Function at 0x44af50
Capabilities:
Get common file path
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4803c6
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x40a5d4]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x40a5d4]
xor eax, esp
push eax
lea eax, [esp + 0x168]
mov dword fs:[0], eax
xor ebx, ebx
or edi, 0xffffffff
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x170], ebx
call fcn.0045d4c0
lea eax, [esp + 0x14]
push eax
push 1
mov ecx, 0x486ad8
mov byte [esp + 0x178], 1
call fcn.00447ce0
push 0x4086dc
push ebx
mov ecx, 0x486ad8
call fcn.00447c30
test eax, eax
je 0x44b069
cmp dword [0x4086f4], 0x10
mov eax, dword [0x4086e0]
jae 0x44aff0
mov eax, 0x4086e0
push eax
push 0x104
push 0x486548
call fcn.0046e38e
add esp, 0xc
push 1
push 0x486548
lea ecx, [esp + 0x24]
call fcn.00446900
test al, al
je 0x44b038
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ebx
push ecx
push edx
lea ecx, [esp + 0x3c]
call fcn.0045d880
test al, al
je 0x44b038
mov eax, dword [esp + 0x44]
mov esi, dword [eax + 0x38]
jmp 0x44b03c
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push ecx
push ebx
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov ebp, eax
cmp ebp, ebx
jne 0x44b0b3
push 0x40000
push 0x40d084
push 0x40d068
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x30]
mov byte [esp + 0x170], bl
call fcn.0045d4d0
mov dword [esp + 0x170], edi
lea ecx, [esp + 0x1c]
call fcn.004468b0
xor eax, eax
mov ecx, dword [esp + 0x168]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.0046db77
add esp, 0x160
ret
mov edi, dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
push esi
push ebx
call edi
lea edx, [esp + 0x18]
push edx
push 2
mov ecx, 0x486ad8
mov dword [0x48653c], eax
call fcn.00447ce0
mov eax, dword [0x48653c]
mov ecx, dword [esp + 0x18]
push ebx
push esi
push eax
push ecx
push ebp
call dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
test eax, eax
jne 0x44b121
push 0x40010
push 0x40cd28
push 0x40d3b0
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x30]
mov byte [esp + 0x170], bl
call fcn.0045d4d0
mov dword [esp + 0x170], 0xffffffff
jmp 0x44b080
push 0x1000
push ebx
call edi
mov edx, dword [esp + 0x30]
push 0x1000
push edx
push eax
mov dword [0x4861ac], eax
call fcn.0046e5e0
mov eax, dword [0x4861ac]
mov ecx, dword [0x48653c]
push 0x1000
push eax
push ecx
call fcn.0046e5e0
add esp, 0x18
lea edx, [esp + 0x60]
push edx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push 0x40d3a4
lea eax, [esp + 0x64]
push 0x104
push eax
call fcn.0046e3f6
add esp, 0xc
push ebx
push 0x80
push 4
push ebx
push 3
push 0xc0000000
lea ecx, [esp + 0x78]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
or edi, 0xffffffff
mov dword [0x485f48], eax
cmp eax, edi
jne 0x44b1c1
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x40010
push 0x40cd28
push 0x40d210
jmp 0x44b062
mov ecx, dword [0x48653c]
push ebx
lea edx, [esp + 0x18]
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov edx, dword [0x48653c]
mov esi, dword [sym.imp.KERNEL32.DLL_GlobalFree]
push edx
call esi
mov eax, dword [0x4861ac]
push eax
call esi
mov ecx, dword [0x485f48]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea edx, [esp + 0x60]
push edx
push 0x104
push 0x486548
call fcn.0046e38e
add esp, 0xc
lea ecx, [esp + 0x30]
mov byte [esp + 0x170], bl
call fcn.0045d4d0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x170], edi
call fcn.004468b0
mov eax, 1
jmp 0x44b08b