Function at 0x416790
Capabilities:
Get common file path
Set current directory
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x459de1
mov eax, dword fs:[0]
push eax
sub esp, 0xc5c
mov eax, dword [0x46e3d0]
xor eax, esp
mov dword [esp + 0xc58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46e3d0]
xor eax, esp
push eax
lea eax, [esp + 0xc70]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [0x471e7c], ebx
jne 0x4169f4
push 0x7fe
lea eax, [esp + 0x472]
push ebx
push eax
mov word [esp + 0x478], bx
call fcn.00443e10
add esp, 0xc
lea ecx, [esp + 0x46c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea edx, [esp + 0x46c]
push edx
push 0x46227c
push 0x400
lea eax, [esp + 0x78]
push 0x200
push eax
call fcn.0043ef21
add esp, 0x14
lea ecx, [esp + 0x34]
call fcn.0042a750
mov dword [esp + 0xc78], ebx
mov edi, 7
lea eax, [esp + 0x6c]
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x416857
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x70]
push ecx
lea esi, [esp + 0x20]
call fcn.00406f20
mov edx, esi
push ebx
push edx
or eax, 0xffffffff
lea esi, [esp + 0x3c]
mov byte [esp + 0xc80], 1
call fcn.00406d90
mov ebp, 8
cmp dword [esp + 0x30], ebp
jb 0x4168a5
mov eax, dword [esp + 0x1c]
push eax
call fcn.0043ef40
add esp, 4
cmp dword [esp + 0x4c], ebp
mov edx, dword [esp + 0x38]
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
jae 0x4168c0
lea edx, [esp + 0x38]
mov edi, dword [0x471b30]
cmp edi, ebx
je 0x4168fb
mov eax, edx
lea esi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4168d0
sub eax, esi
sar eax, 1
push edi
lea ecx, [eax + eax]
push ecx
push 1
push edx
call fcn.0043fe21
mov edx, dword [0x471b30]
push edx
call fcn.004402ef
add esp, 0x14
mov dword [esp + 0xc78], 0xffffffff
cmp dword [esp + 0x4c], ebp
jb 0x416919
mov eax, dword [esp + 0x38]
push eax
call fcn.0043ef40
add esp, 4
push 0x471f84
lea eax, [esp + 0x54]
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
call fcn.0041bba0
add esp, 4
mov dword [esp + 0xc78], 2
cmp dword [esp + 0x68], ebp
mov eax, dword [esp + 0x54]
jae 0x416954
lea eax, [esp + 0x54]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push eax
call edi
cmp dword [0x471f9c], ebp
mov eax, dword [0x471f88]
jae 0x41696f
mov eax, 0x471f88
push eax
push 0x104
push 0x4724cc
call fcn.00441a94
mov eax, dword [0x4724c8]
add esp, 0xc
cmp eax, ebx
jne 0x4169ae
push 0x44
call fcn.0043f2d6
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4169a7
mov eax, 0x4724cc
call fcn.0043e840
jmp 0x4169a9
xor eax, eax
mov dword [0x4724c8], eax
lea ecx, [esp + 0x46c]
push ecx
mov dword [0x471e7c], eax
call edi
mov dword [esp + 0xc78], 0xffffffff
cmp dword [esp + 0x68], ebp
jb 0x4169db
mov edx, dword [esp + 0x54]
push edx
call fcn.0043ef40
add esp, 4
cmp dword [0x471e7c], ebx
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], ebx
mov word [esp + 0x54], bx
je 0x416a19
cmp dword [0x471f60], ebx
jne 0x416a06
call fcn.00425cb0
mov dword [0x471f60], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x471e7c]
mov eax, dword [ecx]
mov edx, dword [eax]
push ebx
call edx
mov eax, 1
mov ecx, dword [esp + 0xc70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc58]
xor ecx, esp
call fcn.0043ef12
add esp, 0xc68
ret