Function at 0x479a10
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0xec8960]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 1
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x68]
mov edx, dword [esi + 0x6c]
mov dword [esi + 0x400d8], 0xffffffff
mov eax, dword [edi + 0x40]
mov ecx, dword [eax + edx*8]
mov eax, dword [eax + edx*8 + 4]
mov dword [esi + 0x400b0], ecx
mov dword [esi + 0x400b4], eax
jne 0x479a59
or ecx, eax
je 0x479bdd
mov ecx, dword [esi]
cmp dword [ecx + 0x40068], 0
je 0x479bdd
push edx
push edi
call fcn.004798e0
mov ecx, dword [esi]
mov dword [esi + 0x70], eax
cmp byte [ecx], 0x65
jne 0x479a87
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x6c]
mov eax, dword [eax + 0x34]
mov ecx, dword [eax + ecx*4]
jmp 0x479ae2
add ecx, 0xc
mov edx, 0xe9af88
mov eax, ecx
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x479ab1
test bl, bl
je 0x479aad
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x479ab1
add eax, 2
add edx, 2
test bl, bl
jne 0x479a91
xor eax, eax
jmp 0x479ab6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x479abe
xor edi, edi
jmp 0x479acd
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x479ac1
sub ecx, edx
lea edi, [ecx + 1]
mov ecx, dword [esi + 0x68]
lea eax, [esi + 0xb0]
push eax
push dword [esi + 0x6c]
call fcn.004795c0
lea ecx, [edi + eax]
mov edx, dword [esi + 0x8c]
lea ebx, [esi + 0x78]
nop dword [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x479af0
mov edx, dword [esi + 0x84]
mov ecx, dword [esi + 0x88]
call fcn.0045cd00
push dword [esi + 0x90]
mov edi, dword [sym.imp.USER32.dll_CharToOemW]
push dword [esi + 0x84]
call edi
cmp dword [esi + 0x70], 0
je 0x479b63
mov eax, dword [esi]
mov dl, byte [eax]
cmp dl, 0x74
je 0x479b63
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x6c]
mov eax, dword [eax + 0x58]
cmp dword [eax + ecx*4], 0
je 0x479bfc
cmp dl, 0x65
je 0x479b63
mov ecx, dword [esi + 0x84]
call fcn.0045cf00
push dword [esi + 0x84]
call fcn.00499657
add esp, 4
cmp dword [ebp + 8], 0
je 0x479b81
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x6c]
mov eax, dword [eax + 0x40]
cmp dword [eax + ecx*8 + 4], 0
jl 0x479bdd
jg 0x479b81
cmp dword [eax + ecx*8], 0
jbe 0x479bdd
mov ecx, dword [esi + 0x68]
mov edx, dword [esi + 0x6c]
mov eax, dword [ecx + 0x58]
cmp dword [eax + edx*4], 0
je 0x479b97
mov eax, dword [esi]
cmp byte [eax], 0x78
jne 0x479bdd
lea eax, [esi + 0xb0]
push eax
push edx
call fcn.004795c0
mov edx, dword [esi + 0xa8]
nop word [eax + eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx], cl
lea edx, [edx + 1]
test cl, cl
jne 0x479bb0
mov edx, dword [esi + 0xa0]
mov ecx, dword [esi + 0xa4]
call fcn.0045cd00
push dword [esi + 0xac]
push dword [esi + 0xa0]
call edi
mov eax, dword [esi]
cmp dword [eax + 0x40068], 0
setne al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004888df
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 8]
call eax
mov byte [ebp - 9], al
test al, al
je 0x479ca9
mov ecx, dword [esi]
cmp dword [ecx + 0x40080], 0
je 0x479c27
mov dword [esi + 0x70], 0
jmp 0x479ca9
cmp dword [ecx + 0x4007c], 0
jne 0x479ca9
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x68]
mov edx, dword [esi + 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 0x4c]
mov ebx, dword [eax + edx*8]
mov edi, dword [eax + edx*8 + 4]
mov eax, dword [ecx + 0x40]
mov ecx, dword [esi + 4]
push edi
push ebx
push dword [eax + edx*8 + 4]
push dword [eax + edx*8]
push dword [esi + 0x90]
call dword [ebp - 8]
movsx eax, al
add eax, 0xffffff9f
cmp eax, 0x12
ja case.0x479c75.98
movzx eax, byte [eax + 0x479d94]
jmp dword [eax*4 + 0x479d80]
mov eax, dword [esi]
mov dword [eax + 0x4007c], 1
jmp case.0x479c75.98
mov eax, dword [esi]
mov dword [eax + 0x40080], 1
mov dword [esi + 0x70], 0
mov al, byte [ebp - 9]
lea ebx, [esi + 0x78]
mov edi, dword [sym.imp.USER32.dll_CharToOemW]
cmp dword [esi + 0x70], 0
je 0x479b63
test al, al
je 0x479cbe
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
mov ecx, dword [esi + 0x84]
call fcn.0045cf00
push 0
lea eax, [ebp - 8]
push eax
push 0x180
push 0x40
push 0x8301
push dword [esi + 0x84]
call fcn.0049bf01
mov ecx, dword [ebp - 8]
or edx, 0xffffffff
add esp, 0x18
test eax, eax
cmovne ecx, edx
mov dword [esi + 0x80], ecx
test ecx, ecx
jns 0x479b63
cmp dword [0xecedb0], 0
jne 0x479d74
jmp 0x479d2a
sub esp, 8
mov ecx, esi
call fcn.0047b400
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004888df
mov esp, ebp
pop ebp
ret 4
mov ecx, 0x40000
call fcn.00477d00
mov ecx, 0x40000
mov ebx, eax
call fcn.00477d00
push dword [esi + 0x88]
mov edi, eax
push str.ERROR:_cant_open_file__s
push ebx
call fcn.0042e890
add esp, 0xc
mov edx, edi
mov ecx, ebx
call fcn.0045cec0
push edi
push 0xea0114
call fcn.00437320
add esp, 8
push 2
call fcn.00497ee7
push 1
push 0xeced70
call fcn.0048a9ab
jl 0x479d1e
inc edi
add byte [esi + 0xd00479c], dl
popfd
inc edi
add byte [edx - 0x62ffb864], cl
pushfd
inc edi
add byte [eax], al
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add dword [esp + eax], eax
add al, byte [ebx + eax]
int3