Function at 0x1003bd8f
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov eax, 0x100636de
call fcn.10061a48
sub esp, 0x18
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, edx
je 0x1003bf25
mov dword [ebp - 0x1c], 0x3d88
cmp dword [ebp - 0x1c], 0x40f7
jle 0x1003be24
push 0x225e
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor esi, esi
mov edi, 0x1007d9f8
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0x18], 0x1625
xor ebx, ebx
mov eax, esi
mov ecx, edi
xor eax, ebx
cdq
push edx
push eax
call fcn.10004c38
inc ebx
cmp ebx, 0x4608
jl 0x1003bde6
mov ebx, dword [ebp - 0x14]
add esi, ebx
dec dword [ebp + 0x18]
jne 0x1003bde4
mov esi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x321b
jl 0x1003bdda
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x147d
jl 0x1003bdd5
jmp 0x1003be29
mov edi, 0x1007d9f8
cmp byte [ebp + 0x24], 0
je 0x1003be5a
mov edx, dword [ebp + 0x2c]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1003be52
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [edx]
cmp dword [edx], 3
jl 0x1003be40
push 2
pop esi
jmp 0x1003beee
mov dword [ebp + 0x18], 0x7dec
cmp dword [ebp + 0x18], 0x80de
jle 0x1003be90
xor esi, esi
xor ebx, ebx
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, edi
cdq
push edx
push eax
call fcn.10004c38
inc ebx
cmp ebx, 0x7aa0
jl 0x1003be6e
inc esi
cmp esi, 0x398d
jl 0x1003be6c
and dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0x7b80
jge 0x1003beca
mov edx, str.pljbgln_erxxp_zfkkza_jbl_istmqx
mov ecx, edi
call fcn.100070aa
jmp 0x1003beca
mov edx, dword [ebp + 0x10]
push 2
pop esi
mov dword [edx], 0
cmp dword [edx], esi
jge 0x1003beee
mov ebx, dword [ebp + 0x30]
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], esi
jl 0x1003bedd
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], 0x3d1f
jge 0x1003bf06
mov edx, str.nirbcmqld_eltdhvwu_ndlgufqkg
mov ecx, edi
call fcn.100070aa
jmp 0x1003bfea
cmp byte [ebp + 0x20], 0
je 0x1003bf32
dec dword [ecx]
jmp 0x1003bfea
mov ecx, dword [ebp + 0x3c]
mov ebx, dword [ebp + 0x28]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ebp + 0x40]
mov eax, dword [eax]
dec dword [ebx]
mov eax, dword [edi]
mov eax, dword [ebx]
dec eax
je 0x1003bf57
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
je 0x1003bf57
xor eax, eax
inc eax
jmp 0x1003bf59
xor eax, eax
imul ecx, eax, 0x5fffa
xor edx, edx
mov eax, dword [ebp + 0x1c]
push 2
pop esi
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [edi]
setg dl
xor ecx, ecx
cmp edx, esi
mov edx, dword [ebp + 0xc]
setg cl
sub eax, ecx
mov ecx, dword [ebp + 0x38]
mov dword [edx], eax
mov eax, dword [edx]
mov ecx, dword [ecx]
add eax, dword [ecx + 0xc]
xor ecx, ecx
cmp eax, 0x7777bab6
mov eax, dword [ebp + 0x44]
setne cl
cmp dword [eax], ecx
jg 0x1003bf9b
mov eax, dword [edi]
mov edx, dword [ebp + 0x40]
xor ecx, ecx
mov eax, dword [edx]
mov eax, dword [ebp + 0x38]
mov eax, dword [eax]
cmp dword [eax + 4], ecx
mov eax, dword [ebp + 0x34]
setne cl
cmp esi, ecx
mov dword [eax], ecx
sbb eax, eax
inc eax
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
sub eax, dword [edx]
je 0x1003bfc5
mov eax, dword [ebx]
mov eax, dword [edi]
xor ecx, ecx
mov ebx, dword [ebp + 0x38]
mov eax, dword [edi]
mov edx, dword [ebx]
cmp eax, dword [edx + 4]
mov eax, dword [ebp + 0x1c]
setg cl
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [eax]
cmp eax, 6
mov eax, dword [ebx]
sete cl
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret