Function at 0x4092f0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41e648
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
mov eax, dword [0x425fe8]
xor eax, esp
mov dword [esp + 0xd0], eax
push ebx
push esi
push edi
mov eax, dword [0x425fe8]
xor eax, esp
push eax
lea eax, [esp + 0xe8]
mov dword fs:[0], eax
fldz
xor eax, eax
mov dword [esp + 0x3c], eax
xor ecx, ecx
mov word [esp + 0x40], cx
xor edx, edx
mov word [esp + 0x18], dx
mov dword [esp + 0x68], eax
mov dword [esp + 0x28], eax
fst dword [esp + 0x14]
fst dword [esp + 0x24]
mov dword [esp + 0x2c], eax
fldz
mov dword [esp + 0x30], eax
fst qword [esp + 0x74]
mov dword [esp + 0x98], 0xf
fxch st(1)
mov dword [esp + 0x94], eax
fstp dword [esp + 0x1c]
mov byte [esp + 0x84], al
fstp qword [esp + 0x54]
push 0x118
mov dword [esp + 0xf4], eax
call fcn.0040b36c
push eax
mov dword [esp + 0x70], eax
call fcn.00402540
add esp, 8
push 0
call fcn.0040b13a
mov esi, dword [esp + 0x34]
add esp, 4
cmp edx, esi
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], edx
jg 0x4093d5
jl 0x4093c7
cmp eax, dword [esp + 0x2c]
jae 0x4093d5
xor esi, esi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], esi
mov ecx, eax
sub ecx, dword [esp + 0x2c]
mov edi, edx
sbb edi, esi
mov dword [esp + 0x20], edi
js 0x409ccd
jg 0x4093f7
cmp ecx, 0x708
jbe 0x409ccd
mov esi, eax
shr esi, 9
push 0x408
lea ebx, [esi + 0x55]
push 0x4257a8
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x68], 0
mov dword [esp + 0x40], esi
mov dword [esp + 0x24], ebx
call fcn.004023a0
push 0xd
push 0x423a50
mov dword [esp + 0x6c], eax
call fcn.004023a0
mov edi, eax
push 0xaf1
push 0x424968
mov dword [esp + 0x5c], edi
call fcn.004023a0
push 0x31e
push 0x4230d8
mov dword [esp + 0x84], eax
call fcn.004023a0
add esp, 0x20
mov dword [esp + 0x50], eax
cmp esi, ebx
je 0x4099a3
mov eax, dword [0x4277e0]
push 0
push eax
call fcn.00401290
add esp, 8
test eax, eax
jne 0x4094a4
add dword [0x42399c], 0x256408ed
mov ecx, dword [0x4277e8]
mov edx, dword [0x427324]
push ecx
push edx
call fcn.004014a0
add esp, 8
fld dword [esp + 0x14]
fadd qword [0x425470]
fcomp qword [0x41fa70]
fnstsw ax
test ah, 0x41
jp 0x4094e5
dec dword [esp + 0x40]
mov ax, word [esp + 0x18]
mov dx, word [esp + 0x40]
movsx ecx, ax
movsx eax, dx
sub ecx, eax
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fsub qword [0x425790]
fstp qword [esp + 0x54]
jmp 0x409514
fld qword [esp + 0x54]
fld qword [0x425c20]
fadd qword [0x41fa68]
fsubp st(1)
call fcn.0040b450
mov word [0x4254c8], ax
fld qword [0x425c20]
fadd qword [0x41f348]
fstp qword [0x425c20]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x64]
push ecx
push edx
push eax
lea ecx, [esp + 0xa8]
push ecx
call fcn.004041d0
push 0x8b
push 0x423b20
call fcn.004023a0
mov ebx, eax
mov eax, dword [esp + 0x5c]
add esp, 0x18
mov esi, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409550
mov edi, ebx
sub eax, esi
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x409560
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x2710
push 0
lea edx, [esp + 0x88]
push edx
mov ecx, eax
lea eax, [esp + 0xa8]
and ecx, 3
push ebx
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00408970
xor ecx, ecx
push 0x8b
push ecx
mov word [esp + 0x2c], cx
mov dword [esp + 0x2c], ecx
push ebx
call fcn.0040b220
push ebx
call fcn.0040b18b
fld dword [esp + 0x38]
mov edx, dword [0x425c68]
mov eax, 0x8912fb7c
sub eax, edx
mov dword [esp + 0x38], eax
fisub dword [esp + 0x38]
mov eax, dword [esp + 0xa8]
add esp, 0x24
cmp dword [esp + 0x98], 0x10
fstp dword [esp + 0x14]
jae 0x4095e8
lea eax, [esp + 0x84]
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x5c]
push ecx
push eax
push edx
call fcn.00408250
mov esi, eax
add esp, 0xc
cmp esi, 9
jl 0x409973
mov eax, dword [0x425cd4]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fadd qword [esp + 0x74]
fsub qword [esp + 0x74]
mov ecx, dword [0x425528]
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
faddp st(1)
call fcn.0040b450
mov dword [0x425528], eax
inc dword [0x425cd4]
cmp dword [esp + 0x98], 0x10
mov eax, dword [esp + 0x84]
jae 0x409656
lea eax, [esp + 0x84]
mov ecx, dword [eax]
xor eax, eax
cmp eax, dword [esp + 0x70]
jl 0x409973
jg 0x409670
cmp ecx, dword [esp + 0x6c]
jb 0x409973
dec esi
cmp esi, dword [esp + 0x94]
jbe 0x40967f
call fcn.0040bf99
mov eax, dword [esp + 0x84]
mov ecx, 0x10
cmp dword [esp + 0x98], ecx
jae 0x40969b
lea eax, [esp + 0x84]
mov byte [eax + esi], 0
fld qword [0x425c98]
fmul qword [0x41fa60]
mov eax, dword [esp + 0x84]
fstp qword [0x425c98]
cmp dword [esp + 0x98], ecx
jae 0x4096c8
lea eax, [esp + 0x84]
lea ecx, [esp + 0x9c]
add eax, 8
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4096f2
test dl, dl
je 0x4096ee
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4096f2
add eax, 2
add ecx, 2
test dl, dl
jne 0x4096d2
xor eax, eax
jmp 0x4096f7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x409973
mov dx, word [0x425578]
movsx eax, dx
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fstp dword [esp + 0x14]
inc word [0x425578]
mov ecx, dword [esp + 0x98]
mov ebx, dword [esp + 0x84]
cmp ecx, 0x10
jb 0x40980c
mov edi, ebx
test ebx, ebx
je 0x409766
mov eax, ebx
cmp ecx, 0x10
jae 0x409747
lea eax, [esp + 0x84]
cmp eax, edi
ja 0x409766
mov eax, ebx
cmp ecx, 0x10
jae 0x409759
lea eax, [esp + 0x84]
mov edx, dword [esp + 0x94]
add eax, edx
cmp edi, eax
jbe 0x409780
call fcn.0040bf99
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x94]
mov ebx, dword [esp + 0x84]
lea esi, [esp + 0x80]
mov dword [esp + 0x4c], edi
jmp 0x409790
mov eax, ebx
cmp ecx, 0x10
jae 0x40979e
lea eax, [esp + 0x84]
lea edi, [eax + edx]
test edi, edi
je 0x4097cb
mov eax, ebx
cmp ecx, 0x10
jae 0x4097b3
lea eax, [esp + 0x84]
cmp eax, edi
ja 0x4097cb
mov eax, ebx
cmp ecx, 0x10
jae 0x4097c5
lea eax, [esp + 0x84]
add eax, edx
cmp edi, eax
jbe 0x4097d0
call fcn.0040bf99
cmp esi, 0xfffffffc
je 0x4097e9
test esi, esi
je 0x4097e4
lea ecx, [esp + 0x80]
cmp esi, ecx
je 0x4097e9
call fcn.0040bf99
cmp dword [esp + 0x4c], edi
je 0x4098ab
cmp esi, 0xfffffffc
je 0x40982b
test esi, esi
jne 0x409801
call fcn.0040bf99
cmp dword [esi + 0x18], 0x10
jb 0x409818
mov eax, dword [esi + 4]
jmp 0x40981b
lea edi, [esp + 0x84]
jmp 0x409739
lea eax, [esi + 4]
mov edx, dword [esi + 0x14]
add edx, eax
cmp dword [esp + 0x4c], edx
jb 0x40982b
call fcn.0040bf99
mov eax, dword [esp + 0x4c]
mov byte [eax], 0
cmp esi, 0xfffffffc
je 0x40985e
test esi, esi
jne 0x409840
call fcn.0040bf99
cmp dword [esi + 0x18], 0x10
jb 0x40984b
mov eax, dword [esi + 4]
jmp 0x40984e
lea eax, [esi + 4]
mov ecx, dword [esi + 0x14]
add ecx, eax
cmp dword [esp + 0x4c], ecx
jb 0x40985e
call fcn.0040bf99
fld qword [esp + 0x54]
inc dword [esp + 0x4c]
fsub qword [0x41f348]
fstp qword [esp + 0x54]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
fld qword [esp + 0x54]
fsub qword [0x41fa58]
fsubp st(1)
call fcn.0040b450
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x94]
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x28], eax
jmp 0x409790
push 0x7e
push 0x423b20
call fcn.004023a0
xor ebx, ebx
push ebx
mov esi, eax
push ebx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0xb0]
push esi
push ecx
call fcn.00408970
fld dword [esp + 0x40]
fadd qword [0x41f348]
push 0x7e
xor edx, edx
push ebx
fstp dword [esp + 0x48]
push esi
fld dword [esp + 0x4c]
fsubr qword [0x41fa50]
fstp qword [0x425bd0]
mov word [esp + 0x38], dx
mov dword [esp + 0x38], ebx
call fcn.0040b220
push esi
call fcn.0040b18b
push 0xc
push 0x425494
call fcn.004023a0
add esp, 0x34
mov esi, eax
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x409920
sub eax, ecx
push eax
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x8c]
call fcn.00404c20
mov edi, eax
xor eax, eax
mov dword [esi], eax
mov word [esp + 0x10], ax
mov dword [esi + 4], eax
mov dword [esp + 0x10], ebx
push esi
mov dword [esi + 8], eax
call fcn.0040b18b
fld dword [esp + 0x28]
mov ecx, dword [esp + 0x98]
fmul qword [0x41fa48]
add ecx, 0xfffffff5
add esp, 4
fstp dword [esp + 0x24]
cmp edi, ecx
je 0x409988
mov eax, dword [esp + 0x38]
inc eax
mov dword [esp + 0x38], eax
cmp eax, dword [esp + 0x1c]
jne 0x409470
jmp 0x40999f
push 0xb
push edi
lea ecx, [esp + 0x88]
call fcn.00406ee0
mov dword [esp + 0x60], 1
mov edi, dword [esp + 0x44]
mov ebx, dword [esp + 0x5c]
xor esi, esi
push 0x408
xor edx, edx
push esi
mov word [esp + 0x18], dx
mov dword [esp + 0x24], esi
push ebx
call fcn.0040b220
push ebx
call fcn.0040b18b
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [esp + 0x20], ax
mov dword [edi + 8], eax
mov dword [esp + 0x2c], esi
push edi
mov byte [edi + 0xc], al
call fcn.0040b18b
mov edi, dword [esp + 0x64]
push 0x31e
xor ecx, ecx
push esi
mov word [esp + 0x2c], cx
mov dword [esp + 0x38], esi
push edi
call fcn.0040b220
push edi
call fcn.0040b18b
mov edi, dword [esp + 0x88]
push 0xaf1
xor edx, edx
push esi
mov word [esp + 0x3c], dx
mov dword [esp + 0x48], esi
push edi
call fcn.0040b220
push edi
call fcn.0040b18b
mov eax, dword [esp + 0x5c]
mov ecx, 0x72929cf1
sub ecx, eax
mov dword [esp + 0x50], ecx
fild dword [esp + 0x50]
push 0x40
lea edx, [esp + 0xd4]
push esi
fadd dword [0x42491c]
push edx
fstp dword [0x42491c]
call fcn.0040b220
add esp, 0x40
cmp dword [esp + 0x60], esi
je 0x409ccd
mov eax, dword [esp + 0x68]
push 0x708
push eax
call fcn.00403400
fld qword [0x423a38]
mov ecx, dword [esp + 0x44]
add ecx, 0xd661a28
mov dword [esp + 0x24], ecx
fild dword [esp + 0x24]
add esp, 8
fsubp st(1)
fstp qword [0x423a38]
inc dword [esp + 0x3c]
cmp dword [esp + 0x94], 0x200
jbe 0x409cbb
push 0x370
call fcn.0040b36c
fld qword [0x425600]
mov edx, dword [0x4256ec]
mov dword [esp + 0x20], edx
fild dword [esp + 0x20]
mov ebx, eax
add esp, 4
fsubp st(1)
fstp qword [0x425600]
fld dword [esp + 0x24]
mov ax, word [0x423a44]
fsub qword [0x41fa40]
movsx ecx, ax
mov dword [esp + 0x1c], ecx
fild dword [esp + 0x1c]
fmulp st(1)
call fcn.0040b450
mov word [0x423a44], ax
fld dword [esp + 0x24]
fadd qword [0x41f348]
push ebx
push 0xeb
fstp dword [esp + 0x2c]
fld qword [0x423d08]
fadd qword [0x41fa38]
fstp qword [0x423d08]
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push ebx
call fcn.00404500
push 3
push 0x425cc8
call fcn.004023a0
mov esi, eax
push esi
push ebx
call fcn.0040be25
mov edi, eax
xor eax, eax
xor edx, edx
mov word [esp + 0x28], dx
mov word [esi], ax
push esi
mov dword [esp + 0x38], eax
mov byte [esi + 2], al
call fcn.0040b18b
mov eax, dword [esp + 0xa0]
add esp, 0x1c
cmp dword [esp + 0x98], 0x10
jae 0x409b81
lea eax, [esp + 0x84]
mov ecx, dword [esp + 0x94]
push edi
push 1
push ecx
push eax
call fcn.0040c1d7
push edi
call fcn.0040b9cb
add esp, 0x14
push 0x104
lea eax, [ebx + 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x15
push 0x425538
call fcn.004023a0
push 0x20
push 0x425754
mov edi, eax
call fcn.004023a0
mov edx, dword [0x4277e0]
push edx
mov esi, eax
push esi
lea eax, [ebx + 0x104]
push eax
push edi
lea eax, [ebx + 0x208]
push 0x168
push eax
call fcn.0040b8a5
movzx eax, word [esp + 0x40]
mov ecx, dword [0x423a6c]
sub eax, ecx
mov word [esp + 0x40], ax
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
xor edx, edx
mov dword [esi + 0x14], eax
mov word [esp + 0x38], dx
mov dword [esi + 0x18], eax
mov dword [esp + 0x44], eax
push esi
mov dword [esi + 0x1c], eax
call fcn.0040b18b
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov word [esp + 0x3c], ax
mov dword [edi + 0x10], eax
mov dword [esp + 0x48], eax
push edi
mov byte [edi + 0x14], al
call fcn.0040b18b
mov ecx, dword [0x4277e0]
push 1
push ecx
call fcn.00401290
lea eax, [ebx + 0x208]
push eax
push ebx
call fcn.004014a0
movzx edx, word [esp + 0x58]
add esp, 0x40
push 0x370
sub edx, 0x5dd3e9c2
push 0
mov word [esp + 0x20], dx
push ebx
call fcn.0040b220
push ebx
call fcn.0040b18b
fld dword [esp + 0x24]
add esp, 0x10
fsub qword [0x41f348]
push 0x15f90
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fadd qword [0x41fa30]
fadd qword [0x41fa28]
fstp dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [0x425650]
fmul qword [0x41fa20]
fstp dword [0x425650]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x4277e0]
push 0
push eax
call fcn.00401290
add esp, 8
test eax, eax
jne 0x4093a5
mov ecx, dword [0x4277e8]
fld qword [0x41fa18]
mov edx, dword [0x427324]
fstp qword [0x423970]
push ecx
push edx
call fcn.004014a0
jmp 0x4093a2