Function at 0x43e5c0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x45fd6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x138
push ebp
push esi
or esi, 0xffffffff
push edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
push 1
mov dword [esp + 0x150], 0
call fcn.0043bbf0
add esp, 4
mov dword [esp + 0xc], eax
call fcn.0043c7b0
push 1
push 0x463268
lea ecx, [esp + 0x18]
call fcn.00439d00
test al, al
je 0x43e647
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x2c]
call fcn.00448e50
test al, al
je 0x43e647
mov edx, dword [esp + 0x38]
mov ebp, dword [edx + 0x38]
jmp 0x43e64b
mov ebp, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
push eax
push 0
push 0x410
call dword [sym.imp.kernel32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x43e69f
push eax
push 0x406494
push 0x406478
push eax
call dword [sym.imp.user32.dll_MessageBoxA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x14c], esi
call fcn.00439cb0
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
add esp, 0x144
ret
mov esi, dword [sym.imp.kernel32.dll_GlobalAlloc]
push ebp
push 0
call esi
push 2
mov dword [0x463260], eax
call fcn.0043bbf0
mov ecx, dword [0x463260]
add esp, 4
push 0
push ebp
push ecx
push eax
push edi
call dword [sym.imp.kernel32.dll_ReadProcessMemory]
test eax, eax
jne 0x43e70f
push eax
push 0x405f60
push 0x406744
push eax
call dword [sym.imp.user32.dll_MessageBoxA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x14c], 0xffffffff
call fcn.00439cb0
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
add esp, 0x144
ret
push 0x1000
push 0
call esi
mov esi, dword [esp + 0x24]
mov dword [0x463080], eax
mov edi, eax
lea edx, [esp + 0x40]
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
mov esi, dword [0x463080]
mov edi, dword [0x463260]
push edx
mov ecx, 0x400
push 0x104
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.kernel32.dll_GetTempPathA]
lea edi, [esp + 0x40]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x43e752
mov eax, dword [0x406738]
mov ecx, dword [0x40673c]
mov dl, byte [0x406740]
push 0
push 0x80
push 4
push 0
mov dword [edi], eax
push 3
push 0xc0000000
lea eax, [esp + 0x58]
mov dword [edi + 4], ecx
push eax
mov byte [edi + 8], dl
call dword [sym.imp.kernel32.dll_CreateFileA]
or edi, 0xffffffff
cmp eax, edi
mov dword [0x462e50], eax
jne 0x43e7e1
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0x10
push 0x405f60
push 0x4061c0
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x14c], edi
call fcn.00439cb0
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
add esp, 0x144
ret
mov edx, dword [0x463260]
push 0
lea ecx, [esp + 0x10]
push ecx
push ebp
push edx
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov eax, dword [0x463260]
mov esi, dword [sym.imp.kernel32.dll_GlobalFree]
push eax
call esi
mov ecx, dword [0x463080]
push ecx
call esi
mov edx, dword [0x462e50]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x40]
mov byte [eax + 0x463268], cl
inc eax
test cl, cl
jne 0x43e820
lea ecx, [esp + 0x10]
mov dword [esp + 0x14c], edi
call fcn.00439cb0
mov ecx, dword [esp + 0x144]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x144
ret