Function at 0x1006ed90
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x310]
sub esp, 0x310
push 0xfffffffffffffffe
push 0x10182ea0
push 0x10132540
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10189710]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x30c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0x318]
or edi, 0xffffffff
mov dword [ebp - 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x34], ebx
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], eax
mov byte [ebp], al
push 0x103
push eax
lea eax, [ebp + 1]
push eax
call fcn.1012e060
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], ecx
mov eax, dword [0x101c885c]
cmp eax, ecx
jne 0x1006ee31
cmp dword [ebp + 0x31c], ecx
jne 0x1006ee31
push ecx
mov ecx, str.GlobalGenLogMutex
call fcn.10067220
mov dword [0x101c885c], eax
cmp esi, 0xffffffff
jne 0x1006ee51
push 0x101c885c
call fcn.10082e10
lea ecx, [ebp - 0x1c]
push ecx
call fcn.10082e10
mov edi, dword [ebp - 0x1c]
mov eax, dword [0x101c885c]
cmp dword [ebp + 0x31c], 0
jne 0x1006ee6d
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
jmp 0x1006f387
test eax, eax
je 0x1006ee9d
xor ebx, ebx
mov dword [ebp - 0x38], ebx
push 0x5a
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1006ee8b
mov ebx, 1
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], ebx
cmp ebx, 1
je 0x1006ee9d
push 0x101c885c
call fcn.10082e10
push 1
xor ecx, ecx
lea edx, [ebp]
call fcn.10082fc0
add esp, 4
cmp dword [0x1019395c], 0xffffffff
jne 0x1006eed6
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1019395c
xor ebx, ebx
xor edx, edx
xor ecx, ecx
call fcn.1006bdc0
add esp, 0x20
mov eax, dword [0x10194224]
call fcn.10067fc0
test eax, eax
jne 0x1006f00d
test esi, esi
je 0x1006efd6
cmp byte [esi], al
je 0x1006efd6
mov eax, edi
call fcn.10067fc0
test eax, eax
jne 0x1006f00d
push bind
push 4
push 3
push 4
mov edi, esi
call fcn.1005aa40
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x1c], edi
call fcn.10067fc0
test eax, eax
jne 0x1006f00d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1006f322
push 0x5c
push esi
call fcn.10129030
add esp, 8
mov edi, eax
test edi, edi
je 0x1006ef51
inc edi
jmp 0x1006ef53
mov edi, esi
lea edx, [ebp + 0x104]
push edx
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.locallow_
push str.local_
lea eax, [ebp + 0x104]
push eax
call fcn.10064100
add esp, 0xc
lea ecx, [ebp + 0x104]
call fcn.10065200
push edi
lea ecx, [ebp + 0x104]
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
push 0x82000000
push 4
push 3
push 4
lea edi, [ebp + 0x104]
call fcn.1005aa40
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x1c], edi
call fcn.10067fc0
test eax, eax
je 0x1006f322
push 0x10194224
call fcn.10082e10
mov dword [0x10194224], edi
jmp 0x1006f013
cmp byte [0x101c8860], 0
je 0x1006f0e6
push bind
push 4
push 3
push 4
mov edi, 0x101c8860
call fcn.1005aa40
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x1c], edi
call fcn.10067fc0
test eax, eax
je 0x1006f322
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [0x101c8968], 0
jne 0x1006f060
mov byte [ebp + 0x204], 0
push 0x104
push 0
lea edx, [ebp + 0x205]
push edx
call fcn.1012e060
add esp, 0xc
push 0x105
lea eax, [ebp + 0x204]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x101c8968
lea ecx, [ebp + 0x204]
call fcn.100620f0
add esp, 4
push 0x5000
call fcn.10128320
mov ebx, eax
mov dword [ebp - 0x28], ebx
push 0x5000
call fcn.10128320
add esp, 8
mov dword [ebp - 0x20], eax
test ebx, ebx
je 0x1006f30f
test eax, eax
je 0x1006f30f
mov byte [eax], 0
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp]
push ecx
push 0x101c8968
push str.__s___s__04x__04x__
mov edx, dword [ebp - 0x20]
push edx
call fcn.10127dc0
lea eax, [ebp + 0x320]
push eax
mov ecx, dword [ebp + 0x31c]
push ecx
push ebx
call fcn.1012b69a
add esp, 0x24
push ebx
cmp byte [ebx], 0xa
je 0x1006f23e
mov edx, dword [ebp - 0x20]
push edx
call esi
jmp 0x1006f248
push 0x105
push 0x101c8860
call fcn.1005f830
add esp, 8
mov ecx, 0x101c8860
call fcn.10065200
push str.general.log
push 0x101c8860
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
push bind
push 4
push 3
push 4
mov edi, 0x101c8860
call fcn.1005aa40
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x1c], edi
call fcn.10067fc0
test eax, eax
jne 0x1006f013
mov byte [0x101c8860], al
push 0x105
push 0x101c8860
call fcn.1005f830
add esp, 8
mov ecx, 0x101c8860
call fcn.10065200
push str.TEMPgeneral.log
push 0x101c8860
call esi
push bind
push 4
push 3
push 4
mov edi, 0x101c8860
call fcn.1005aa40
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x1c], edi
call fcn.10067fc0
test eax, eax
jne 0x1006f013
mov byte [0x101c8860], al
push 0x101c8860
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, 0x101c8860
call fcn.10065200
push str.general.log
push 0x101c8860
call esi
push bind
push 4
push 3
push 4
mov edi, 0x101c8860
call fcn.1005aa40
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x1c], edi
call fcn.10067fc0
test eax, eax
jne 0x1006f013
mov byte [0x101c8860], al
mov ecx, 0x101c8860
call fcn.1007f9e0
mov ecx, 0x101c8860
call fcn.10065200
push str.general.log
push 0x101c8860
call esi
push bind
push 4
push 3
push 4
mov edi, 0x101c8860
call fcn.1005aa40
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x1c], edi
call fcn.10067fc0
test eax, eax
je 0x1006f322
jmp 0x1006f013
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x20]
call fcn.1005a130
mov ebx, eax
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x20]
cmp ebx, 1
jne 0x1006f276
cmp byte [eax], 0xa
jne 0x1006f273
mov byte [eax], 0
xor ebx, ebx
mov dword [ebp - 0x24], ebx
jmp 0x1006f29a
cmp ebx, 1
jbe 0x1006f28f
cmp byte [ebx + eax - 1], 0xa
jne 0x1006f28f
cmp byte [ebx + eax - 2], 0xd
je 0x1006f28f
mov byte [ebx + eax - 1], 0
dec ebx
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x1006f29a
cmp byte [ebx + eax - 1], 0xa
je 0x1006f2a8
push 0x10155f64
push eax
call esi
add ebx, 2
mov dword [ebp - 0x24], ebx
mov ecx, dword [0x10194224]
mov eax, ecx
call fcn.10067fc0
push 2
push 0
push 0
test eax, eax
jne 0x1006f2e9
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1006f2d1
lea ecx, [ebp - 0x1c]
push ecx
jmp 0x1006f31d
push 0
lea edx, [ebp - 0x30]
push edx
push ebx
mov eax, dword [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x1c]
push ecx
jmp 0x1006f31d
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1006f318
push 0
lea edx, [ebp - 0x30]
push edx
push ebx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [0x10194224]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1006f322
lea edx, [ebp - 0x1c]
push edx
call fcn.10082e10
push 0x10194224
call fcn.10082e10
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x1006f332
push eax
call fcn.10128243
add esp, 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1006f360
push eax
call fcn.10128243
add esp, 4
jmp 0x1006f360
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x101c885c]
test eax, eax
je 0x1006f37d
cmp dword [ebp - 0x2c], 1
jne 0x1006f37d
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x30c]
xor ecx, ebp
call fcn.10127db1
add ebp, 0x310
mov esp, ebp
pop ebp
ret