Function at 0x4110d0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc78
mov eax, dword [0x43d180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0xc54]
mov dword [ebp - 0xc64], edi
call fcn.004114c0
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x7d0
push dword [edi + 0x3c80]
call ebx
mov esi, 2
test eax, eax
jne 0x411319
push str.ALLUSERSPROFILE
push eax
push eax
lea eax, [ebp - 0xc60]
push eax
call fcn.00416749
mov eax, dword [ebp - 0xc60]
add esp, 0x10
test eax, eax
jne 0x41114a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416230
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00417498
push str.ALLUSERSPROFILE
push dword [ebp - 0xc60]
mov ebx, eax
lea eax, [ebp - 0xc60]
push ebx
push eax
call fcn.00416749
lea ecx, [ebp - 0x41c]
mov esi, ebx
mov eax, ecx
add esp, 0x14
mov edx, 0x200
sub esi, eax
lea esp, [esp]
lea eax, [edx + 0x7ffffdfe]
test eax, eax
je 0x4111ae
movzx eax, word [esi + ecx]
test ax, ax
je 0x4111ae
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x411190
jmp 0x4111b2
test edx, edx
jne 0x4111b5
sub ecx, 2
xor eax, eax
push str.GID
mov word [ecx], ax
lea eax, [ebp - 0x41c]
push 0x200
push eax
call fcn.00401200
push str.Act.ws
push 0x200
lea eax, [ebp - 0x41c]
push eax
call fcn.00401200
lea eax, [ebp - 0xc74]
mov dword [ebp - 0xc74], 0xc
mov dword [ebp - 0xc6c], 0
test eax, eax
je 0x411219
push 0
lea eax, [ebp - 0xc70]
push eax
push 1
push 0x42eb48
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
push str.IEIsProtectedModeProcess
push str.ieframe
mov dword [ebp - 0xc5c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x411247
lea ecx, [ebp - 0xc5c]
push ecx
call eax
cmp dword [ebp - 0xc5c], 0
jne 0x4112f9
push 0
push 0x80
push 1
lea eax, [ebp - 0xc74]
push eax
push 0
push 0x10000000
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x42ff60
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0xc58]
push eax
call fcn.00417ca9
add esp, 0xc
test eax, eax
je 0x4112e6
lea eax, [ebp - 0xc78]
mov dword [ebp - 0xc5c], 1
push eax
lea eax, [ebp - 0xc68]
push eax
lea eax, [ebp - 0xc5c]
push eax
push dword [ebp - 0xc70]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
push 0
push dword [ebp - 0xc68]
lea eax, [ebp - 0x41c]
push 0
push 0
push 4
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov eax, dword [ebp - 0xc58]
test eax, eax
je 0x4112f9
push eax
call fcn.00417e24
add esp, 4
push dword [edi + 0x3c80]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call fcn.004174a1
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add esp, 4
mov esi, 2
push 0x42ff0c
call fcn.0040eaa0
add esp, 4
cmp eax, 2
jne 0x41133e
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416230
mov esp, ebp
pop ebp
ret
push 0x7d0
push dword [edi + 0x3c80]
call ebx
test eax, eax
jne 0x411484
lea eax, [ebp - 0x42c]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [eax*2 - 2]
cmp eax, 0x410
jae 0x4114b1
xor ecx, ecx
push str.Act.ws
mov word [ebp + eax - 0x42c], cx
lea eax, [ebp - 0x42c]
push 0x208
push eax
call fcn.00401200
push 0x42ff60
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0xc58]
push eax
call fcn.00417ca9
add esp, 0xc
mov byte [ebp - 8], 0
test eax, eax
jne 0x411478
push dword [ebp - 0xc58]
call fcn.00418e63
add esp, 4
lea ecx, [ebp - 0xc54]
call fcn.00411660
push eax
mov ecx, edi
call fcn.00410cb0
lea ebx, [edi + 0x3230]
mov ecx, edi
push ebx
call fcn.0040f860
mov eax, dword [ebp - 0xc64]
lea esi, [edi + 0x52c]
mov edi, dword [edi + 0x3c8c]
mov ecx, 0x277
rep movsd dword es:[edi], dword [esi]
mov edi, dword [eax + 0x3c8c]
mov ecx, 0x213
add edi, 0x9dc
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, eax
mov eax, dword [edi + 0x3c8c]
mov dword [eax], 3
push dword [ebp - 0xc58]
push 0x1a68
push 1
push dword [edi + 0x3c8c]
call fcn.00418de1
lea eax, [ebp - 0x1c]
push eax
push 0x1a68
push dword [edi + 0x3c8c]
call fcn.00410630
push dword [ebp - 0xc58]
lea eax, [ebp - 0x1c]
push 0x14
push 1
push eax
call fcn.00418de1
push dword [ebp - 0xc58]
call fcn.00417e24
add esp, 0x30
push dword [edi + 0x3c80]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x42ff68
call fcn.0040eaa0
add esp, 4
xor ecx, ecx
cmp eax, 2
mov eax, 2
cmove ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416230
mov esp, ebp
pop ebp
ret
call fcn.00416f80
int3