Function at 0x10003520
Capabilities:
Create directory
Get common file path
Query environment variable

Disassembly:
sub esp, 0x104
xor eax, eax
push ebx
push ebp
mov ebp, ecx
push esi
push edi
or ecx, 0xffffffff
lea esi, [ebp + 0xb008]
mov ebx, dword [sym.imp.SHELL32.dll_StrCmpNIA]
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str._DRIVERS_
push esi
call ebx
test eax, eax
jne 0x100035c9
call fcn.10016430
test eax, eax
je 0x10003597
lea esi, [ebp + 0xb408]
push 0x104
push esi
push 0x100bc438
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x3ff
push 0x100bc444
push esi
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0xc
mov byte [ebp + 0xb807], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x3ff
push str.drivers
push esi
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0xc
mov byte [ebp + 0xb407], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str._GWSEC_
push esi
call ebx
test eax, eax
jne 0x10003636
push 0x104
push esi
push 0x100bc46c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call fcn.10016430
test eax, eax
push 0x3ff
je 0x10003608
push str.SysWOW64
jmp 0x1000360d
push str._system32
push esi
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0xc
mov byte [ebp + 0xb407], 0
push 0x100c33ec
call fcn.1000bdd0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str._APP_
push esi
call ebx
test eax, eax
jne 0x10003847
mov ecx, 0x40
lea edi, [esp + 0x11]
mov byte [esp + 0x10], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.10016430
test eax, eax
lea eax, [esp + 0x10]
push 0x104
push eax
je 0x100037ae
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x100bc498
call edi
lea ecx, [esp + 0x10]
push 0x100c3418
push ecx
push 0x100bc4ac
push 0x400
push esi
call fcn.1000f0c0
mov ebx, dword [sym.imp.MSVCRT.dll__access]
push 0
push esi
call ebx
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x100036c8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
call fcn.10010d90
add esp, 4
push 0x100c351c
lea edx, [esp + 0x14]
push 0x100c3418
push edx
push 0x100bc4b4
push 0x400
push esi
call fcn.1000f0c0
push 0
push esi
call ebx
add esp, 0x20
cmp eax, 0xffffffff
jne 0x10003706
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
call fcn.10010d90
add esp, 4
lea eax, [esp + 0x10]
push 0x104
push eax
push str.ProgramW6432
call edi
lea ecx, [esp + 0x10]
push 0x100c3418
push ecx
lea edi, [ebp + 0xb408]
push 0x100bc4d0
push 0x400
push edi
call fcn.1000f0c0
push 0
push edi
call ebx
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x10003756
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
call fcn.10010d90
add esp, 4
push 0x100c351c
lea edx, [esp + 0x14]
push 0x100c3418
push edx
push 0x100bc4d8
push 0x400
push edi
call fcn.1000f0c0
push 0
push edi
call ebx
add esp, 0x20
cmp eax, 0xffffffff
jne 0x10003794
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
call fcn.10010d90
add esp, 4
push esi
call fcn.1000bd60
push edi
call fcn.1000bdd0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
push 0x100bc4e4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [esp + 0x10]
push 0x100c3418
push ecx
push 0x100bc4f4
push 0x400
push esi
call fcn.1000f0c0
mov edi, dword [sym.imp.MSVCRT.dll__access]
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x100037fa
push 0
push esi
call ebx
push esi
call fcn.10010d90
add esp, 4
push 0x100c351c
lea edx, [esp + 0x14]
push 0x100c3418
push edx
push str._s_s_s
push 0x400
push esi
call fcn.1000f0c0
push 0
push esi
call edi
add esp, 0x20
cmp eax, 0xffffffff
jne 0x10003834
push 0
push esi
call ebx
push esi
call fcn.10010d90
add esp, 4
push esi
call fcn.1000bd60
push 0x100c33f0
call fcn.1000bdd0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret