Function at 0x1001d4e2
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x69c]
sub esp, 0xa44
mov eax, dword [0x10113a30]
xor eax, ebp
mov dword [ebp + 0x698], eax
mov eax, dword [ebp + 0x6a4]
push ebx
xor ebx, ebx
push pe_nt_image_headers32
mov dword [ebp + 0x80], eax
lea eax, [ebp + 0x494]
push ebx
push eax
mov dword [ebp + 0x78], ecx
mov dword [ebp + 0x68], ebx
call fcn.1008ef90
add esp, 0xc
cmp dword [ebp + 0x6a8], ebx
push 0x100d9118
je 0x1001d53b
push 0x28000
jmp 0x1001d540
push 0x18000
push ebx
push ebx
push 0xa
call dword [sym.imp.CRYPT32.dll_CertOpenStore]
cmp eax, ebx
mov dword [ebp + 0x7c], eax
je 0x1001d70b
push ebx
push eax
call dword [sym.imp.CRYPT32.dll_CertEnumCertificatesInStore]
cmp eax, ebx
mov dword [ebp + 0x74], eax
je 0x1001d701
push esi
push edi
mov ecx, dword [ebp + 0x78]
mov eax, dword [ecx]
push ebx
push dword [ebp + 0x74]
lea edx, [ebp - 0x3a8]
push edx
call dword [eax + 0x34]
mov esi, eax
push pe_nt_image_headers32
lea eax, [ebp + 0x494]
push eax
lea eax, [ebp + 0x84]
mov ecx, 0x104
lea edi, [ebp + 0x84]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.1009060d
add esp, 0xc
test eax, eax
je 0x1001d5e9
mov eax, dword [ebp + 0x80]
mov ecx, dword [eax]
cmp dword [ebp + 0x484], ecx
jne 0x1001d5d2
push ecx
add eax, 4
push eax
push dword [ebp + 0x488]
call fcn.1009060d
add esp, 0xc
test eax, eax
je 0x1001d605
cmp dword [ebp + 0x484], ebx
je 0x1001d5e9
mov ecx, dword [ebp + 0x78]
lea eax, [ebp + 0x84]
push eax
call fcn.1001b6d9
push dword [ebp + 0x74]
push dword [ebp + 0x7c]
call dword [sym.imp.CRYPT32.dll_CertEnumCertificatesInStore]
cmp eax, ebx
mov dword [ebp + 0x74], eax
jne 0x1001d56a
jmp 0x1001d6ff
mov esi, 0x104
push esi
lea eax, [ebp + 0x594]
push ebx
push eax
mov dword [ebp + 0x70], ebx
call fcn.1008ef90
add esp, 0xc
push esi
lea eax, [ebp + 0x594]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.RaCert.pfx
lea eax, [ebp + 0x594]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
push 0x2000
push ebx
push ebx
push 2
call dword [sym.imp.CRYPT32.dll_CertOpenStore]
push ebx
push 1
push dword [ebp + 0x74]
mov dword [ebp + 0x80], eax
push eax
call dword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
mov esi, dword [sym.imp.CRYPT32.dll_PFXExportCertStoreEx]
push 4
push ebx
mov edi, 0x100d90fc
push edi
lea eax, [ebp + 0x6c]
push eax
push dword [ebp + 0x80]
call esi
push dword [ebp + 0x6c]
call fcn.1008e330
pop ecx
push 4
push ebx
mov dword [ebp + 0x70], eax
push edi
lea eax, [ebp + 0x6c]
push eax
push dword [ebp + 0x80]
call esi
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x594]
push 0x100d90f8
push eax
call fcn.1009471a
mov esi, eax
push esi
push 1
push dword [ebp + 0x6c]
push dword [ebp + 0x70]
call fcn.1009490b
push esi
call fcn.10094308
add esp, 0x1c
cmp dword [ebp + 0x70], ebx
je 0x1001d6d3
push dword [ebp + 0x70]
call fcn.1008e3f3
pop ecx
cmp dword [ebp + 0x484], ebx
je 0x1001d6ea
mov ecx, dword [ebp + 0x78]
lea eax, [ebp + 0x84]
push eax
call fcn.1001b6d9
cmp dword [ebp + 0x80], ebx
je 0x1001d6ff
push ebx
push dword [ebp + 0x80]
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
pop edi
pop esi
push ebx
push dword [ebp + 0x7c]
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
mov ecx, dword [ebp + 0x698]
mov eax, dword [ebp + 0x68]
xor ecx, ebp
pop ebx
call fcn.1008e5e8
add ebp, 0x69c
leave
ret 8