Function at 0x47b310
Capabilities:
Create directory
Create process on windows
Get common file path
Get file size
Move file
Read file on windows
Read file via mapping
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a0de0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xad0
cmp dword [ebp + 8], 0
je 0x47b35a
cmp dword [ebp + 0xc], 0
je 0x47b35a
mov eax, dword [ebp + 8]
push eax
call fcn.0048bc60
add esp, 4
test eax, eax
je 0x47b35a
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0048bc60
add esp, 4
test eax, eax
jne 0x47b361
xor al, al
jmp 0x47bcc2
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.004236e0
mov dword [ebp - 4], 0
push 4
push str.temp
mov edx, dword [ebp + 0xc]
push edx
call fcn.0048fd20
add esp, 0xc
test eax, eax
jne 0x47b3ec
lea eax, [ebp - 0x154]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x154]
push ecx
call fcn.0048bc60
add esp, 4
push eax
lea edx, [ebp - 0x154]
push edx
lea ecx, [ebp - 0x28]
call fcn.0041c910
mov eax, dword [ebp + 0xc]
add eax, 6
mov dword [ebp - 0x9f0], eax
mov ecx, dword [ebp - 0x9f0]
push ecx
call fcn.0048bc60
add esp, 4
push eax
mov edx, dword [ebp - 0x9f0]
push edx
lea ecx, [ebp - 0x28]
call fcn.0041c910
jmp 0x47b7d2
push 6
push str.windir
mov eax, dword [ebp + 0xc]
push eax
call fcn.0048fd20
add esp, 0xc
test eax, eax
jne 0x47b49f
push 0x104
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x25c]
push edx
call fcn.0048bc60
add esp, 4
push eax
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041c910
lea ecx, [ebp - 0x25c]
push ecx
call fcn.0048bc60
add esp, 4
movsx edx, byte [ebp + eax - 0x25d]
cmp edx, 0x5c
je 0x47b46f
push 0x4a2bc0
call fcn.0048bc60
add esp, 4
push eax
push 0x4a2bc0
lea ecx, [ebp - 0x28]
call fcn.0041c910
mov eax, dword [ebp + 0xc]
add eax, 8
mov dword [ebp - 0x9f4], eax
mov ecx, dword [ebp - 0x9f4]
push ecx
call fcn.0048bc60
add esp, 4
push eax
mov edx, dword [ebp - 0x9f4]
push edx
lea ecx, [ebp - 0x28]
call fcn.0041c910
jmp 0x47b7d2
push 6
push str.sysdir
mov eax, dword [ebp + 0xc]
push eax
call fcn.0048fd20
add esp, 0xc
test eax, eax
jne 0x47b552
push 0x104
lea ecx, [ebp - 0x364]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x364]
push edx
call fcn.0048bc60
add esp, 4
push eax
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041c910
lea ecx, [ebp - 0x364]
push ecx
call fcn.0048bc60
add esp, 4
movsx edx, byte [ebp + eax - 0x365]
cmp edx, 0x5c
je 0x47b522
push 0x4a2bc0
call fcn.0048bc60
add esp, 4
push eax
push 0x4a2bc0
lea ecx, [ebp - 0x28]
call fcn.0041c910
mov eax, dword [ebp + 0xc]
add eax, 8
mov dword [ebp - 0x9f8], eax
mov ecx, dword [ebp - 0x9f8]
push ecx
call fcn.0048bc60
add esp, 4
push eax
mov edx, dword [ebp - 0x9f8]
push edx
lea ecx, [ebp - 0x28]
call fcn.0041c910
jmp 0x47b7d2
push 7
push str.profile
mov eax, dword [ebp + 0xc]
push eax
call fcn.0048fd20
add esp, 0xc
test eax, eax
jne 0x47b60b
lea ecx, [ebp - 0x46c]
push ecx
push 0
push 0
push 0x801a
push 0
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathA]
lea edx, [ebp - 0x46c]
push edx
call fcn.0048bc60
add esp, 4
push eax
lea eax, [ebp - 0x46c]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041c910
lea ecx, [ebp - 0x46c]
push ecx
call fcn.0048bc60
add esp, 4
movsx edx, byte [ebp + eax - 0x46d]
cmp edx, 0x5c
je 0x47b5db
push 0x4a2bc0
call fcn.0048bc60
add esp, 4
push eax
push 0x4a2bc0
lea ecx, [ebp - 0x28]
call fcn.0041c910
mov eax, dword [ebp + 0xc]
add eax, 9
mov dword [ebp - 0x9fc], eax
mov ecx, dword [ebp - 0x9fc]
push ecx
call fcn.0048bc60
add esp, 4
push eax
mov edx, dword [ebp - 0x9fc]
push edx
lea ecx, [ebp - 0x28]
call fcn.0041c910
jmp 0x47b7d2
push 2
push 0x4a3bb8
mov eax, dword [ebp + 0xc]
push eax
call fcn.0048fd20
add esp, 0xc
test eax, eax
jne 0x47b7b9
push 0x310
push 0
lea ecx, [ebp - 0x99c]
push ecx
call fcn.0048d000
add esp, 0xc
lea edx, [ebp - 0x57c]
push edx
call fcn.00433730
add esp, 4
lea eax, [ebp - 0x57c]
push eax
push 0x310
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x470], eax
push 0
push 0
push 0
push 0xf001f
mov ecx, dword [ebp - 0x470]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x9a0], eax
cmp dword [ebp - 0x9a0], 0
je 0x47b6dd
push 0x310
mov edx, dword [ebp - 0x9a0]
push edx
lea eax, [ebp - 0x99c]
push eax
call fcn.0048ccc0
add esp, 0xc
mov ecx, dword [ebp - 0x9a0]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 0x470]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x894]
push eax
lea ecx, [ebp - 0x684]
push ecx
call fcn.0048e090
add esp, 8
lea edx, [ebp - 0x684]
push edx
call fcn.0048bc60
add esp, 4
mov dword [ebp - 0x688], eax
cmp dword [ebp - 0x688], 0
jl 0x47b71f
mov eax, dword [ebp - 0x688]
movsx ecx, byte [ebp + eax - 0x684]
cmp ecx, 0x5c
je 0x47b71f
mov edx, dword [ebp - 0x688]
sub edx, 1
mov dword [ebp - 0x688], edx
jmp 0x47b6f2
cmp dword [ebp - 0x688], 0
jl 0x47b736
mov eax, dword [ebp - 0x688]
mov byte [ebp + eax - 0x684], 0
lea ecx, [ebp - 0x684]
push ecx
call fcn.0048bc60
add esp, 4
push eax
lea edx, [ebp - 0x684]
push edx
lea ecx, [ebp - 0x28]
call fcn.0041c910
lea eax, [ebp - 0x684]
push eax
call fcn.0048bc60
add esp, 4
movsx ecx, byte [ebp + eax - 0x685]
cmp ecx, 0x5c
je 0x47b78c
push 0x4a2bc0
call fcn.0048bc60
add esp, 4
push eax
push 0x4a2bc0
lea ecx, [ebp - 0x28]
call fcn.0041c910
mov edx, dword [ebp + 0xc]
add edx, 4
mov dword [ebp - 0xa04], edx
mov eax, dword [ebp - 0xa04]
push eax
call fcn.0048bc60
add esp, 4
push eax
mov ecx, dword [ebp - 0xa04]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0041c910
jmp 0x47b7d2
mov edx, dword [ebp + 0xc]
push edx
call fcn.0048bc60
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.004241c0
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x9b8], esp
mov dword [ebp - 0xa10], ecx
push 0
push 0
mov ecx, dword [ebp - 0xa10]
call fcn.004236e0
mov edx, dword [ebp + 8]
push edx
call fcn.0048bc60
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xa10]
call fcn.004241c0
mov ecx, dword [ebp - 0xa10]
mov dword [ebp - 0xab8], ecx
lea edx, [ebp - 0x48]
push edx
call fcn.0047ae00
add esp, 0x24
mov dword [ebp - 0xabc], eax
mov byte [ebp - 4], 1
mov byte [ebp - 0x29], 0
xor eax, eax
cmp dword [ebp - 0x34], 0
sete al
movzx ecx, al
test ecx, ecx
jne 0x47b9d2
cmp dword [ebp - 0x30], 0x10
jb 0x47b85b
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0xac0], edx
jmp 0x47b864
lea eax, [ebp - 0x44]
mov dword [ebp - 0xac0], eax
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov ecx, dword [ebp - 0xac0]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x9a4], eax
cmp dword [ebp - 0x9a4], 0xffffffff
je 0x47b9d2
mov dword [ebp - 0x9b0], 0
lea edx, [ebp - 0x9b0]
push edx
mov eax, dword [ebp - 0x9a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x9ac], eax
mov ecx, dword [ebp - 0x9ac]
push ecx
call fcn.0048a6d0
add esp, 4
mov dword [ebp - 0x9bc], eax
mov edx, dword [ebp - 0x9bc]
mov dword [ebp - 0x9a8], edx
cmp dword [ebp - 0x9a8], 0
je 0x47b9c5
mov dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x9ac]
push eax
push 0
mov ecx, dword [ebp - 0x9a8]
push ecx
call fcn.0048d000
add esp, 0xc
push 0
lea edx, [ebp - 0x9b4]
push edx
mov eax, dword [ebp - 0x9ac]
push eax
mov ecx, dword [ebp - 0x9a8]
push ecx
mov edx, dword [ebp - 0x9a4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47b9aa
mov eax, dword [ebp - 0x9b4]
mov dword [ebp - 0xa18], eax
push 0
push 0
push 0
call fcn.00482980
add esp, 0xc
mov dword [ebp - 0xa14], eax
mov ecx, dword [ebp - 0xa18]
push ecx
mov edx, dword [ebp - 0x9a8]
push edx
mov eax, dword [ebp - 0xa14]
push eax
call fcn.00482980
add esp, 0xc
mov dword [ebp - 0xa14], eax
mov ecx, dword [ebp - 0xa14]
xor ecx, 0x5e340a23
mov dword [ebp - 0xa14], ecx
mov edx, dword [ebp - 0xa14]
sub edx, dword [ebp + 0x10]
neg edx
sbb edx, edx
inc edx
mov byte [ebp - 0xa19], dl
movzx eax, byte [ebp - 0xa19]
test eax, eax
je 0x47b9aa
mov byte [ebp - 0x29], 1
mov ecx, dword [ebp - 0x9a8]
mov dword [ebp - 0x9c0], ecx
mov edx, dword [ebp - 0x9c0]
push edx
call fcn.0048bd78
add esp, 4
mov eax, dword [ebp - 0x9a4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, byte [ebp - 0x29]
test ecx, ecx
jne 0x47ba0f
mov byte [ebp - 0x9c1], 0
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.004236e0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004236e0
mov al, byte [ebp - 0x9c1]
jmp 0x47bcc2
mov byte [ebp - 0xa1a], 0x5c
push 1
push 0xffffffffffffffff
lea edx, [ebp - 0xa1a]
push edx
lea ecx, [ebp - 0x48]
call fcn.00419ba0
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffff
jne 0x47ba67
mov byte [ebp - 0x9c2], 0
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.004236e0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004236e0
mov al, byte [ebp - 0x9c2]
jmp 0x47bcc2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa30], eax
cmp dword [ebp - 0x10], 0x10
jb 0x47ba81
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0xac4], ecx
jmp 0x47ba8a
lea edx, [ebp - 0x24]
mov dword [ebp - 0xac4], edx
mov eax, dword [ebp - 0xac4]
add eax, dword [ebp - 0xa30]
movsx ecx, byte [eax - 1]
cmp ecx, 0x5c
je 0x47baba
push 0x4a2bc0
call fcn.0048bc60
add esp, 4
push eax
push 0x4a2bc0
lea ecx, [ebp - 0x28]
call fcn.0041c910
cmp dword [ebp - 0x30], 0x10
jb 0x47bacb
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0xac8], edx
jmp 0x47bad4
lea eax, [ebp - 0x44]
mov dword [ebp - 0xac8], eax
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0xac8]
lea eax, [edx + ecx + 1]
mov dword [ebp - 0xa3c], eax
mov ecx, dword [ebp - 0xa3c]
push ecx
call fcn.0048bc60
add esp, 4
push eax
mov edx, dword [ebp - 0xa3c]
push edx
lea ecx, [ebp - 0x28]
call fcn.0041c910
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0xa49], 0x5c
push 1
mov eax, dword [ebp - 0x4c]
add eax, 1
push eax
lea ecx, [ebp - 0xa49]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00419a90
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffff
je 0x47bb9f
mov edx, dword [ebp - 0x4c]
push edx
push 0
lea eax, [ebp - 0x9e0]
push eax
lea ecx, [ebp - 0x28]
call fcn.00416b20
mov dword [ebp - 0xa50], eax
mov ecx, dword [ebp - 0xa50]
cmp dword [ecx + 0x18], 0x10
jb 0x47bb6d
mov edx, dword [ebp - 0xa50]
mov eax, dword [edx + 4]
mov dword [ebp - 0xacc], eax
jmp 0x47bb7c
mov ecx, dword [ebp - 0xa50]
add ecx, 4
mov dword [ebp - 0xacc], ecx
push 0
mov edx, dword [ebp - 0xacc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push 1
lea ecx, [ebp - 0x9e0]
call fcn.004236e0
jmp 0x47bb0d
cmp dword [ebp - 0x30], 0x10
jb 0x47bbb0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xad0], eax
jmp 0x47bbb9
lea ecx, [ebp - 0x44]
mov dword [ebp - 0xad0], ecx
push 0x80
mov edx, dword [ebp - 0xad0]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [ebp - 0x10], 0x10
jb 0x47bbdc
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xad4], eax
jmp 0x47bbe5
lea ecx, [ebp - 0x24]
mov dword [ebp - 0xad4], ecx
cmp dword [ebp - 0x30], 0x10
jb 0x47bbf6
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0xad8], edx
jmp 0x47bbff
lea eax, [ebp - 0x44]
mov dword [ebp - 0xad8], eax
mov ecx, dword [ebp - 0xad4]
push ecx
mov edx, dword [ebp - 0xad8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x47bc27
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.00423530
cmp dword [ebp - 0x10], 0x10
jb 0x47bc38
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0xadc], ecx
jmp 0x47bc41
lea edx, [ebp - 0x24]
mov dword [ebp - 0xadc], edx
push 5
push 0
push 0
mov eax, dword [ebp - 0xadc]
push eax
push 0x4a2cb0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x47bc92
mov byte [ebp - 0x9e1], 0
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.004236e0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004236e0
mov al, byte [ebp - 0x9e1]
jmp 0x47bcc2
mov byte [ebp - 0x9e2], 1
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.004236e0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004236e0
mov al, byte [ebp - 0x9e2]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret