Function at 0x4cacda
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x28c
lea eax, [esp + 0x88]
push ebx
push ebp
mov ebp, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, ecx
push esi
push edi
push eax
xor eax, eax
push eax
push eax
push 0x23
push eax
call ebp
lea edi, [esp + 0x98]
sub edi, 2
xor edx, edx
mov ax, word [edi + 2]
add edi, 2
cmp ax, dx
jne 0x4cad09
push 9
pop ecx
push edx
push 0x80
push 2
mov esi, str.Aeroadminconfig
lea eax, [esp + 0xa4]
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
push edx
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4cb576
xor eax, eax
lea ecx, [esp + 0x20]
push eax
mov byte [esp + 0x1c], al
call fcn.004cdb5b
push esi
lea eax, [ebx + 0x2f8]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0043db94
mov al, byte [esp + 0x14]
sub esp, 0x10
mov ecx, esp
push str.useProxy
mov byte [ecx], 4
mov byte [ecx + 8], al
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x300]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0043dc70
sub esp, 0x10
lea eax, [esp + 0x48]
mov ecx, esp
push eax
call fcn.004cc08f
push str.proxy_ip
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
lea ecx, [esp + 0x38]
call fcn.0043c446
push esi
lea eax, [ebx + 0x308]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0043dc70
sub esp, 0x10
lea eax, [esp + 0x48]
mov ecx, esp
push eax
call fcn.004cc08f
push str.proxy_user
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
lea ecx, [esp + 0x38]
call fcn.0043c446
push esi
lea eax, [ebx + 0x310]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0043dc70
sub esp, 0x10
lea eax, [esp + 0x48]
mov ecx, esp
push eax
call fcn.004cc08f
push str.proxy_pass
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
lea ecx, [esp + 0x38]
call fcn.0043c446
push esi
lea eax, [ebx + 0x318]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00445160
mov eax, dword [esp + 0x14]
sub esp, 0x10
mov ecx, esp
cdq
push str.proxy_port
mov byte [ecx], 5
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x320]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0043dc70
sub esp, 0x10
lea eax, [esp + 0x48]
mov ecx, esp
push eax
call fcn.004cc08f
push str.sa_ip
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
lea ecx, [esp + 0x38]
call fcn.0043c446
push esi
lea eax, [ebx + 0x328]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00445160
mov eax, dword [esp + 0x14]
sub esp, 0x10
mov ecx, esp
cdq
push str.sa_port
mov byte [ecx], 5
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x330]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00445160
mov eax, dword [esp + 0x14]
sub esp, 0x10
mov ecx, esp
cdq
push str.out_port
mov byte [ecx], 5
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x338]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00445160
mov eax, dword [esp + 0x14]
sub esp, 0x10
mov ecx, esp
cdq
push str.base_port
mov byte [ecx], 5
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x340]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0043db94
mov al, byte [esp + 0x14]
sub esp, 0x10
mov ecx, esp
push str.min_cpu
mov byte [ecx], 4
mov byte [ecx + 8], al
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x348]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0043db94
mov al, byte [esp + 0x14]
sub esp, 0x10
mov ecx, esp
push str.hide_back
mov byte [ecx], 4
mov byte [ecx + 8], al
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x350]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0043db94
mov al, byte [esp + 0x14]
sub esp, 0x10
mov ecx, esp
push str.cursor_noblink
mov byte [ecx], 4
mov byte [ecx + 8], al
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x358]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0049b14b
fld dword [esp + 0x14]
sub esp, 0x10
mov ecx, esp
push ecx
fstp dword [esp]
call fcn.004d0068
push str.frame_rate
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x360]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0043db94
mov al, byte [esp + 0x14]
sub esp, 0x10
mov ecx, esp
push str.videoCompressionAuto
mov byte [ecx], 4
mov byte [ecx + 8], al
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x368]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0049b14b
fld dword [esp + 0x14]
sub esp, 0x10
mov ecx, esp
push ecx
fstp dword [esp]
call fcn.004d0068
push str.video_quality
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x370]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00445160
mov eax, dword [esp + 0x14]
sub esp, 0x10
mov ecx, esp
cdq
push str.inputDevice
mov byte [ecx], 5
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x378]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00445160
mov eax, dword [esp + 0x14]
sub esp, 0x10
mov ecx, esp
cdq
push str.outputDevice
mov byte [ecx], 5
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x380]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0049b14b
fld dword [esp + 0x14]
sub esp, 0x10
mov ecx, esp
push ecx
fstp dword [esp]
call fcn.004d0068
push str.inputLevel
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x388]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0049b14b
sub esp, 0x10
mov ecx, esp
fld dword [esp + 0x24]
push ecx
fstp dword [esp]
call fcn.004d0068
push str.outputLevel
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x398]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0043db94
mov al, byte [esp + 0x14]
sub esp, 0x10
mov ecx, esp
push str.minimize
mov byte [ecx], 4
mov byte [ecx + 8], al
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x3a8]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0043db94
mov al, byte [esp + 0x14]
sub esp, 0x10
mov ecx, esp
push str.sess_notif_minimize
mov byte [ecx], 4
mov byte [ecx + 8], al
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x3a0]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0043db94
mov al, byte [esp + 0x14]
sub esp, 0x10
mov ecx, esp
push str.as_admin
mov byte [ecx], 4
mov byte [ecx + 8], al
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x3b8]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0043dc70
sub esp, 0x10
lea eax, [esp + 0x48]
mov ecx, esp
push eax
call fcn.004cc08f
push str.language
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
lea ecx, [esp + 0x38]
call fcn.0043c446
push esi
lea eax, [ebx + 0x3c0]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0043db94
mov al, byte [esp + 0x14]
sub esp, 0x10
mov ecx, esp
push str.sims
mov byte [ecx], 4
mov byte [ecx + 8], al
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
push esi
lea eax, [ebx + 0x3c8]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00449191
sub esp, 0x10
lea edx, [esp + 0x48]
lea ecx, [esp + 0x60]
mov esi, esp
call fcn.004a484d
push eax
mov ecx, esi
call fcn.004cc08f
push str.sims_admin_email
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
lea ecx, [esp + 0x50]
call fcn.0043c446
lea ecx, [esp + 0x38]
call fcn.0043c274
push 2
lea eax, [ebx + 0x3d0]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00449191
sub esp, 0x10
lea edx, [esp + 0x48]
lea ecx, [esp + 0x60]
mov esi, esp
call fcn.004a484d
push eax
mov ecx, esi
call fcn.004cc08f
push str.sims_client_email
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
lea ecx, [esp + 0x50]
call fcn.0043c446
lea ecx, [esp + 0x38]
call fcn.0043c274
push 2
lea eax, [ebx + 0x3d8]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00449191
sub esp, 0x10
lea edx, [esp + 0x48]
lea ecx, [esp + 0x60]
mov esi, esp
call fcn.004a484d
push eax
mov ecx, esi
call fcn.004cc08f
push str.sims_text
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
lea ecx, [esp + 0x50]
call fcn.0043c446
lea ecx, [esp + 0x38]
call fcn.0043c274
push 2
lea eax, [ebx + 0x3e0]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00449191
sub esp, 0x10
lea edx, [esp + 0x48]
lea ecx, [esp + 0x60]
mov esi, esp
call fcn.004a484d
push eax
mov ecx, esi
call fcn.004cc08f
push str.contacts_folder
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
lea ecx, [esp + 0x50]
call fcn.0043c446
lea ecx, [esp + 0x38]
call fcn.0043c274
push 2
lea eax, [ebx + 0x3e8]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00449191
sub esp, 0x10
lea edx, [esp + 0x48]
lea ecx, [esp + 0x60]
mov esi, esp
call fcn.004a484d
push eax
mov ecx, esi
call fcn.004cc08f
push str.sims_lic_key
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
lea ecx, [esp + 0x50]
call fcn.0043c446
lea ecx, [esp + 0x38]
call fcn.0043c274
push 2
lea eax, [ebx + 0x390]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00449191
sub esp, 0x10
lea edx, [esp + 0x48]
lea ecx, [esp + 0x60]
mov esi, esp
call fcn.004a484d
push eax
mov ecx, esi
call fcn.004cc08f
push str.fm_path
lea ecx, [esp + 0x2c]
call fcn.004cffd8
mov ecx, eax
call fcn.004cbf75
lea ecx, [esp + 0x50]
call fcn.0043c446
lea ecx, [esp + 0x38]
call fcn.0043c274
push ecx
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x20]
call fcn.004cbe2c
push 0x558ffc
lea ecx, [esp + 0x54]
call fcn.0043a56f
push 0x558d90
lea ecx, [esp + 0x84]
call fcn.0043a56f
lea eax, [esp + 0x50]
push eax
lea esi, [esp + 0x84]
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
lea eax, [esp + 0x84]
push eax
call fcn.0043c644
mov edx, esi
lea ecx, [esp + 0x50]
call fcn.004c837b
add esp, 0x1c
lea ecx, [esp + 0x68]
push eax
call fcn.00443391
lea ecx, [esp + 0x34]
call fcn.0043c446
mov ecx, esi
call fcn.0043c446
lea ecx, [esp + 0x50]
call fcn.0043c446
cmp dword [esp + 0x7c], 0x10
lea eax, [esp + 0x68]
lea ecx, [esp + 0x2c]
cmovae eax, dword [esp + 0x68]
xor esi, esi
push esi
push ecx
push dword [esp + 0x80]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x68]
call fcn.0043c446
lea ecx, [esp + 0x18]
call fcn.004cbeff
jmp 0x4cb578
xor esi, esi
cmp byte [ebx + 0x2f0], 0
je 0x4cb84d
cmp byte [0x5fea1a], 0
lea eax, [esp + 0x98]
je 0x4cb5e3
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x98]
push 0x5c
push eax
call fcn.00504a54
pop ecx
pop ecx
xor ecx, ecx
lea edi, [esp + 0x98]
mov word [eax + 2], cx
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x4cb5ca
mov esi, str.guid.bin
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4cb60f
push eax
xor eax, eax
push eax
push eax
push 0x23
push eax
call ebp
lea edi, [esp + 0x98]
sub edi, 2
xor ecx, ecx
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x4cb5f9
push 0xa
pop ecx
mov esi, str.Aeroadminguid.bin
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
lea eax, [esp + 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4cb6e9
push dword [esp + 0x2c]
lea ecx, [ebx + 0x2ec]
xor edx, edx
lea eax, [ecx + 4]
mov dword [esp + 0x1c], edx
push eax
push ecx
push edx
lea ecx, [esp + 0x28]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
call fcn.00448e16
mov eax, dword [ebx + 0x2cc]
lea ecx, [esp + 0x18]
sub eax, dword [ebx + 0x2c8]
push dword [esp + 0x2c]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x28]
call fcn.00448e16
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4cb6ae
mov ecx, dword [ebx + 0x2c8]
add eax, ecx
push dword [esp + 0x2c]
push eax
push ecx
push dword [esp + 0x28]
lea ecx, [esp + 0x28]
call fcn.00448e16
lea edx, [ebx + 0x2d4]
lea ecx, [esp + 0x18]
call fcn.004c8148
xor ecx, ecx
lea eax, [esp + 0x2c]
push ecx
push eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
push eax
push dword [esp + 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
call fcn.0043c24c
cmp byte [ebx + 0x2f0], 0
je 0x4cb84d
lea eax, [esp + 0x98]
push eax
xor eax, eax
push eax
push eax
push 0x23
push eax
call ebp
lea edi, [esp + 0x98]
sub edi, 2
xor edx, edx
mov ax, word [edi + 2]
add edi, 2
cmp ax, dx
jne 0x4cb713
push 0xc
pop ecx
push edx
push 0x80
push 2
push edx
push 2
push 0x40000000
lea eax, [esp + 0xb0]
mov esi, str.Aeroadmin_settings.bin
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4cb84d
push dword [esp + 0x2c]
xor ecx, ecx
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
mov dword [esp + 0x38], ecx
push eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
push ecx
lea ecx, [esp + 0x28]
call fcn.00448e16
lea edx, [ebx + 0x408]
lea ecx, [esp + 0x18]
call fcn.004c8ba0
xor eax, eax
or ecx, 0xffffffff
mov edx, eax
mov esi, eax
test cl, 1
je 0x4cb7a1
push 0x1f
pop eax
sub eax, esi
bts edx, eax
inc esi
shr ecx, 1
cmp esi, 0x20
jb 0x4cb794
mov dword [esp + 0x2c], edx
call fcn.004d067a
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
sub eax, ecx
sub eax, 4
push eax
lea eax, [ecx + 4]
push eax
lea ecx, [esp + 0x34]
call fcn.004cfae3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
not ecx
mov dword [esp + 0x30], ecx
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x18]
push eax
call fcn.004edb63
pop ecx
push dword [ebx + 0x2c4]
mov ecx, ebx
mov edi, eax
push dword [ebx + 0x2b4]
push dword [ebx + 0x2b8]
call fcn.00447cf8
mov edx, dword [esp + 0x1c]
lea ecx, [ebx + 4]
sub edx, dword [esp + 0x18]
mov esi, dword [ecx]
push edx
push dword [esp + 0x1c]
push edi
call dword [esi + 0x1c]
xor ecx, ecx
lea eax, [esp + 0x10]
push ecx
push eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
push eax
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.004ed662
pop ecx
lea ecx, [esp + 0x18]
call fcn.0043c24c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28c
ret