Function at 0x413605
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de68b
mov eax, dword fs:[0]
push eax
mov eax, 0x1578
call fcn.004be980
mov eax, dword [0x513720]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
mov dword [ebp - 0x1584], edi
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
push 0x1fe
mov word [ebp - 0x31c], ax
lea eax, [ebp - 0x31a]
push ebx
push eax
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x31c]
push ebx
push 0x10
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4136b2
lea ecx, [ebp - 0x31c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x413685
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jbe 0x4136b2
push 0x4fe494
lea eax, [ebp - 0x31c]
push 0x100
push eax
call fcn.004bc23f
add esp, 0xc
mov esi, 0x80004005
cmp word [ebp - 0x31c], bx
je 0x413a9d
mov eax, dword [edi + 0xc08]
cmp byte [eax], 0x3a
jne 0x413a9d
push 0x104
lea eax, [ebp - 0x11b]
mov byte [ebp - 0x11c], bl
push ebx
push eax
call fcn.004be330
add esp, 0xc
xor eax, eax
mov word [ebp - 0xb54], ax
lea eax, [ebp - 0xb52]
push 0x208
push ebx
push eax
call fcn.004be330
add esp, 0xc
xor eax, eax
mov word [ebp - 0xd64], ax
lea eax, [ebp - 0xd62]
push 0x208
push ebx
push eax
call fcn.004be330
add esp, 0xc
mov byte [ebp - 0x1164], bl
lea eax, [ebp - 0x1163]
push 0x3ff
push ebx
push eax
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x1164]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [edi + 0xc08]
lea eax, [ebp - 0x1163]
push 0x103
push eax
call fcn.004bb363
add esp, 0xc
lea eax, [ebp - 0xb54]
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x1164]
push eax
push ebx
push 0x3a8
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ebx, [edi + 0x100c]
test ebx, ebx
je 0x4139ac
cmp byte [ebx], 0
je 0x4139ac
xor eax, eax
mov dword [ebp - 0x156c], eax
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x1568], 0xf
mov dword [ebp - 0x156c], eax
mov byte [ebp - 0x157c], al
mov dword [ebp - 4], eax
lea edx, [ebp - 0x157c]
mov ecx, ebx
mov edi, eax
call fcn.004059b6
cmp dword [ebp - 0x156c], edi
jne 0x41380f
inc edi
cmp edi, 3
jg 0x4138f9
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x157c]
mov ecx, ebx
call fcn.004059b6
cmp dword [ebp - 0x156c], 0
je 0x4137e7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
xor ebx, ebx
mov esi, eax
push ebx
push 0x23
lea eax, [ebp - 0x11c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str._tempicon_
lea eax, [ebp - 0x11c]
push 0x105
push eax
call fcn.004bab23
add esp, 0xc
xor eax, eax
mov word [ebp - 0x524], ax
lea eax, [ebp - 0x522]
push 0x206
push ebx
push eax
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x524]
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x11c]
push eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x3a8
call ebx
lea eax, [ebp - 0x524]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0x3ff
lea eax, [ebp - 0x1563]
mov byte [ebp - 0x1564], 0
push 0
push eax
call fcn.004be330
mov edi, dword [ebp - 0x1584]
add esp, 0xc
lea ecx, [edi + 0x404]
mov esi, ecx
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4138c0
sub esi, edx
lea eax, [ebp - 0x1564]
push esi
push ecx
push eax
call fcn.004bdce0
add esp, 0xc
lea eax, [ebp - 0x1564]
push 0x4feadc
push eax
call fcn.004baf70
pop ecx
pop ecx
test eax, eax
je 0x413911
mov dword [eax], 0x6f63692e
jmp 0x41391c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x157c]
push 0
push 1
call fcn.004019c4
jmp 0x413aa3
mov dword [ebp + esi - 0x1564], 0x6f63692e
lea eax, [ebp - 0x1564]
push eax
lea eax, [ebp - 0x11c]
push 0x105
push eax
call fcn.004bab23
add esp, 0xc
lea eax, [ebp - 0x11c]
xor esi, esi
mov dword [ebp - 0x1580], esi
push 0x4ff940
push eax
lea eax, [ebp - 0x1580]
push eax
call fcn.004ba471
add esp, 0xc
cmp dword [ebp - 0x1580], esi
je 0x413998
push dword [ebp - 0x1580]
cmp dword [ebp - 0x1568], 0x10
lea eax, [ebp - 0x157c]
push dword [ebp - 0x156c]
cmovae eax, dword [ebp - 0x157c]
push 1
push eax
call fcn.004bc1bd
push dword [ebp - 0x1580]
call fcn.004bad04
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x157c]
push esi
push 1
call fcn.004019c4
jmp 0x4139cf
lea eax, [ebp - 0x1164]
push eax
lea eax, [ebp - 0x11c]
push 0x105
push eax
call fcn.004bb363
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 0xc
xor esi, esi
push 0x104
lea eax, [ebp - 0xd64]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x11c]
push eax
push esi
push 0x3a8
call ebx
xor eax, eax
push 0x208
mov word [ebp - 0x944], ax
lea eax, [ebp - 0x942]
push esi
push eax
call fcn.004be330
add esp, 0xc
xor eax, eax
mov word [ebp - 0x734], ax
lea eax, [ebp - 0x732]
push 0x208
push esi
push eax
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x944]
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [edi + 0x404]
push eax
push esi
push 0x3a8
call ebx
lea eax, [ebp - 0x944]
push eax
lea eax, [ebp - 0x31c]
push 0x100
push eax
call fcn.004bc23f
add esp, 0xc
lea eax, [ebp - 0x734]
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [edi + 4]
push eax
push esi
push 0x3a8
call ebx
lea eax, [ebp - 0x734]
push eax
lea eax, [ebp - 0xd64]
push eax
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0xb54]
push eax
call fcn.00413ac3
mov esi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b923d
mov esp, ebp
pop ebp
ret 4