Function at 0x1000ffdc
Capabilities:
Get common file path
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push ebx
push esi
push edi
push 0x200
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x200
push 0x10142a60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100d6f5c
push 0x10142a60
call fcn.1001bc40
add esp, 8
push 0x100d6f60
push 0x10142a60
call fcn.1001bc40
add esp, 8
push 0x100d6f68
push 0x10142a60
call fcn.1001bc40
add esp, 8
push 0x10142a60
call fcn.10005ffa
add esp, 4
test eax, eax
jne 0x10010087
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 5
je 0x10010087
cmp dword [ebp - 8], 2
je 0x10010087
push 0x40001
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100103d4
push 0x100d6f70
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x100d6f74
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x100d6f7c
push 0x101434e0
call fcn.1001bc40
add esp, 8
cmp dword [ebp + 8], 0
je 0x10010193
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x34c]
push eax
call fcn.1001bc30
add esp, 8
push 0x100d6f84
lea eax, [ebp - 0x34c]
push eax
call fcn.1001bc40
add esp, 8
push 0x100d6f88
lea eax, [ebp - 0x34c]
push eax
call fcn.1001bc40
add esp, 8
push 0x100d6f90
lea eax, [ebp - 0x34c]
push eax
call fcn.1001bc40
add esp, 8
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffff
je 0x10010193
push 0
push 0x101434e0
lea eax, [ebp - 0x34c]
push eax
call fcn.10006020
add esp, 0xc
test eax, eax
jne 0x1001017f
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100103d4
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x100103d4
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0xc0000000
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x101436e0], eax
cmp dword [0x101436e0], 0xffffffff
jne 0x100102b9
push 0x200
push 0x10142a60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100d6f98
push 0x10142a60
call fcn.1001bc40
add esp, 8
push 0x100d6f9c
push 0x10142a60
call fcn.1001bc40
add esp, 8
push 0x100d6fa4
push 0x10142a60
call fcn.1001bc40
add esp, 8
push 0x10142a60
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1001025d
cmp dword [ebp - 8], 5
je 0x1001025d
cmp dword [ebp - 8], 2
je 0x1001025d
cmp dword [ebp - 8], 0xb7
je 0x1001025d
push 0x40002
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100103d4
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0xc0000000
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x101436e0], eax
cmp dword [0x101436e0], 0xffffffff
jne 0x100102a8
push 0x40003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100103d4
mov eax, dword [0x101436e0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100102c5
mov eax, dword [0x101436e0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x200
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100d6fac
push 0x101434e0
call fcn.1001bc40
add esp, 8
push str.haspvdd
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0x100d6fb8
push 0x101434e0
call fcn.1001bc40
add esp, 8
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0xc0000000
push 0x101434e0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x10142a58], eax
cmp dword [0x10142a58], 0xffffffff
jne 0x10010351
push 0x40003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100103d4
push 0
lea eax, [ebp - 4]
push eax
push 0x1a00
push 0x100d4638
mov eax, dword [0x10142a58]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1001039d
mov eax, dword [0x10142a58]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100103d4
mov eax, dword [0x10142a58]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100103cd
push 0x40005
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100103d4
xor eax, eax
jmp 0x100103d4
pop edi
pop esi
pop ebx
leave
ret