Function at 0x4138c6
Capabilities:
Get common file path
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x200
push 0x5c2c60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x534018
push 0x5c2c60
call fcn.004202e0
add esp, 8
push 0x53401c
push 0x5c2c60
call fcn.004202e0
add esp, 8
push 0x534024
push 0x5c2c60
call fcn.004202e0
add esp, 8
push 0x5c2c60
call fcn.00408b00
add esp, 4
test eax, eax
jne 0x413969
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 5
je 0x413969
cmp dword [ebp - 0x34c], 2
je 0x413969
push 0x40001
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413c8f
push 0x53402c
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x534030
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0x534038
push 0x5c2a40
call fcn.004202e0
add esp, 8
cmp dword [ebp + 8], 0
je 0x413a5f
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.004202d0
add esp, 8
push 0x534040
lea edx, [ebp - 0x204]
push edx
call fcn.004202e0
add esp, 8
push 0x534044
lea eax, [ebp - 0x204]
push eax
call fcn.004202e0
add esp, 8
push 0x53404c
lea ecx, [ebp - 0x204]
push ecx
call fcn.004202e0
add esp, 8
lea edx, [ebp - 0x348]
push edx
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x413a5f
push 0
push 0x5c2a40
lea ecx, [ebp - 0x204]
push ecx
call fcn.00408b26
add esp, 0xc
test eax, eax
jne 0x413a4e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4000c
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413c8f
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x413c8f
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5c2a20], eax
cmp dword [0x5c2a20], 0xffffffff
jne 0x413b81
push 0x200
push 0x5c2c60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x534054
push 0x5c2c60
call fcn.004202e0
add esp, 8
push 0x534058
push 0x5c2c60
call fcn.004202e0
add esp, 8
push str..dl_
push 0x5c2c60
call fcn.004202e0
add esp, 8
push 0x5c2c60
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x413b32
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 5
je 0x413b32
cmp dword [ebp - 0x34c], 2
je 0x413b32
cmp dword [ebp - 0x34c], 0xb7
je 0x413b32
push 0x40002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413c8f
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5c2a20], eax
cmp dword [0x5c2a20], 0xffffffff
jne 0x413b72
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413c8f
mov ecx, dword [0x5c2a20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x413b8e
mov edx, dword [0x5c2a20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x200
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x534068
push 0x5c2a40
call fcn.004202e0
add esp, 8
push str.hlvdd
push 0x5c2a40
call fcn.004202e0
add esp, 8
push str..dll
push 0x5c2a40
call fcn.004202e0
add esp, 8
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5c2a40
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x5c2a24], eax
cmp dword [0x5c2a24], 0xffffffff
jne 0x413c11
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413c8f
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.004089da
push eax
push 0x437d80
mov ecx, dword [0x5c2a24]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x413c60
mov edx, dword [0x5c2a24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413c8f
mov eax, dword [0x5c2a24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x413c8d
push 0x40005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x413c8f
xor eax, eax
mov esp, ebp
pop ebp
ret