Function at 0x412ec1
Capabilities:
Get common file path
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push 0x200
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x200
push 0x5abf80
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5229a0
push 0x5abf80
call fcn.0041e940
add esp, 8
push 0x5229a4
push 0x5abf80
call fcn.0041e940
add esp, 8
push 0x5229ac
push 0x5abf80
call fcn.0041e940
add esp, 8
push 0x5abf80
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x412f64
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 5
je 0x412f64
cmp dword [ebp - 0x34c], 2
je 0x412f64
push 0x40001
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41328a
push 0x5229b4
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x5229b8
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x5229c0
push 0x5abd60
call fcn.0041e940
add esp, 8
cmp dword [ebp + 8], 0
je 0x41305a
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.0041e930
add esp, 8
push 0x5229c8
lea edx, [ebp - 0x204]
push edx
call fcn.0041e940
add esp, 8
push 0x5229cc
lea eax, [ebp - 0x204]
push eax
call fcn.0041e940
add esp, 8
push 0x5229d4
lea ecx, [ebp - 0x204]
push ecx
call fcn.0041e940
add esp, 8
lea edx, [ebp - 0x348]
push edx
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x41305a
push 0
push 0x5abd60
lea ecx, [ebp - 0x204]
push ecx
call fcn.00408ae7
add esp, 0xc
test eax, eax
jne 0x413049
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41328a
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x41328a
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5abd40], eax
cmp dword [0x5abd40], 0xffffffff
jne 0x41317c
push 0x200
push 0x5abf80
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5229dc
push 0x5abf80
call fcn.0041e940
add esp, 8
push 0x5229e0
push 0x5abf80
call fcn.0041e940
add esp, 8
push str..dl_
push 0x5abf80
call fcn.0041e940
add esp, 8
push 0x5abf80
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x41312d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 5
je 0x41312d
cmp dword [ebp - 0x34c], 2
je 0x41312d
cmp dword [ebp - 0x34c], 0xb7
je 0x41312d
push 0x40002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41328a
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5abd40], eax
cmp dword [0x5abd40], 0xffffffff
jne 0x41316d
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41328a
mov ecx, dword [0x5abd40]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x413189
mov edx, dword [0x5abd40]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x200
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5229f0
push 0x5abd60
call fcn.0041e940
add esp, 8
push str.hlvdd
push 0x5abd60
call fcn.0041e940
add esp, 8
push str..dll
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5abd44], eax
cmp dword [0x5abd44], 0xffffffff
jne 0x41320c
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41328a
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.004089da
push eax
push 0x435b90
mov ecx, dword [0x5abd44]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x41325b
mov edx, dword [0x5abd44]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41328a
mov eax, dword [0x5abd44]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x413288
push 0x40005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41328a
xor eax, eax
mov esp, ebp
pop ebp
ret