Function at 0x10035ab0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10056aa6
push eax
mov dword fs:[0], esp
sub esp, 0x22c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x248]
test esi, esi
push edi
je 0x10035e7f
mov ebp, dword [esp + 0x250]
test ebp, ebp
je 0x10035e7f
mov edi, dword [esp + 0x254]
test edi, edi
je 0x10035e7f
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
cmp eax, edi
mov dword [esp + 0x10], eax
jb 0x10035b22
mov dword [0x10071f04], 0xea
push 0xea
jmp 0x10035e8b
mov ebx, dword [sym.imp.MSVCRT.dll_wcscpy]
push esi
push ebp
call ebx
mov ax, word [esi]
add esp, 8
cmp ax, 0x5c
jne 0x10035dc8
mov edi, dword [sym.imp.MSVCRT.dll__wcsnicmp]
push 0xc
push str.SystemRoot_
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x10035c1f
mov ecx, 0x81
lea edi, [esp + 0x36]
mov word [esp + 0x34], ax
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x38]
add esi, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x10035bfa
lea ecx, [esp + 0x34]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x10035b99
mov word [eax], 0
lea edx, [esp + 0x34]
test edx, edx
je 0x10035bf3
test esi, esi
mov edi, 0x7a
je 0x10035bcb
mov ecx, dword [esp + 0x254]
lea eax, [esp + 0x34]
push esi
push eax
push 0x100619dc
push ecx
push ebp
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
xor edi, edi
jmp 0x10035c02
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ecx, dword [esp + 0x258]
add esp, 4
cmp ecx, eax
jbe 0x10035c02
lea eax, [esp + 0x34]
push eax
push ebp
call ebx
add esp, 8
xor edi, edi
jmp 0x10035c02
mov edi, 0x57
jmp 0x10035c02
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
mov dword [0x10071f04], edi
je 0x10035c13
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test edi, edi
sete al
jmp 0x10035e93
push 8
push str.__UNC_
push esi
call edi
add esp, 0xc
test eax, eax
je 0x10035dad
push 8
push str._UNC_
push esi
call edi
add esp, 0xc
test eax, eax
je 0x10035dad
push 8
push str..UNC_
push esi
call edi
add esp, 0xc
test eax, eax
je 0x10035dad
push 4
push str.___
push esi
call edi
add esp, 0xc
test eax, eax
je 0x10035d7e
push 4
push str.__
push esi
call edi
add esp, 0xc
test eax, eax
je 0x10035d7e
push 4
push str.._
push esi
call edi
add esp, 0xc
test eax, eax
je 0x10035d7e
push 0x10
push str.DeviceHarddisk
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x10035e1d
lea ecx, [esp + 0x24]
call fcn.10021bc0
xor ebx, ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x244], ebx
call fcn.10021bc0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x24]
push ecx
push edx
mov byte [esp + 0x24c], 1
call fcn.10050fe0
mov eax, dword [esp + 0x20]
add esp, 8
test eax, eax
jle 0x10035d54
mov eax, dword [esp + 0x14]
mov eax, dword [eax + ebx*4]
mov edi, dword [eax - 8]
test edi, edi
jbe 0x10035d0d
push edi
push esi
push eax
call dword [sym.imp.MSVCRT.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x10035d18
mov eax, dword [esp + 0x18]
inc ebx
cmp ebx, eax
jl 0x10035cef
jmp 0x10035d54
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ecx, dword [esp + 0x258]
sub eax, edi
add eax, 2
add esp, 4
cmp eax, ecx
jae 0x10035d54
mov ecx, dword [esp + 0x24]
push 2
mov ebx, dword [ecx + ebx*4]
push ebx
push ebp
call dword [sym.imp.MSVCRT.dll_wcsncpy]
lea edx, [esi + edi*2]
lea eax, [ebp + 4]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 0x14
lea ecx, [esp + 0x14]
mov byte [esp + 0x244], 0
call fcn.10021bd0
lea ecx, [esp + 0x24]
mov dword [esp + 0x244], 0xffffffff
call fcn.10021bd0
jmp 0x10035e1d
cmp dword [esp + 0x10], 7
jb 0x10035d9f
cmp word [esi + 0xa], 0x3a
jne 0x10035d9f
cmp word [esi + 0xc], 0x5c
jne 0x10035d9f
add esi, 8
push esi
push ebp
call ebx
add esp, 8
jmp 0x10035e1d
mov word [ebp + 2], 0x5c
mov word [ebp + 4], 0x2e
jmp 0x10035e1d
add esi, 0x10
lea ecx, [ebp + 4]
push esi
push ecx
mov word [ebp], 0x5c
mov word [ebp + 2], 0x5c
call ebx
add esp, 8
jmp 0x10035e1d
cmp ax, 0x25
jne 0x10035e1d
lea edi, [esi + 2]
push 0x25
push edi
call dword [sym.imp.MSVCRT.dll_wcschr]
push 0x5c
push edi
mov ebx, eax
call dword [sym.imp.MSVCRT.dll_wcschr]
add esp, 0x10
test ebx, ebx
je 0x10035e1d
test eax, eax
je 0x10035e1d
cmp ebx, eax
jae 0x10035e1d
mov edi, dword [esp + 0x254]
lea edx, [edi - 1]
push edx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x10035e91
cmp eax, 0x104
jae 0x10035e91
mov word [ebp + edi*2 - 2], 0
push ebp
call fcn.10036920
add esp, 4
test eax, eax
je 0x10035e78
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x36]
mov word [esp + 0x34], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x34]
push 0x104
push eax
push ebp
call fcn.100365e0
add esp, 0xc
test eax, eax
je 0x10035e78
mov esi, dword [esp + 0x254]
lea edx, [esp + 0x34]
lea ecx, [esi - 1]
push ecx
push edx
push ebp
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
mov word [ebp + esi*2 - 2], 0
mov eax, 1
jmp 0x10035e93
mov dword [0x10071f04], 0x57
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x238
ret