Function at 0x408cb0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41e2e8
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x425ff0]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
push esi
push edi
mov eax, dword [0x425ff0]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
fldz
xor ebx, ebx
fst qword [esp + 0x64]
xor eax, eax
fst qword [esp + 0x54]
xor ecx, ecx
fldz
xor edi, edi
fst dword [esp + 0x3c]
xor esi, esi
mov dword [esp + 0x44], edi
mov dword [esp + 0x70], ebx
fst dword [esp + 0x50]
fxch st(1)
mov dword [esp + 0x48], esi
fstp qword [esp + 0x74]
mov word [esp + 0x20], ax
fstp dword [esp + 0x60]
mov word [esp + 0x30], cx
mov dword [esp + 0x34], ebx
dec word [0x424568]
mov dx, word [0x424568]
movsx eax, dx
mov ecx, 0x1d4b86ef
sub ecx, eax
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fmul qword [esp + 0x54]
mov dword [esp + 0xa0], 0xf
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
fstp qword [esp + 0x54]
push 0x118
mov dword [esp + 0xfc], ebx
call fcn.0040b048
push eax
mov dword [esp + 0x58], eax
call fcn.004038a0
add esp, 8
push ebx
call fcn.0040adea
fld qword [0x4258c8]
add esp, 4
fstp qword [0x425228]
cmp edx, esi
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], edx
jg 0x408dc7
jl 0x408dbb
cmp eax, edi
jae 0x408dc7
xor edi, edi
xor esi, esi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], esi
mov ecx, eax
sub ecx, edi
mov edi, edx
sbb edi, esi
mov dword [esp + 0x18], edi
js 0x409871
jg 0x408de7
cmp ecx, 0x708
jbe 0x409871
dec dword [esp + 0x30]
mov ecx, dword [0x4235e4]
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
mov esi, eax
shr esi, 9
mov dword [esp + 0x48], edx
fadd dword [esp + 0x3c]
mov cx, word [esp + 0x30]
movsx ecx, cx
mov dword [esp + 0x14], ecx
lea edx, [esi + 0x55]
push 0x408
fild dword [esp + 0x18]
push 0x423198
mov dword [esp + 0x4c], eax
mov dword [esp + 0x1c], ebx
faddp st(1)
mov dword [esp + 0x48], esi
mov dword [esp + 0x34], edx
fadd dword [0x425b64]
fstp dword [0x425b64]
fld dword [0x4235e0]
fld qword [0x4235b0]
fadd qword [esp + 0x6c]
fsubp st(1)
fstp dword [0x4235e0]
fld qword [0x4235b0]
fadd qword [0x41f350]
fstp qword [0x4235b0]
fld qword [esp + 0x7c]
fadd qword [0x41fa18]
fstp qword [esp + 0x7c]
call fcn.004020a0
push 0xd
push 0x42595c
mov dword [esp + 0x2c], eax
call fcn.004020a0
mov edi, eax
push 0xaf1
push 0x424598
mov dword [esp + 0x50], edi
call fcn.004020a0
push 0x31e
push 0x425b80
mov dword [esp + 0x48], eax
call fcn.004020a0
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x90]
add esp, 0x20
mov word [esp + 0x20], ax
cmp esi, dword [esp + 0x2c]
je 0x40944e
mov ecx, dword [0x427800]
push 0
push ecx
call fcn.00401280
add esp, 8
test eax, eax
jne 0x408efd
mov edx, dword [0x427808]
mov eax, dword [0x427344]
push edx
push eax
call fcn.004010c0
add esp, 8
mov ecx, dword [esp + 0x40]
fld qword [esp + 0x64]
mov edx, dword [esp + 0x24]
fstp qword [0x423600]
mov eax, dword [esp + 0x28]
push ecx
push edx
push eax
lea ecx, [esp + 0xb0]
push ecx
call fcn.00403540
push 0x8b
push 0x425260
call fcn.004020a0
mov ebx, eax
mov eax, dword [esp + 0x50]
add esp, 0x18
mov esi, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408f40
mov edi, ebx
sub eax, esi
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x408f50
mov dx, word [esp + 0x30]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x2710
rep movsb byte es:[edi], byte [esi]
push 0
movsx eax, dx
lea ecx, [esp + 0x90]
push ecx
lea edx, [esp + 0xb0]
sub eax, 0x20558739
push ebx
mov dword [esp + 0x44], eax
push edx
call fcn.00408500
xor eax, eax
push 0x8b
push eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x2c], eax
push ebx
call fcn.0040b130
push ebx
call fcn.0040af6b
mov eax, dword [esp + 0x34]
mov dword [esp + 0x34], eax
fild dword [esp + 0x34]
add esp, 0x24
fld qword [0x425800]
fsubr qword [0x41f388]
fsubp st(1)
call fcn.0040aec0
mov dword [esp + 0x10], eax
fld qword [0x425800]
fld1
fadd st(1), st(0)
fxch st(1)
fstp qword [0x425800]
fadd dword [0x425934]
fstp dword [0x425934]
fld dword [0x425934]
mov cx, word [0x425b5c]
dec word [0x425b5c]
movsx edx, cx
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fsubp st(1)
fcomp qword [0x41fa10]
fnstsw ax
test ah, 5
jp 0x409035
movzx eax, word [0x4235dc]
imul eax, eax, 0x3f99fd37
mov word [0x4235dc], ax
mov eax, dword [esp + 0x8c]
mov edi, 0x10
cmp dword [esp + 0xa0], edi
jae 0x409051
lea eax, [esp + 0x8c]
mov ecx, dword [esp + 0x9c]
mov edx, dword [esp + 0x1c]
push ecx
push eax
push edx
call fcn.004082c0
add esp, 0xc
cmp eax, 9
jl 0x40939b
mov ecx, dword [esp + 0x8c]
cmp dword [esp + 0xa0], edi
jae 0x409087
lea ecx, [esp + 0x8c]
mov edx, dword [ecx]
xor ecx, ecx
cmp ecx, dword [esp + 0x80]
jl 0x40939b
jg 0x4090a4
cmp edx, dword [esp + 0x7c]
jb 0x40939b
mov cx, word [0x4258b8]
movsx edx, cx
mov dword [esp + 0x10], edx
lea esi, [eax - 1]
fild dword [esp + 0x10]
fadd dword [esp + 0x3c]
fstp dword [esp + 0x3c]
cmp esi, dword [esp + 0x9c]
jbe 0x4090cf
call fcn.0040bb11
mov eax, dword [esp + 0x8c]
cmp dword [esp + 0xa0], edi
jae 0x4090e6
lea eax, [esp + 0x8c]
mov byte [eax + esi], 0
mov esi, dword [esp + 0xa0]
mov ebx, dword [esp + 0x8c]
mov eax, ebx
cmp esi, edi
jae 0x409105
lea eax, [esp + 0x8c]
lea ecx, [esp + 0xa4]
add eax, 8
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409130
test dl, dl
je 0x40912c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409130
add eax, 2
add ecx, 2
test dl, dl
jne 0x409110
xor eax, eax
jmp 0x409135
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40939b
cmp esi, edi
jb 0x409219
mov edi, ebx
test ebx, ebx
je 0x409178
mov eax, ebx
cmp esi, 0x10
jae 0x409159
lea eax, [esp + 0x8c]
cmp eax, edi
ja 0x409178
mov eax, ebx
cmp esi, 0x10
jae 0x40916b
lea eax, [esp + 0x8c]
mov ecx, dword [esp + 0x9c]
add eax, ecx
cmp edi, eax
jbe 0x409184
call fcn.0040bb11
mov ecx, dword [esp + 0x9c]
lea esi, [esp + 0x88]
mov ebx, edi
mov edx, dword [esp + 0xa0]
mov eax, dword [esp + 0x8c]
cmp edx, 0x10
jae 0x4091a7
lea eax, [esp + 0x8c]
lea edi, [eax + ecx]
test edi, edi
je 0x4091de
mov eax, dword [esp + 0x8c]
cmp edx, 0x10
jae 0x4091c1
lea eax, [esp + 0x8c]
cmp eax, edi
ja 0x4091de
mov eax, dword [esp + 0x8c]
cmp edx, 0x10
jae 0x4091d8
lea eax, [esp + 0x8c]
add eax, ecx
cmp edi, eax
jbe 0x4091e3
call fcn.0040bb11
cmp esi, 0xfffffffc
je 0x4091fc
test esi, esi
je 0x4091f7
lea eax, [esp + 0x88]
cmp esi, eax
je 0x4091fc
call fcn.0040bb11
cmp ebx, edi
je 0x409270
cmp esi, 0xfffffffc
je 0x409236
test esi, esi
jne 0x40920e
call fcn.0040bb11
cmp dword [esi + 0x18], 0x10
jb 0x409225
mov eax, dword [esi + 4]
jmp 0x409228
lea edi, [esp + 0x8c]
jmp 0x40914b
lea eax, [esi + 4]
mov ecx, dword [esi + 0x14]
add ecx, eax
cmp ebx, ecx
jb 0x409236
call fcn.0040bb11
mov byte [ebx], 0
cmp esi, 0xfffffffc
je 0x409263
test esi, esi
jne 0x409247
call fcn.0040bb11
cmp dword [esi + 0x18], 0x10
jb 0x409252
mov eax, dword [esi + 4]
jmp 0x409255
lea eax, [esi + 4]
mov edx, dword [esi + 0x14]
add edx, eax
cmp ebx, edx
jb 0x409263
call fcn.0040bb11
mov ecx, dword [esp + 0x9c]
inc ebx
jmp 0x40918d
push 0x7e
push 0x425260
call fcn.004020a0
fld qword [0x425ee8]
fadd qword [0x41f350]
xor ebx, ebx
push ebx
mov esi, eax
fstp qword [0x425ee8]
push ebx
fld qword [0x425ee8]
lea eax, [esp + 0x98]
fsub qword [0x41fa08]
push eax
lea ecx, [esp + 0xb8]
push esi
fmul qword [0x425198]
push ecx
fstp qword [0x425198]
call fcn.00408500
push 0x7e
push ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x34], ebx
push esi
call fcn.0040b130
push esi
call fcn.0040af6b
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x3c], edx
fild dword [esp + 0x3c]
fld qword [0x425800]
fsubr qword [0x41f388]
fsubp st(1)
call fcn.0040aec0
mov dword [esp + 0x3c], eax
fld qword [0x425800]
fadd qword [0x41f350]
push 0xc
push 0x4259e4
fstp qword [0x425800]
call fcn.004020a0
add esp, 0x34
mov esi, eax
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x409322
sub eax, ecx
push eax
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x94]
call fcn.00404900
mov edi, eax
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x10], ebx
push esi
mov dword [esi + 8], eax
call fcn.0040af6b
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
add esp, 4
fld qword [0x425800]
fsubr qword [0x41f388]
fsubp st(1)
call fcn.0040aec0
mov dword [esp + 0x10], eax
fld qword [0x425800]
mov ecx, dword [esp + 0x9c]
fadd qword [0x41f350]
add ecx, 0xfffffff5
fstp qword [0x425800]
cmp edi, ecx
je 0x4093b3
mov eax, dword [esp + 0x40]
inc eax
mov dword [esp + 0x40], eax
cmp eax, dword [esp + 0x2c]
jne 0x408ed3
jmp 0x409448
mov edx, dword [0x425ea0]
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fadd dword [0x425a00]
mov ax, word [esp + 0x30]
movsx ecx, ax
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fsubp st(1)
fcomp qword [0x41fa00]
fnstsw ax
test ah, 5
jp 0x40941a
mov edx, dword [esp + 0x34]
add edx, 0x3bcbf2cc
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
fadd qword [esp + 0x74]
mov ax, word [0x4252f4]
movsx ecx, ax
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
faddp st(1)
call fcn.0040aec0
mov word [0x4252f4], ax
push 0xb
push edi
lea ecx, [esp + 0x90]
call fcn.00404f80
mov dx, word [esp + 0x30]
movsx eax, dx
mov ecx, 0x3c774d94
sub ecx, eax
add ecx, dword [esp + 0x34]
mov dword [esp + 0x14], 1
mov dword [esp + 0x34], ecx
mov edi, dword [esp + 0x38]
xor ebx, ebx
mov esi, dword [esp + 0x1c]
push 0x408
push ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x34], ebx
push esi
call fcn.0040b130
push esi
call fcn.0040af6b
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x2c], edx
fild dword [esp + 0x2c]
fld qword [0x425800]
fsubr qword [0x41f388]
fsubp st(1)
call fcn.0040aec0
mov dword [esp + 0x3c], eax
fld qword [0x425800]
fadd qword [0x41f350]
xor eax, eax
push edi
fstp qword [0x425800]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], ebx
mov byte [edi + 0xc], al
call fcn.0040af6b
mov eax, dword [esp + 0x30]
mov dword [esp + 0x30], eax
fild dword [esp + 0x30]
fld qword [0x425800]
fsubr qword [0x41f388]
fsubp st(1)
call fcn.0040aec0
mov esi, dword [esp + 0x38]
mov dword [esp + 0x30], eax
fld qword [0x425800]
fadd qword [0x41f350]
push 0x31e
push ebx
push esi
fstp qword [0x425800]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x3c], ebx
call fcn.0040b130
push esi
call fcn.0040af6b
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x48], ecx
fild dword [esp + 0x48]
fld qword [0x425800]
fsubr qword [0x41f388]
fsubp st(1)
call fcn.0040aec0
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x40], eax
fld qword [0x425800]
fadd qword [0x41f350]
push 0xaf1
push ebx
push esi
fstp qword [0x425800]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x54], ebx
call fcn.0040b130
push esi
call fcn.0040af6b
mov edx, dword [esp + 0x58]
mov dword [esp + 0x5c], edx
fild dword [esp + 0x5c]
fld qword [0x425800]
fsubr qword [0x41f388]
fsubp st(1)
call fcn.0040aec0
mov dword [esp + 0x58], eax
fld qword [0x425800]
fld1
fadd st(1), st(0)
fxch st(1)
fstp qword [0x425800]
fadd qword [esp + 0x88]
fstp qword [esp + 0x88]
fld qword [esp + 0x88]
mov eax, dword [esp + 0x68]
fsub qword [0x41f9f8]
mov dword [esp + 0x5c], eax
fild dword [esp + 0x5c]
fmulp st(1)
call fcn.0040aec0
push 0x40
lea ecx, [esp + 0xdc]
push ebx
push ecx
mov dword [esp + 0x74], eax
call fcn.0040b130
add esp, 0x40
cmp dword [esp + 0x14], ebx
je 0x409871
fld qword [0x4230d0]
fsub qword [str._.H]
mov edx, dword [0x4235b8]
mov dword [esp + 0x14], edx
fild dword [esp + 0x14]
faddp st(1)
call fcn.0040aec0
mov dword [0x4235b8], eax
mov eax, dword [esp + 0x50]
push 0x708
push eax
call fcn.00402720
add esp, 8
cmp dword [esp + 0x9c], 0x200
jbe 0x409863
push 0x370
call fcn.0040b048
add esp, 4
mov ebx, eax
push ebx
push 0xeb
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push ebx
call fcn.00403bb0
push 3
push 0x425814
call fcn.004020a0
mov esi, eax
push esi
push ebx
call fcn.0040b95f
movzx ecx, word [esp + 0x38]
imul ecx, ecx, 0xa14dcf43
mov edi, eax
xor eax, eax
mov word [esp + 0x38], cx
mov dword [esp + 0x2c], eax
mov word [esi], ax
mov dword [esp + 0x2c], eax
push esi
mov byte [esi + 2], al
call fcn.0040af6b
mov edx, dword [esp + 0x30]
mov dword [esp + 0x30], edx
add esp, 0x1c
fild dword [esp + 0x14]
fld qword [0x425800]
fsubr qword [0x41f388]
fsubp st(1)
call fcn.0040aec0
mov dword [esp + 0x14], eax
fld qword [0x425800]
cmp dword [esp + 0xa0], 0x10
fadd qword [0x41f350]
mov eax, dword [esp + 0x8c]
fstp qword [0x425800]
jae 0x4096e4
lea eax, [esp + 0x8c]
mov ecx, dword [esp + 0x9c]
push edi
push 1
push ecx
push eax
call fcn.0040b819
push edi
call fcn.0040b63b
add esp, 0x14
push 0x104
lea eax, [ebx + 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x15
push 0x425b04
call fcn.004020a0
push 0x20
push 0x4259c0
mov edi, eax
call fcn.004020a0
mov edx, dword [0x427800]
push edx
mov esi, eax
push esi
lea eax, [ebx + 0x104]
push eax
push edi
lea eax, [ebx + 0x208]
push 0x168
push eax
call fcn.0040b515
mov ax, word [0x4250d8]
movzx ecx, word [esp + 0x48]
cwde
sub ecx, eax
xor eax, eax
sub ecx, 0x1bda9f0d
mov word [esp + 0x48], cx
inc word [0x4250d8]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esp + 0x3c], eax
mov dword [esi + 0x18], eax
mov dword [esp + 0x3c], eax
push esi
mov dword [esi + 0x1c], eax
call fcn.0040af6b
mov edx, dword [esp + 0x40]
mov dword [esp + 0x40], edx
fild dword [esp + 0x40]
fld qword [0x425800]
fsubr qword [0x41f388]
fsubp st(1)
call fcn.0040aec0
mov dword [esp + 0x40], eax
fld qword [0x425800]
fadd qword [0x41f350]
xor eax, eax
xor esi, esi
push edi
fstp qword [0x425800]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [esp + 0x44], esi
mov dword [esp + 0x44], esi
mov byte [edi + 0x14], al
call fcn.0040af6b
mov eax, dword [esp + 0x44]
mov dword [esp + 0x44], eax
fild dword [esp + 0x44]
fld qword [0x425800]
fsubr qword [0x41f388]
fsubp st(1)
call fcn.0040aec0
mov dword [esp + 0x44], eax
fld qword [0x425800]
fadd qword [0x41f350]
mov ecx, dword [0x427800]
push 1
push ecx
fstp qword [0x425800]
call fcn.00401280
lea eax, [ebx + 0x208]
push eax
push ebx
call fcn.004010c0
add esp, 0x40
push 0x370
push esi
push ebx
call fcn.0040b130
push ebx
call fcn.0040af6b
add esp, 0x10
push 0x15f90
call dword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
fld qword [esp + 0x64]
fmul qword [0x41f9f0]
fstp qword [esp + 0x64]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x427800]
push ebx
push edx
call fcn.00401280
add esp, 8
test eax, eax
jne 0x4098a5
mov eax, dword [0x427808]
mov ecx, dword [0x427344]
push eax
push ecx
call fcn.004010c0
add esp, 8
fld dword [esp + 0x60]
mov esi, dword [esp + 0x48]
fmul qword [0x41f9e8]
mov edi, dword [esp + 0x44]
fstp dword [esp + 0x60]
jmp 0x408d91