Function at 0x410191
Capabilities:
Get common file path
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push 0x200
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x200
push 0x5a2880
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x51eae4
push 0x5a2880
call fcn.0041bfb0
add esp, 8
push 0x51eae8
push 0x5a2880
call fcn.0041bfb0
add esp, 8
push 0x51eaf0
push 0x5a2880
call fcn.0041bfb0
add esp, 8
push 0x5a2880
call fcn.00406151
add esp, 4
test eax, eax
jne 0x410234
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 5
je 0x410234
cmp dword [ebp - 0x34c], 2
je 0x410234
push 0x40001
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x41054d
push 0x51eaf8
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x51eafc
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x51eb04
push 0x5a2660
call fcn.0041bfb0
add esp, 8
cmp dword [ebp + 8], 0
je 0x41032a
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.0041bfa0
add esp, 8
push 0x51eb0c
lea edx, [ebp - 0x204]
push edx
call fcn.0041bfb0
add esp, 8
push 0x51eb10
lea eax, [ebp - 0x204]
push eax
call fcn.0041bfb0
add esp, 8
push 0x51eb18
lea ecx, [ebp - 0x204]
push ecx
call fcn.0041bfb0
add esp, 8
lea edx, [ebp - 0x348]
push edx
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x41032a
push 0
push 0x5a2660
lea ecx, [ebp - 0x204]
push ecx
call fcn.00406177
add esp, 0xc
test eax, eax
jne 0x410319
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x41054d
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x41054d
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5a2640], eax
cmp dword [0x5a2640], 0xffffffff
jne 0x410440
push 0x200
push 0x5a2880
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x51eb20
push 0x5a2880
call fcn.0041bfb0
add esp, 8
push 0x51eb24
push 0x5a2880
call fcn.0041bfb0
add esp, 8
push 0x51eb2c
push 0x5a2880
call fcn.0041bfb0
add esp, 8
push 0x5a2880
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x4103f1
cmp dword [ebp - 0x34c], 5
je 0x4103f1
cmp dword [ebp - 0x34c], 2
je 0x4103f1
cmp dword [ebp - 0x34c], 0xb7
je 0x4103f1
push 0x40002
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x41054d
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5a2640], eax
cmp dword [0x5a2640], 0xffffffff
jne 0x410431
push 0x40003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x41054d
mov ecx, dword [0x5a2640]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41044d
mov edx, dword [0x5a2640]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x200
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x51eb34
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x51eb38
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x51eb40
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5a2644], eax
cmp dword [0x5a2644], 0xffffffff
jne 0x4104d0
push 0x40003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x41054d
push 0
lea eax, [ebp - 0x208]
push eax
push 0x1a00
push 0x51c044
mov ecx, dword [0x5a2644]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x41051e
mov edx, dword [0x5a2644]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x41054d
mov eax, dword [0x5a2644]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x41054b
push 0x40005
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x41054d
xor eax, eax
mov esp, ebp
pop ebp
ret