Function at 0x426be3
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
and byte [ebp - 0x14], 0
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x13]
and dword [ebp - 4], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
sub eax, dword [0x7f5508]
sub ebx, dword [str.Tb:]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub edx, dword [0x7f550c]
sub ecx, dword [0x7f5510]
inc edx
mov edx, edx
add ebx, dword [str.Tb:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
add edx, dword [0x7f550c]
lea ecx, [ecx]
lea eax, [ebp - 0x14]
push 0x8004b8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
sub eax, dword [0x7f5508]
sub ebx, dword [str.Tb:]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub edx, dword [0x7f550c]
sub ecx, dword [0x7f5510]
inc edx
mov edx, edx
add ebx, dword [str.Tb:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
add edx, dword [0x7f550c]
lea ecx, [ecx]
mov al, byte [0x7f5500]
push 5
push eax
push 0x7fdd40
call fcn.00412ef3
mov dword [0x7fdd30], eax
sub eax, dword [0x7f5508]
sub ebx, dword [str.Tb:]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub edx, dword [0x7f550c]
sub ecx, dword [0x7f5510]
inc edx
mov edx, edx
add ebx, dword [str.Tb:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
add edx, dword [0x7f550c]
lea ecx, [ecx]
push dword [0x7fdd30]
lea eax, [ebp - 0x14]
push eax
call fcn.00429240
sub eax, dword [0x7f5508]
sub ebx, dword [str.Tb:]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub edx, dword [0x7f550c]
sub ecx, dword [0x7f5510]
inc edx
mov edx, edx
add ebx, dword [str.Tb:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
add edx, dword [0x7f550c]
lea ecx, [ecx]
push dword [0x7fdd30]
call fcn.00428816
add esp, 0x18
sub eax, dword [0x7f5508]
sub ebx, dword [str.Tb:]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub edx, dword [0x7f550c]
sub ecx, dword [0x7f5510]
inc edx
mov edx, edx
add ebx, dword [str.Tb:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
add edx, dword [0x7f550c]
lea ecx, [ecx]
and dword [0x7fdd30], 0
sub eax, dword [0x7f5508]
sub ebx, dword [str.Tb:]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub edx, dword [0x7f550c]
sub ecx, dword [0x7f5510]
inc edx
mov edx, edx
add ebx, dword [str.Tb:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
add edx, dword [0x7f550c]
lea ecx, [ecx]
and byte [ebp - 0x118], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
sub eax, dword [0x7f5508]
sub ebx, dword [str.Tb:]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub edx, dword [0x7f550c]
sub ecx, dword [0x7f5510]
inc edx
mov edx, edx
add ebx, dword [str.Tb:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
add edx, dword [0x7f550c]
lea ecx, [ecx]
lea eax, [ebp - 0x118]
push 0x7f5808
push eax
call fcn.00429240
sub eax, dword [0x7f5508]
sub ebx, dword [str.Tb:]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub edx, dword [0x7f550c]
sub ecx, dword [0x7f5510]
inc edx
mov edx, edx
add ebx, dword [str.Tb:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
add edx, dword [0x7f550c]
lea ecx, [ecx]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00429240
sub eax, dword [0x7f5508]
sub ebx, dword [str.Tb:]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub edx, dword [0x7f550c]
sub ecx, dword [0x7f5510]
inc edx
mov edx, edx
add ebx, dword [str.Tb:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
add edx, dword [0x7f550c]
lea ecx, [ecx]
lea eax, [ebp - 0x118]
push eax
push 0x7ff93c
call fcn.00429230
add esp, 0x18
sub eax, dword [0x7f5508]
sub ebx, dword [str.Tb:]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub edx, dword [0x7f550c]
sub ecx, dword [0x7f5510]
inc edx
mov edx, edx
add ebx, dword [str.Tb:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
add edx, dword [0x7f550c]
lea ecx, [ecx]
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
lea eax, [ebp - 0x118]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
sub eax, dword [0x7f5508]
sub ebx, dword [str.Tb:]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub edx, dword [0x7f550c]
sub ecx, dword [0x7f5510]
inc edx
mov edx, edx
add ebx, dword [str.Tb:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
add edx, dword [0x7f550c]
lea ecx, [ecx]
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub eax, dword [0x7f5508]
sub ebx, dword [str.Tb:]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub edx, dword [0x7f550c]
sub ecx, dword [0x7f5510]
inc edx
mov edx, edx
add ebx, dword [str.Tb:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
add edx, dword [0x7f550c]
lea ecx, [ecx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub eax, dword [0x7f5508]
sub ebx, dword [str.Tb:]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub edx, dword [0x7f550c]
sub ecx, dword [0x7f5510]
inc edx
mov edx, edx
add ebx, dword [str.Tb:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
add edx, dword [0x7f550c]
lea ecx, [ecx]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret