Function at 0x96a780
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x210]
sub esp, 0x210
push 0xfffffffffffffffe
push 0xb104d8
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x20c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 0x218]
xor ebx, ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], ebx
mov byte [ebp + 0x108], bl
push 0x103
push ebx
lea eax, [ebp + 0x109]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [0xbfcad0]
cmp eax, ebx
jne 0x96a826
cmp dword [ebp + 0x21c], ebx
jne 0x96a841
push ebx
mov ecx, str.GlobalGenLogMutex
call fcn.00962f00
mov dword [0xbfcad0], eax
cmp dword [ebp + 0x21c], ebx
jne 0x96a841
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
jmp 0x96ac25
cmp eax, ebx
je 0x96a866
mov ecx, 0x5a
mov eax, 0xbfcad0
call fcn.0096ffd0
mov dword [ebp - 0x28], eax
cmp eax, 1
je 0x96a866
push 0xbfcad0
call fcn.00985290
mov ebx, 1
lea esi, [ebp + 0x108]
call fcn.00985ed0
cmp dword [0xb32da4], 0xffffffff
jne 0x96a8a0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xb32da4
xor ebx, ebx
xor edx, edx
xor ecx, ecx
call fcn.009691d0
add esp, 0x20
test edi, edi
je 0x96a8d4
push 0x80000000
push 4
push 3
push 4
call fcn.0094db00
add esp, 0x10
mov esi, eax
mov dword [ebp - 0x1c], esi
call fcn.00964530
test eax, eax
je 0x96abd3
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x96aa3c
cmp byte [str.C:WINDOWSgeneral.log], 0
je 0x96a912
push 0x80000000
push 4
push 3
push 4
mov edi, str.C:WINDOWSgeneral.log
call fcn.0094db00
add esp, 0x10
mov esi, eax
mov dword [ebp - 0x1c], esi
call fcn.00964530
test eax, eax
je 0x96abd3
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x96aa3c
mov edi, 0x105
mov ecx, str.C:WINDOWSgeneral.log
call fcn.00958630
mov ecx, str.C:WINDOWSgeneral.log
call fcn.00960910
push str.general.log
push str.C:WINDOWSgeneral.log
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
call ebx
push 0x80000000
push 4
push 3
push 4
mov edi, str.C:WINDOWSgeneral.log
call fcn.0094db00
add esp, 0x10
mov esi, eax
mov dword [ebp - 0x1c], esi
call fcn.00964530
test eax, eax
jne 0x96aa3c
mov byte [str.C:WINDOWSgeneral.log], al
mov edi, 0x105
mov ecx, str.C:WINDOWSgeneral.log
call fcn.00958630
mov ecx, str.C:WINDOWSgeneral.log
call fcn.00960910
push str.TEMPgeneral.log
push str.C:WINDOWSgeneral.log
call ebx
push 0x80000000
push 4
push 3
push 4
mov edi, str.C:WINDOWSgeneral.log
call fcn.0094db00
add esp, 0x10
mov esi, eax
mov dword [ebp - 0x1c], esi
call fcn.00964530
test eax, eax
jne 0x96aa3c
mov byte [str.C:WINDOWSgeneral.log], al
push edi
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, edi
call fcn.00960910
push str.general.log
push edi
call ebx
push 0x80000000
push 4
push 3
push 4
call fcn.0094db00
add esp, 0x10
mov esi, eax
mov dword [ebp - 0x1c], esi
call fcn.00964530
test eax, eax
jne 0x96aa3c
mov byte [str.C:WINDOWSgeneral.log], al
mov ecx, edi
call fcn.00980970
mov ecx, edi
call fcn.00960910
push str.general.log
push edi
call ebx
push 0x80000000
push 4
push 3
push 4
call fcn.0094db00
add esp, 0x10
mov esi, eax
mov dword [ebp - 0x1c], esi
call fcn.00964530
test eax, eax
je 0x96abd3
cmp byte [str.avpmapp.exe], 0
jne 0x96aa7d
mov byte [ebp], 0
push 0x104
push 0
lea ecx, [ebp + 1]
push ecx
call fcn.00a7ffb0
add esp, 0xc
push 0x105
lea edx, [ebp]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.avpmapp.exe
lea ecx, [ebp]
call fcn.0095af90
add esp, 4
push 0x5000
call fcn.00a7a155
mov dword [ebp - 0x20], eax
push 0x5000
call fcn.00a7a155
add esp, 8
mov edi, eax
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x96abd6
test edi, edi
je 0x96abd6
mov byte [edi], 0
mov byte [eax], 0
cmp dword [0xb32da4], 0
je 0x96aae8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp + 0x108]
push eax
push str.avpmapp.exe
push str.__s___s__04x__04x__
push edi
call fcn.00a78f30
add esp, 0x18
jmp 0x96ab0e
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor eax, 0xff000000
push eax
lea ecx, [ebp + 0x108]
push ecx
push str.avpmapp.exe
push str.__s___s__0x_08x___
push edi
call fcn.00a78f30
add esp, 0x14
lea edx, [ebp + 0x220]
push edx
mov eax, dword [ebp + 0x21c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00a7b631
add esp, 0xc
mov eax, dword [ebp - 0x20]
push eax
push edi
cmp byte [eax], 0xa
je 0x96ab36
call ebx
jmp 0x96ab3c
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x34], 0
mov ecx, edi
call fcn.0094c3d0
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, 1
jne 0x96ab66
cmp byte [edi], 0xa
jne 0x96ab63
mov byte [edi], 0
xor ebx, ebx
mov dword [ebp - 0x24], ebx
jmp 0x96ab8a
cmp ebx, 1
jbe 0x96ab7f
cmp byte [ebx + edi - 1], 0xa
jne 0x96ab7f
cmp byte [ebx + edi - 2], 0xd
je 0x96ab7f
mov byte [ebx + edi - 1], 0
dec ebx
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x96ab8a
cmp byte [ebx + edi - 1], 0xa
je 0x96ab9c
push 0xaaa5d0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
add ebx, 2
mov dword [ebp - 0x24], ebx
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x96abb9
lea edx, [ebp - 0x1c]
push edx
call fcn.00985290
jmp 0x96abd6
push 0
lea eax, [ebp - 0x34]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00985290
jmp 0x96abd6
mov edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x96abe6
push eax
call fcn.00a78fec
add esp, 4
test edi, edi
je 0x96abfe
push edi
call fcn.00a78fec
add esp, 4
jmp 0x96abfe
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0xbfcad0]
test eax, eax
je 0x96ac1b
cmp dword [ebp - 0x28], 1
jne 0x96ac1b
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.00a78f21
add ebp, 0x210
mov esp, ebp
pop ebp
ret