Function at 0x413506
Capabilities:
Get common file path
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x200
push 0x5c2c60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x533fb4
push 0x5c2c60
call fcn.004202e0
add esp, 8
push 0x533fb8
push 0x5c2c60
call fcn.004202e0
add esp, 8
push 0x533fc0
push 0x5c2c60
call fcn.004202e0
add esp, 8
push 0x5c2c60
call fcn.00408b00
add esp, 4
test eax, eax
jne 0x4135a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 5
je 0x4135a9
cmp dword [ebp - 0x34c], 2
je 0x4135a9
push 0x40001
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4138c2
push 0x533fc8
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x533fcc
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x533fd4
push 0x5c2a40
call fcn.004202e0
add esp, 8
cmp dword [ebp + 8], 0
je 0x41369f
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.004202d0
add esp, 8
push 0x533fdc
lea edx, [ebp - 0x204]
push edx
call fcn.004202e0
add esp, 8
push 0x533fe0
lea eax, [ebp - 0x204]
push eax
call fcn.004202e0
add esp, 8
push 0x533fe8
lea ecx, [ebp - 0x204]
push ecx
call fcn.004202e0
add esp, 8
lea edx, [ebp - 0x348]
push edx
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x41369f
push 0
push 0x5c2a40
lea ecx, [ebp - 0x204]
push ecx
call fcn.00408b26
add esp, 0xc
test eax, eax
jne 0x41368e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4138c2
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4138c2
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5c2a20], eax
cmp dword [0x5c2a20], 0xffffffff
jne 0x4137b5
push 0x200
push 0x5c2c60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x533ff0
push 0x5c2c60
call fcn.004202e0
add esp, 8
push 0x533ff4
push 0x5c2c60
call fcn.004202e0
add esp, 8
push 0x533ffc
push 0x5c2c60
call fcn.004202e0
add esp, 8
push 0x5c2c60
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x413766
cmp dword [ebp - 0x34c], 5
je 0x413766
cmp dword [ebp - 0x34c], 2
je 0x413766
cmp dword [ebp - 0x34c], 0xb7
je 0x413766
push 0x40002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4138c2
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5c2a20], eax
cmp dword [0x5c2a20], 0xffffffff
jne 0x4137a6
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4138c2
mov ecx, dword [0x5c2a20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4137c2
mov edx, dword [0x5c2a20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x534004
push 0x5c2a40
call fcn.004202e0
add esp, 8
push str.haspvdd
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x534010
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5c2a24], eax
cmp dword [0x5c2a24], 0xffffffff
jne 0x413845
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4138c2
push 0
lea eax, [ebp - 0x208]
push eax
push 0x1a00
push 0x531254
mov ecx, dword [0x5c2a24]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x413893
mov edx, dword [0x5c2a24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4138c2
mov eax, dword [0x5c2a24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x4138c0
push 0x40005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4138c2
xor eax, eax
mov esp, ebp
pop ebp
ret