Function at 0x402360
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa98
mov eax, dword [0x41c004]
xor eax, esp
mov dword [esp + 0xa94], eax
push esi
push edi
mov ecx, pe_nt_image_headers32
lea edi, [esp + 0x230]
mov esi, str.MIIDRDCCAiygAwIBAgIFV1Wl6xEwDQYJKoZIhvcNAQELBQAwMDELMAkGA1UEBhMCY24xEDAOBgNVBAoMB2luZm9zZWMxDzANBgNVBAMMBnJvb3RjYTAgFw0yMDA4MTIwMzE5NDJaGA8yMTIwMDgxMjAzMTk0MlowMDELMAkGA1UEBhMCY24xEDAOBgNVBAoMB2luZm9zZWMxDzANBgNVBAMMBnJvb3RjYTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANlxXUdV2Eu7RSQcXvZk8eZnyfOYjklPMXBrpCmUSAxoIvMBP9SZZZoKLbjHuOr6efN7WkU3jkR460kWmDSM8T3uNO2fbhbPBYJ5V1WnJUCvrpn5J417PnQaJITzRL859kmLu9QGr9BMRBIS7AsHyKqKQCfQpe9hvTq6t6UdeacbpmOp24hlEFRZjq83Sue5ImV5CiIC_uOSv_K4oWtz8T0WF4dOeLZoat8jRwl0EUEhawKYJNqf18l3a1WHE72s3_sogWG9n0PdYTUSf_Z2HrE9IfT2LTefM9THdD3FQxsEqxmLfZ1pSLx6qWy0ZmdWTBD5FxhpETdKujMCAwEAAaNjMGEwHwYDVR0jBBgwFoAUAlDh6KiLwK18fYKfyeYRQUDUlk8wDwYDVR0TAQH_BAUwAwEB_zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFAJQ4eioi8CtfH2Cn8nmEUFA1JZPMA0GCSqGSIb3DQEBCwUAA4IBAQA9TV8KBVX0QRYAVtr2NGeadpPcOripWLsxVBWHXgBP6xFMDR1870fRGVPVb0UaWFVeGltognSGgQCulaPnRizFP7GwEmtN7qxICptG8bl9ugQEvQMgIE1iNgC5eaLJalv8gU9RDaN4Xr1GBfBbKpMoGlTzHGI9E_kIvNL3BHdiPahRjgXskoO8yYYFNuxZywm0UMHMIaOxLteHeBB0qJ4vM0vvDbxRvOeYwdDwmr0r7Tq3X92g6CBj2e8G_LGX8osHD2PFY5vfTX2OZvsSpB06TI2h3MahOCMafQTB70XGfArtVu6BosgVFokyKe0eKVW3oBPRyKNhuoDDpE428M
lea eax, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push 0x104
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.00403a60
add esp, 0xc
lea eax, [esp + 0x128]
push 0x104
push 0
push eax
call fcn.00403a60
add esp, 0xc
mov dword [0x41d334], 0
mov dword [0x41d330], 0x2800
push 0x100
push 0
push 0x41d230
call fcn.00403a60
add esp, 0xc
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0x801c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x40242d
push str.InfosecCNGCertInstallNew
lea eax, [esp + 0x24]
push eax
push str._s_s
lea eax, [esp + 0x134]
push 0x104
push eax
call fcn.00401050
add esp, 0x14
lea ecx, [esp + 0x128]
call fcn.004011a0
xor edx, edx
push 0x419801
push str.InstallIECACerts_start
lea ecx, [edx + 1]
call fcn.00401070
lea edx, [esp + 0x238]
add esp, 8
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x402450
sub edx, ecx
push ecx
lea ecx, [esp + 0x234]
call fcn.004013d0
add esp, 4
xor edx, edx
push 0x419801
push str.InstallIECACerts_end
lea ecx, [edx + 1]
call fcn.00401070
lea edx, [esp + 0x238]
add esp, 8
lea esi, [edx + 1]
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x402490
sub edx, esi
lea ecx, [esp + 0x230]
call fcn.00401980
xor edx, edx
push 0x419801
push str.InstallFFCertImpl_end
lea ecx, [edx + 1]
call fcn.00401070
mov esi, dword [0x41d334]
lea eax, [esp + 0x6a0]
push 0x400
push 0
push eax
call fcn.00403a60
add esp, 0x14
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x1a]
push 0x4196d4
push 0x419744
push str.dbglog_close
push esi
push 0x4196d0
push eax
movzx eax, word [esp + 0x30]
push eax
movzx eax, word [esp + 0x32]
push eax
movzx eax, word [esp + 0x34]
push eax
movzx eax, word [esp + 0x36]
push eax
movzx eax, word [esp + 0x36]
push eax
movzx eax, word [esp + 0x38]
push eax
push str._4.4d__2.2d__2.2d__2.2d:_2.2d:_2.2d._3.3d__s__5d__s__s_s
lea eax, [esp + 0x6cc]
push 0x400
push eax
call fcn.00401050
lea ecx, [esp + 0x6d4]
add esp, 0x3c
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402544
push 0
lea eax, [esp + 0x20]
sub ecx, edx
push eax
push ecx
lea eax, [esp + 0x6a4]
push eax
push dword [0x41d334]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x41d334]
test eax, eax
je 0x402583
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x41d334], 0
mov ecx, dword [esp + 0xa9c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.004025ad
mov esp, ebp
pop ebp
ret