Function at 0x472a70
Capabilities:
Create directory
Query environment variable
Set environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4c8d9e
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x509354]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x509354]
xor eax, esp
push eax
lea eax, [esp + 0xb4]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], esi
cmp byte [0x50ad14], bl
je 0x472dc0
push ebx
lea eax, [esp + 0x98]
push eax
mov byte [esp + 0x22], bl
call fcn.00471760
mov edx, dword [str.acro_rd_dir]
mov ebp, 7
xor ecx, ecx
mov eax, edx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov word [esp + 0x28], cx
lea edi, [eax + 2]
jmp 0x472b00
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x472b00
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x2c]
call fcn.00401cd6
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x80]
push ecx
mov byte [esp + 0xc8], 1
call fcn.00438360
add esp, 0xc
mov edi, 8
mov byte [esp + 0xbc], 3
cmp dword [esp + 0x3c], edi
jb 0x472b5f
mov edx, dword [esp + 0x28]
push edx
call fcn.0048e006
add esp, 4
mov ecx, dword [esp + 0x7c]
xor eax, eax
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov word [esp + 0x28], ax
cmp dword [esp + 0x90], edi
jae 0x472b7f
lea ecx, [esp + 0x7c]
mov eax, dword [esp + 0x98]
cmp dword [esp + 0xac], edi
jae 0x472b96
lea eax, [esp + 0x98]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
test eax, eax
jne 0x472bb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x472d5b
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ebx
push ebx
push str.TEMP
call ebp
lea ecx, [esp + 0x1c]
push ecx
inc eax
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x24], ebx
call fcn.00428d80
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
sub esi, eax
sar esi, 1
push esi
push eax
push str.TEMP
mov byte [esp + 0xc8], 4
call ebp
push ebx
push ebx
push 0x4f04f8
call ebp
lea edx, [esp + 0x1c]
inc eax
push edx
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], ebx
call fcn.00428d80
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
sub edi, ebx
sar edi, 1
push edi
push ebx
push 0x4f04f8
mov byte [esp + 0xc8], 5
call ebp
mov eax, dword [esp + 0x7c]
mov ebp, 8
cmp dword [esp + 0x90], ebp
jae 0x472c44
lea eax, [esp + 0x7c]
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x472d0b
mov eax, dword [esp + 0x7c]
cmp dword [esp + 0x90], ebp
jae 0x472c69
lea eax, [esp + 0x7c]
mov ebp, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push eax
push 0x4f04f8
call ebp
test eax, eax
je 0x472d11
call fcn.0046ffd0
mov dword [0x50ad18], eax
test eax, eax
je 0x472d11
push 0x4e9538
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x64]
push ecx
call fcn.00409d0c
add esp, 0xc
mov ecx, dword [esp + 0x20]
push eax
mov byte [esp + 0xc0], 6
call fcn.004719d0
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1b], al
mov byte [esp + 0xbc], 5
call fcn.0040198e
cmp byte [esp + 0x1b], 0
je 0x472d11
push 0x4cfe30
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x64]
push eax
call fcn.00409d0c
push eax
mov byte [esp + 0xcc], 7
call fcn.00410144
add esp, 0x10
lea ecx, [esp + 0x5c]
call fcn.0040198e
mov byte [esp + 0x1a], 1
jmp 0x472d11
mov ebp, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp esi, 1
mov esi, dword [esp + 0x44]
jbe 0x472d22
push esi
push str.TEMP
call ebp
cmp edi, 1
jbe 0x472d2f
push ebx
push 0x4f04f8
call ebp
test ebx, ebx
je 0x472d3c
push ebx
call fcn.0048e006
add esp, 4
test esi, esi
je 0x472d49
push esi
call fcn.0048e006
add esp, 4
mov esi, dword [esp + 0x20]
xor ebx, ebx
lea ebp, [ebx + 7]
lea edi, [ebx + 8]
cmp byte [esp + 0x1a], bl
jne 0x472d62
mov byte [0x50ad14], 0
cmp dword [esp + 0x90], edi
jb 0x472d78
mov ecx, dword [esp + 0x7c]
push ecx
call fcn.0048e006
add esp, 4
xor edx, edx
mov dword [esp + 0x90], ebp
mov dword [esp + 0x8c], ebx
mov word [esp + 0x7c], dx
mov dword [esp + 0xbc], 0xffffffff
cmp dword [esp + 0xac], edi
jb 0x472db1
mov eax, dword [esp + 0x98]
push eax
call fcn.0048e006
add esp, 4
cmp byte [0x50ad14], 0
jne 0x472ed0
jmp 0x472dc8
mov ebp, 7
lea edi, [ebp + 1]
call fcn.00446560
cmp eax, 4
jl 0x472e03
push 1
push str.TempLow
lea ecx, [esp + 0x64]
push 0x1c
push ecx
call fcn.004703a0
add esp, 0x10
push eax
mov ecx, esi
mov dword [esp + 0xc0], edi
mov dword [esp + 0x18], 1
call fcn.004719d0
test al, al
je 0x472e5a
push ebx
push str.TempAdobeAcrobat10.0
lea edx, [esp + 0x48]
push 0x1c
push edx
call fcn.004703a0
add esp, 0x10
or dword [esp + 0x14], 2
push eax
mov ecx, esi
mov dword [esp + 0xc0], 9
call fcn.00471820
test al, al
je 0x472e5a
push 1
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call fcn.00471760
or dword [esp + 0x14], 4
push eax
mov ecx, esi
mov dword [esp + 0xc0], 0xa
call fcn.004719d0
test byte [esp + 0x14], 4
je 0x472e88
and dword [esp + 0x14], 0xfffffffb
cmp dword [esp + 0x3c], edi
jb 0x472e79
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0048e006
add esp, 4
xor edx, edx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov word [esp + 0x28], dx
test byte [esp + 0x14], 2
je 0x472eb6
and dword [esp + 0x14], 0xfffffffd
cmp dword [esp + 0x58], edi
jb 0x472ea7
mov eax, dword [esp + 0x44]
push eax
call fcn.0048e006
add esp, 4
xor ecx, ecx
mov dword [esp + 0x58], ebp
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], cx
test byte [esp + 0x14], 1
je 0x472ed0
cmp dword [esp + 0x74], edi
jb 0x472ed0
mov edx, dword [esp + 0x60]
push edx
call fcn.0048e006
add esp, 4
mov al, 1
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0048e25d
add esp, 0xac
ret