Function at 0x412b01
Capabilities:
Get common file path
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push 0x200
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x200
push 0x5abf80
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x52293c
push 0x5abf80
call fcn.0041e940
add esp, 8
push 0x522940
push 0x5abf80
call fcn.0041e940
add esp, 8
push 0x522948
push 0x5abf80
call fcn.0041e940
add esp, 8
push 0x5abf80
call fcn.00408ac1
add esp, 4
test eax, eax
jne 0x412ba4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 5
je 0x412ba4
cmp dword [ebp - 0x34c], 2
je 0x412ba4
push 0x40001
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412ebd
push 0x522950
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x522954
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x52295c
push 0x5abd60
call fcn.0041e940
add esp, 8
cmp dword [ebp + 8], 0
je 0x412c9a
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.0041e930
add esp, 8
push 0x522964
lea edx, [ebp - 0x204]
push edx
call fcn.0041e940
add esp, 8
push 0x522968
lea eax, [ebp - 0x204]
push eax
call fcn.0041e940
add esp, 8
push 0x522970
lea ecx, [ebp - 0x204]
push ecx
call fcn.0041e940
add esp, 8
lea edx, [ebp - 0x348]
push edx
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x412c9a
push 0
push 0x5abd60
lea ecx, [ebp - 0x204]
push ecx
call fcn.00408ae7
add esp, 0xc
test eax, eax
jne 0x412c89
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412ebd
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x412ebd
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5abd40], eax
cmp dword [0x5abd40], 0xffffffff
jne 0x412db0
push 0x200
push 0x5abf80
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x522978
push 0x5abf80
call fcn.0041e940
add esp, 8
push 0x52297c
push 0x5abf80
call fcn.0041e940
add esp, 8
push 0x522984
push 0x5abf80
call fcn.0041e940
add esp, 8
push 0x5abf80
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x412d61
cmp dword [ebp - 0x34c], 5
je 0x412d61
cmp dword [ebp - 0x34c], 2
je 0x412d61
cmp dword [ebp - 0x34c], 0xb7
je 0x412d61
push 0x40002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412ebd
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5abd40], eax
cmp dword [0x5abd40], 0xffffffff
jne 0x412da1
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412ebd
mov ecx, dword [0x5abd40]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x412dbd
mov edx, dword [0x5abd40]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x200
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x52298c
push 0x5abd60
call fcn.0041e940
add esp, 8
push str.haspvdd
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x522998
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5abd44], eax
cmp dword [0x5abd44], 0xffffffff
jne 0x412e40
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412ebd
push 0
lea eax, [ebp - 0x208]
push eax
push 0x1a00
push 0x51fe9c
mov ecx, dword [0x5abd44]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x412e8e
mov edx, dword [0x5abd44]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412ebd
mov eax, dword [0x5abd44]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x412ebb
push 0x40005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412ebd
xor eax, eax
mov esp, ebp
pop ebp
ret