sub.kernel32.dll_DeleteFileW
push 0x20
push 0x477080
call sub.kernel32.dll_SetFileAttributesW
push 0x477080
call sub.kernel32.dll_DeleteFileW
push 0x20
push 0x4770e0
call sub.kernel32.dll_SetFileAttributesW
push 0x4770e0
call sub.kernel32.dll_DeleteFileW
mov eax, 0x47714c
call fcn.00475758
mov eax, 0x477164
call fcn.00475758
mov eax, 0x47717c
call fcn.00475758
lea edx, [ebp - 0x1c]
mov eax, dword [0x65197c]
mov eax, dword [eax + 0x5c]
call fcn.00422398
cmp dword [ebp - 0x1c], 0
je 0x476dba
mov eax, dword [0x65197c]
mov eax, dword [eax + 0x5c]
call fcn.00475758
mov eax, 0x477194
call fcn.00423050
mov eax, dword [0x651f54]
cmp byte [eax], 0
je 0x476de4
mov ecx, 0x4771a0
mov eax, 0x52210c
mov edx, 0x9000
call fcn.00464418
jmp 0x476e24
push 0x20
push 0x4771b0
call sub.kernel32.dll_SetFileAttributesW
push 0x20
push 0x4771c4
call sub.kernel32.dll_SetFileAttributesW
push 0x4771dc
call sub.kernel32.dll_DeleteFileA
push 0x4771e8
call sub.kernel32.dll_DeleteFileA
mov ecx, 0x4771a0
mov eax, 0x517b0c
mov edx, 0xa600
call fcn.00464418
mov ecx, 0x4771f4
mov eax, 0x48e1d8
mov edx, 0x1f000
call fcn.00464418
mov ecx, 0x477204
mov eax, 0x52b10c
mov edx, 0x4000
call fcn.00464418
mov ecx, 0x477228
mov eax, 0x52f10c
mov edx, 0x8000
call fcn.00464418
mov ecx, 0x477258
mov eax, 0x53710c
mov edx, 0x8000
call fcn.00464418
mov ecx, 0x477288
mov eax, str.DDS_
mov edx, 0x10080
call fcn.00464418
mov ecx, 0x4772a4
mov eax, 0x4ad1d8
mov edx, 0xcaa0
call fcn.00464418
mov ecx, 0x4772bc
mov eax, str.MAXFILE_C3_00001MOTI
mov edx, 0x56f0
call fcn.00464418
mov ecx, 0x4772d4
mov eax, 0x4b9c78
mov edx, 0xd916
call fcn.00464418
mov ecx, 0x4772ec
mov eax, str.MAXFILE_C3_00001PHY
mov edx, 0x13d09
call fcn.00464418
mov eax, dword [0x651fd8]
cmp byte [eax], 0
je 0x476f4b
mov eax, dword [ebp - 8]
mov edx, eax
mov eax, 0x47714c
call fcn.004751d8
mov eax, dword [ebp - 8]
mov edx, eax
mov eax, 0x477164
call fcn.004751d8
mov eax, dword [ebp - 8]
mov edx, eax
mov eax, 0x47717c
call fcn.004751d8
lea edx, [ebp - 0x20]
mov eax, dword [0x65197c]
mov eax, dword [eax + 0x5c]
call fcn.00422398
cmp dword [ebp - 0x20], 0
je 0x476f37
mov eax, dword [ebp - 8]
mov edx, eax
mov eax, dword [0x65197c]
mov eax, dword [eax + 0x5c]
call fcn.004751d8
mov ecx, 0x477300
mov eax, 0x53f10c
mov edx, 0x1167d
call fcn.00464418
mov eax, dword [ebp - 4]
call fcn.00475e44
mov ebx, eax
test bl, bl
je 0x476f73
mov eax, dword [0x651a28]
mov byte [eax], 1
jmp 0x476f73
push 0x10
push 0
push 0x477318
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476f9d
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.004053b0
lea eax, [ebp - 4]
call fcn.0040538c
ret