Function at 0x1003716f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac
mov eax, dword [0x1011d1c0]
xor eax, esp
mov dword [esp + 0xa8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
dec eax
push ebx
push esi
mov esi, dword [ebp + 0x1c]
push edi
cmp eax, 5
ja case.default.0x100370b0
jmp dword [eax*4 + 0x1003739c]
mov edx, dword [ebp + 0x10]
test edx, edx
jle case.default.0x100370b0
lfence
cmp eax, 3
ja case.default.0x100370ca
jmp dword [eax*4 + 0x100373b4]
mov ecx, 3
jmp 0x100370ef
mov ecx, 4
jmp 0x100370ef
mov ecx, 2
jmp 0x100370ef
mov ecx, 1
jmp 0x100370ef
xor ecx, ecx
mov al, byte [0x10121ad0]
push edx
mov edx, dword [0x10121ad4]
push ecx
push eax
push dword [ebp + 0x14]
mov ecx, 0x10121b38
call fcn.10042250
add esp, 0x10
test al, al
je case.default.0x100370b0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.100be435
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [ebp + 0x14]
lea eax, [esp + 0x11]
push ecx
mov ecx, dword [0x10121ad4]
push eax
call fcn.10042cd0
add esp, 8
test al, al
je case.default.0x100370b0
xor eax, eax
cmp byte [esp + 0x11], al
sete al
add eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.100be435
mov esp, ebp
pop ebp
ret 0x18
cmp dword [ebp + 0xc], 0
jle case.default.0x100370b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
test edi, edi
jne 0x100371ce
mov eax, dword [0x1011de3c]
cmp eax, 0x1011de3c
je case.default.0x100370b0
test byte [eax + 0x1c], 0x10
je case.default.0x100370b0
cmp byte [eax + 0x19], 2
jb case.default.0x100370b0
push dword [eax + 0x14]
mov edx, 0x10102e0c
mov ecx, 0xef
push dword [eax + 0x10]
call fcn.10022c70
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.100be435
mov esp, ebp
pop ebp
ret 0x18
push 0
push edi
mov ecx, esi
call fcn.1001eb70
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x100371e2
mov eax, dword [esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [edi - 1]
cmp eax, ecx
je 0x10037227
mov ecx, dword [0x1011de3c]
cmp ecx, 0x1011de3c
je case.default.0x100370b0
test byte [ecx + 0x1c], 0x10
je case.default.0x100370b0
cmp byte [ecx + 0x19], 2
jb case.default.0x100370b0
push eax
push edi
push dword [ecx + 0x14]
mov edx, 0x10102e0c
push dword [ecx + 0x10]
mov ecx, 0xf0
call fcn.10024380
add esp, 0x10
jmp case.default.0x100370b0
push 0
push eax
mov ecx, esi
call fcn.1001eb70
push 0
call fcn.100ce604
mov dword [esp + 0x18], eax
add esp, 4
mov dword [esp + 0x18], eax
xor edi, edi
xor bl, bl
mov dword [esp + 0x1c], edx
xor bh, bh
xor cl, cl
xor ch, ch
xor al, al
cmp edx, 7
jg 0x100372b3
jl 0x10037260
cmp dword [esp + 0x14], edi
ja 0x100372b3
lea eax, [esp + 0x18]
xor bh, bh
push eax
lea eax, [esp + 0x28]
mov byte [esp + 0x16], bh
push eax
xor edi, edi
xor bl, bl
call fcn.100ce36e
add esp, 8
test eax, eax
jne 0x100372ab
mov al, byte [esp + 0x2c]
movzx edi, word [esp + 0x38]
mov bl, byte [esp + 0x34]
mov bh, byte [esp + 0x30]
mov byte [esp + 0x12], al
mov al, byte [esp + 0x28]
mov cl, byte [esp + 0x12]
mov byte [esp + 0x11], al
mov al, byte [esp + 0x24]
mov ch, byte [esp + 0x11]
jmp 0x100372b3
mov cl, byte [esp + 0x12]
mov ch, cl
mov al, ch
movzx eax, al
inc bl
push eax
movzx eax, ch
xor edx, edx
push eax
movzx eax, cl
mov ecx, 0x64
push eax
movzx eax, bh
push eax
movzx eax, bl
push eax
lea eax, [edi + 0x76c]
movzx eax, ax
div ecx
lea eax, [esp + 0x5c]
push edx
push str.ESET__02d_02d_02d__02d_02d_02d_
push 0x32
push eax
call fcn.10053b30
add esp, 0x24
lea eax, [esp + 0x48]
mov ecx, esi
push eax
call fcn.10023ba0
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x10037306
mov eax, dword [esi]
mov edx, dword [ebp + 0x14]
mov ecx, dword [0x10121ad4]
push eax
call fcn.10043150
add esp, 4
test al, al
je case.default.0x100370b0
cmp dword [esi + 0x14], 7
mov ecx, esi
jbe 0x1003732a
mov ecx, dword [esi]
call fcn.1004f3f0
test eax, eax
je 0x1003737d
mov eax, dword [0x1011de3c]
cmp eax, 0x1011de3c
je case.default.0x100370b0
test byte [eax + 0x1c], 0x10
je case.default.0x100370b0
cmp byte [eax + 0x19], 2
jb case.default.0x100370b0
cmp dword [esi + 0x14], 7
jbe 0x1003735f
mov esi, dword [esi]
push esi
push dword [eax + 0x14]
mov edx, 0x10102e0c
mov ecx, 0xf1
push dword [eax + 0x10]
call fcn.10022c90
add esp, 0xc
jmp case.default.0x100370b0
mov ecx, dword [esp + 0xb4]
mov eax, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100be435
mov esp, ebp
pop ebp
ret 0x18