Function at 0x40104b
Capabilities:
Get common file path
Get session user name
Resolve function by parsing pe exports
Write file on windows

Disassembly:
jmp 0x402220
sub esp, 0x5c
push ebp
push esi
mov esi, 0x407ac8
mov dword [esp + 0x14], 0x101
push edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x402236
mov ebp, dword [esp + 0x70]
sub esi, ecx
mov edi, ebp
sar esi, 1
lea ecx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x402250
sub edi, ecx
sar edi, 1
lea eax, [edi + 1]
add eax, esi
cmp eax, 0x8000
ja 0x4024f1
push ebx
xor bh, bh
lfence
cmp byte [section..data], bh
je 0x4023cc
cmp byte [esp + 0x7c], bh
je 0x4023cc
lea eax, [esi + 0x19]
add eax, edi
cmp eax, 0x8000
ja 0x4023cc
lea eax, [esp + 0x30]
mov byte [esp + 0x13], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0xb
lea eax, [esp + 0x5c]
mov dword [esp + 0x6c], 0
push eax
push str.yyyy_MM_dd
lea eax, [esp + 0x40]
mov word [esp + 0x78], 0
push eax
push 0
xorps xmm0, xmm0
push 0
movups xmmword [esp + 0x70], xmm0
call dword [sym.imp.KERNEL32.dll_GetDateFormatEx]
push 9
mov dword [esp + 0x18], eax
xorps xmm0, xmm0
lea eax, [esp + 0x44]
mov word [esp + 0x54], 0
push eax
push str.HH:mm:ss
lea eax, [esp + 0x3c]
push eax
push 0
push 0
movups xmmword [esp + 0x58], xmm0
call dword [sym.imp.KERNEL32.dll_GetTimeFormatEx]
movzx ecx, word [esp + 0x3e]
xorps xmm0, xmm0
mov dword [esp + 0x18], eax
mov ebx, 3
movlpd qword [esp + 0x28], xmm0
mov eax, 0xcccccccd
dec ebx
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esp + ebx*2 + 0x28], cx
mov ecx, edx
test ebx, ebx
jne 0x402324
cmp dword [esp + 0x14], ebx
je 0x4023c8
cmp dword [esp + 0x18], ebx
je 0x4023c8
lea eax, [esp + 0x54]
push eax
push 0x8000
push 0x407ac8
call fcn.0040102d
push 0x404444
push 0x8000
push 0x407ac8
call fcn.0040102d
lea eax, [esp + 0x40]
push eax
push 0x8000
push 0x407ac8
call fcn.0040102d
push 0x404960
push 0x8000
push 0x407ac8
call fcn.0040102d
lea eax, [esp + 0x28]
push eax
push 0x8000
push 0x407ac8
call fcn.0040102d
push 0x404444
push 0x8000
push 0x407ac8
call fcn.0040102d
mov bh, byte [esp + 0x13]
mov bl, byte [esp + 0x78]
push ebp
push 0x8000
push 0x407ac8
mov byte [section..data], bl
call fcn.0040102d
test eax, eax
js 0x4024f0
lea eax, [esp + 0x1c]
push eax
push 0x417ac8
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x4024f0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0
push 0x4000
push 0x40683c
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x4024f0
lfence
push dword [esp + 0x14]
push 0x407ac8
call fcn.0040100f
push 0x417ac8
push 0x407ac8
call fcn.0040100f
mov eax, dword [0x404964]
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], eax
lea edx, [ecx + 2]
mov ax, word [0x404968]
add esp, 0x10
mov word [esp + 0x24], ax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402470
sub ecx, edx
lea eax, [edi + 0x19]
sar ecx, 1
test bh, bh
jne 0x402489
lea eax, [edi + 1]
add eax, ecx
add eax, esi
cmp eax, 0x8000
setbe al
test bl, bl
je 0x4024b1
test al, al
je 0x4024b1
lea eax, [esp + 0x20]
push eax
push 0x8000
push 0x407ac8
call fcn.0040102d
cmp byte [esp + 0x80], 0
je 0x4024c2
mov esi, 0x407ac8
jmp 0x4024c9
lea esi, [esi*2 + 0x407ac8]
push 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push dword [esp + 0x80]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x5c
ret