Function at 0x407276
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1094
call fcn.0040ce40
mov edx, dword [0x429810]
push ebx
push esi
push edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1090]
mov dword [ebp - 0x1094], edx
rep stosd dword es:[edi], eax
push 0x1f
lea edi, [ebp - 0x90]
pop ecx
mov dword [ebp - 0x94], edx
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0x14]
xor esi, esi
push 0x40f784
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, 0x825
push ebx
call sub.MSVCRT.dll_malloc
cmp eax, esi
pop ecx
mov dword [ebp + 0x14], eax
jne 0x4072f5
push 0x40f780
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 7
jmp 0x4074eb
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x40f77c
push edi
call esi
push ebx
push 0
push dword [ebp + 0x14]
call sub.MSVCRT.dll_memset
push ebx
mov ebx, dword [ebp + 0x14]
push ebx
push str.87494a0ba8f8f94efd7debcaf91847e4691a6cfc2e9e4ed8eb5a4a79f729b9e63bfcddfa2d9ceb1a2a985739f54afb7dedcefd1c4be60a8808
call fcn.0040788c
add esp, 0x18
test eax, eax
je 0x407333
push ebx
call sub.MSVCRT.dll_free
mov dword [esp], 0x40f704
jmp 0x407380
push 0x40f700
push edi
call esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ebx
call fcn.00407934
push ebx
mov dword [ebp + 0x14], eax
call sub.MSVCRT.dll_free
mov eax, dword [ebp + 0xc]
add esp, 0x18
test eax, eax
je 0x407369
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x407375
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
cmp dword [ebp + 0x14], 0
je 0x407388
push 0x40f6fc
push edi
call esi
jmp 0x4072ee
push 0x40f6f8
push edi
call esi
mov eax, dword [ebp - 4]
push 0xb
push str._HTML__CFG_
mov dword [ebp + 0x14], eax
push dword [ebp - 8]
call fcn.00409b04
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x407406
sub dword [ebp + 0x14], 0xb
jne 0x4073c3
push 0x40f6e8
push edi
call esi
push 8
jmp 0x4074eb
push 0x40f6e4
push edi
call esi
push dword [ebp + 0x14]
mov eax, dword [ebp - 8]
add eax, 0xb
push str.__CFG___HTML___EGMC__
push eax
call fcn.00409b04
add esp, 0xc
mov dword [ebp + 0x14], eax
test eax, eax
jne 0x4073f0
push 0x40f6c8
jmp 0x4073b9
push 0x40f6c4
push edi
call esi
mov eax, dword [ebp + 0x14]
add eax, 0x15
sub ebx, eax
mov dword [ebp - 8], eax
add dword [ebp - 4], ebx
lea eax, [ebp - 0x1094]
push eax
xor eax, eax
push eax
push eax
push 0x801c
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x407428
push 0x40f6c0
jmp 0x4073b9
push 0x40f6bc
push edi
call esi
lea eax, [ebp - 0x94]
push eax
call fcn.0040643b
test eax, eax
pop ecx
jne 0x40744b
push 0x40f6b8
jmp 0x4073b9
push 0x40f6b4
push edi
call esi
lea eax, [ebp - 0x94]
push 0x40f41c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x1094]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x407487
push 0x40f6b0
jmp 0x4073b9
push 0x40f6ac
push edi
call esi
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
lea eax, [ebp - 0x1094]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4074bb
push 0x40f6a8
jmp 0x4074e6
push 0x40f6a4
push edi
call esi
lea eax, [ebp - 0x14]
push 0
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4074ee
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.F10_
push edi
call esi
push 2
pop eax
jmp 0x40750f
push str.S10_
push edi
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1094]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret