Function at 0x478520
Capabilities:
Check if file exists
Create directory
Get session user name

Disassembly:
sub esp, 0x470
mov eax, dword [0x5b7a9c]
xor eax, esp
mov dword [esp + 0x46c], eax
mov eax, dword [esp + 0x474]
mov ecx, dword [esp + 0x478]
mov edx, dword [esp + 0x484]
push ebx
mov ebx, dword [esp + 0x490]
push ebp
mov ebp, dword [esp + 0x488]
push esi
mov esi, dword [esp + 0x488]
push edi
mov edi, dword [esp + 0x4a0]
mov dword [esp + 0x10], eax
mov eax, dword [0x5ed80c]
push ebp
mov dword [esp + 0x18], ecx
mov ecx, dword [eax - 0xc]
push esi
push ecx
push eax
mov dword [esp + 0x28], edx
call fcn.0046e0b0
mov edx, dword [esp + 0x4b4]
push esi
push edx
push edi
call fcn.0054013c
add esp, 0x1c
cmp dword [0x5ed764], 0
jne 0x4785ae
cmp dword [0x5ed768], 0
je 0x478753
push ebx
lea eax, [esp + 0x70]
push 0x208
push eax
call fcn.00477ed0
lea ecx, [esp + 0x78]
push 0x5c
push ecx
call fcn.00540fb2
add esp, 0x14
test eax, eax
je 0x4785d8
xor edx, edx
mov word [eax], dx
jmp 0x4785f4
lea eax, [esp + 0x6c]
push 0x2f
push eax
call fcn.00540fb2
add esp, 8
test eax, eax
je 0x478753
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x6c]
lea edx, [eax + 2]
jmp 0x478600
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x478600
push 0x57c428
sub eax, edx
sar eax, 1
push ebp
push esi
mov edi, eax
call fcn.005400bf
xor ecx, ecx
add esp, 0xc
cmp dword [0x5ed764], ecx
je 0x4786a7
test edi, edi
jle 0x47867b
mov edx, dword [esp + 0x4a8]
jmp 0x478640
movzx eax, word [esp + ecx*2 + 0x6c]
mov ebx, 0x3a
cmp bx, ax
je 0x47866c
test edx, edx
je 0x47865d
mov ebx, 0x5c
cmp bx, ax
je 0x47866c
mov ebx, 0x2f
cmp bx, ax
jne 0x478676
lea eax, [ebx + 0x2d]
jmp 0x478671
mov eax, 0x5f
mov word [esp + ecx*2 + 0x6c], ax
inc ecx
cmp ecx, edi
jl 0x478640
lea ecx, [esp + 0x6c]
push ecx
push ebp
push esi
call fcn.005400bf
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x478753
push esi
call fcn.0046e110
add esp, 4
jmp 0x478753
test edi, edi
jle 0x4786e2
jmp 0x4786b0
movzx eax, word [esp + ecx*2 + 0x6c]
mov edx, 0x5c
cmp dx, ax
je 0x4786d3
mov edx, 0x2f
cmp dx, ax
je 0x4786d3
mov edx, 0x3a
cmp dx, ax
jne 0x4786dd
mov eax, 0x5f
mov word [esp + ecx*2 + 0x6c], ax
inc ecx
cmp ecx, edi
jl 0x4786b0
lea ecx, [esp + 0x6c]
push ecx
push ebp
push esi
call fcn.005400bf
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x478709
push 0
push esi
call ebx
cmp dword [0x5ed760], 0
je 0x478753
push 0x14
lea edx, [esp + 0x20]
push edx
push str.yyyyMMdd
push 0
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0x57c428
push ebp
push esi
call fcn.005400bf
lea eax, [esp + 0x28]
push eax
push ebp
push esi
call fcn.005400bf
add esp, 0x18
push esi
call edi
test eax, eax
jne 0x478753
push eax
push esi
call ebx
mov edi, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x49c]
push esi
push edi
call fcn.0054013c
push 0x57c428
push esi
push edi
call fcn.005400bf
mov ecx, dword [esp + 0x28]
push ecx
push esi
push edi
call fcn.005400bf
add esp, 0x24
cmp dword [0x5ed760], 0
je 0x4787db
push 0x14
lea edx, [esp + 0x20]
push edx
push str..yyyyMMdd
push 0
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0x14
lea eax, [esp + 0x48]
push eax
push str._HHmmss
push 0
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
lea ecx, [esp + 0x1c]
push ecx
push esi
push edi
call fcn.005400bf
lea edx, [esp + 0x50]
push edx
push esi
push edi
call fcn.005400bf
add esp, 0x18
cmp dword [0x5ed75c], 0
je 0x478820
mov eax, 0x2e
lea edx, [esp + 0x10]
mov word [esp + 0x6c], ax
push edx
lea eax, [esp + 0x72]
xor ecx, ecx
push eax
mov word [esp + 0x76], cx
mov dword [esp + 0x18], 0x1f3
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x478820
lea ecx, [esp + 0x6c]
push ecx
push esi
push edi
call fcn.005400bf
add esp, 0xc
mov edx, dword [esp + 0x14]
push edx
push esi
push edi
call fcn.005400bf
mov ecx, dword [esp + 0x488]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0053fa67
add esp, 0x470
ret