Function at 0x40726a
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push ebx
push esi
push edi
push 0x41
call dword [sym.imp.MSVCRT.dll_isupper]
and byte [ebp - 0x514], 0
pop ecx
push pe_nt_image_headers32
xor eax, eax
pop ecx
lea edi, [ebp - 0x513]
rep stosd dword es:[edi], eax
and byte [ebp - 0x618], 0
push pe_nt_image_headers32
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x617]
and byte [ebp - 0x208], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push pe_nt_image_headers32
xor eax, eax
pop ecx
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
cmp dword [ebp + 8], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x407352
lea eax, [ebp - 0x514]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x514]
push eax
lea eax, [ebp - 0x618]
push 0x43f6ac
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x618]
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x208]
push 0x43f6b8
push eax
call esi
lea eax, [ebp - 0x208]
push 0x43f6a8
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 0x18
test edi, edi
je 0x407352
push edi
push dword [ebp + 0x10]
push 1
pop ebx
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, dword [ebp + 0x10]
push edi
je 0x407359
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
xor al, al
jmp 0x4074d4
call dword [sym.imp.MSVCRT.dll_fclose]
lea eax, [ebp - 0x208]
push eax
call fcn.004094eb
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.00408306
add esp, 0x10
cmp dword [ebp + 0x14], 0
je 0x4074d2
push dword [ebp + 8]
call fcn.004082cf
test eax, eax
pop ecx
jne 0x4074d2
and dword [ebp + 0xc], eax
and byte [ebp - 0x104], al
push pe_nt_image_headers32
lea edi, [ebp - 0x103]
pop ecx
and byte [ebp - 0x30c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push pe_nt_image_headers32
xor eax, eax
pop ecx
lea edi, [ebp - 0x30b]
rep stosd dword es:[edi], eax
and byte [ebp - 0x410], 0
push pe_nt_image_headers32
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x40f]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x30c]
push str.zdzI_9
push eax
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x14], ebx
call esi
add esp, 0xc
lea eax, [ebp - 0x104]
push dword [ebp + 8]
push 0x43f6dc
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x410]
push 0x43f704
push eax
call esi
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0xc
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push eax
lea eax, [ebp - 0x30c]
push eax
push ebx
lea eax, [ebp - 0x104]
push 0x43f73c
push eax
push edi
call esi
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x104]
push dword [ebp + 8]
push ebx
push 0x43f748
push eax
push edi
call esi
lea eax, [ebp - 0x410]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x410]
push eax
push ebx
lea eax, [ebp - 0x104]
push 0x43f754
push eax
push edi
call esi
lea eax, [ebp + 0x10]
push 4
push eax
push 4
lea eax, [ebp - 0x104]
push 0x43f75c
push eax
push edi
call esi
lea eax, [ebp + 0xc]
push 4
push eax
push 4
lea eax, [ebp - 0x104]
push 0x43f76c
push eax
push edi
call esi
lea eax, [ebp + 0x14]
push 4
push eax
push 4
lea eax, [ebp - 0x104]
push 0x43f774
push eax
push edi
call esi
mov al, bl
pop edi
pop esi
pop ebx
leave
ret