Function at 0x1003d260
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov ecx, eax
mov dl, 1
mov esi, dword [0x101537c8]
mov edi, dword [0x101537c4]
mov ebx, esi
sub ebx, 0x5d4be7d3
sub ebx, 1
add ebx, 0x5d4be7d3
imul esi, ebx
and esi, 1
cmp esi, 0
sete dh
cmp edi, 0xa
setl bl
mov bh, dh
xor bh, 1
mov dword [ebp - 0x10], eax
mov al, bl
xor al, 1
xor dl, 1
mov ah, bh
and ah, 1
and dh, dl
mov byte [ebp - 0x11], al
and al, 1
and bl, dl
or ah, dh
or al, bl
xor ah, al
mov al, byte [ebp - 0x11]
or bh, al
xor bh, 1
or dl, 1
and bh, dl
or ah, bh
test ah, 1
mov dword [ebp - 0x18], ecx
jne 0x1003d2ee
jmp 0x1003d5c3
mov eax, 0x208
call fcn.1001fcd0
mov eax, esp
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], eax
mov dword [ecx], 0x104
mov ecx, dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x1c], eax
call ecx
mov dl, 1
mov ecx, 0
cmp eax, 0
setne dh
mov eax, dword [0x101537c8]
mov esi, dword [0x101537c4]
sub ecx, 1
mov edi, eax
add edi, ecx
imul eax, edi
and eax, 1
cmp eax, 0
sete bl
cmp esi, 0xa
setl bh
mov al, bl
xor al, 1
mov ah, bh
xor ah, 1
xor dl, 1
mov cl, al
and cl, 1
and bl, dl
mov ch, ah
and ch, 1
and bh, dl
or cl, bl
or ch, bh
xor cl, ch
or al, ah
xor al, 1
or dl, 1
and al, dl
or cl, al
test cl, 1
mov byte [ebp - 0x1d], dh
jne 0x1003d38c
jmp 0x1003d5c3
mov al, byte [ebp - 0x1d]
test al, 1
jne 0x1003d39c
jmp 0x1003d4a3
mov al, 1
mov ecx, dword [0x101537c8]
mov edx, dword [0x101537c4]
mov esi, ecx
add esi, 0x6416de9d
sub esi, 1
sub esi, 0x6416de9d
imul ecx, esi
and ecx, 1
cmp ecx, 0
sete ah
cmp edx, 0xa
setl bl
mov bh, ah
xor bh, 1
mov cl, bl
xor cl, 1
xor al, 0
mov ch, bh
and ch, 0
and ah, al
mov dl, cl
and dl, 0
and bl, al
or ch, ah
or dl, bl
xor ch, dl
or bh, cl
xor bh, 1
or al, 0
and bh, al
or ch, bh
test ch, 1
jne 0x1003d412
jmp 0x1003d5ec
sub esp, 4
mov eax, esp
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
call fcn.1002cf80
mov dl, 1
mov ecx, dword [0x101537c8]
mov esi, dword [0x101537c4]
mov edi, ecx
sub edi, 0x35222c57
sub edi, 1
add edi, 0x35222c57
imul ecx, edi
and ecx, 1
cmp ecx, 0
sete dh
cmp esi, 0xa
setl bl
mov bh, dh
xor bh, 1
mov cl, bl
xor cl, 1
xor dl, 1
mov ch, bh
and ch, 1
and dh, dl
mov dword [ebp - 0x24], eax
mov al, cl
and al, 1
and bl, dl
or ch, dh
or al, bl
xor ch, al
or bh, cl
xor bh, 1
or dl, 1
and bh, dl
or ch, bh
test ch, 1
jne 0x1003d49e
jmp 0x1003d5ec
jmp 0x1003d5b8
sub esp, 0xc
mov eax, esp
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x104
mov dword [eax], str.TEMP
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
call eax
cmp eax, 0
je 0x1003d4e7
sub esp, 4
mov eax, esp
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
call fcn.1002cf80
mov dword [ebp - 0x28], eax
jmp 0x1003d5b8
mov eax, 0
mov ecx, dword [0x101537c8]
mov edx, dword [0x101537c4]
sub eax, 1
mov esi, ecx
add esi, eax
imul ecx, esi
and ecx, 1
cmp ecx, 0
sete bl
cmp edx, 0xa
setl bh
mov al, bl
and al, bh
xor bl, bh
or al, bl
test al, 1
jne 0x1003d531
jmp 0x1003d606
mov ecx, dword [ebp - 0x10]
call fcn.1007ddf0
mov dl, 1
mov ecx, dword [0x101537c8]
mov esi, dword [0x101537c4]
mov edi, ecx
add edi, 0x1fdc8c42
sub edi, 1
sub edi, 0x1fdc8c42
imul ecx, edi
and ecx, 1
cmp ecx, 0
sete dh
cmp esi, 0xa
setl bl
mov bh, dh
xor bh, 1
mov cl, bl
xor cl, 1
xor dl, 0
mov ch, bh
and ch, 0
and dh, dl
mov dword [ebp - 0x2c], eax
mov al, cl
and al, 0
and bl, dl
or ch, dh
or al, bl
xor ch, al
or bh, cl
xor bh, 1
or dl, 0
and bh, dl
or ch, bh
test ch, 1
jne 0x1003d5b3
jmp 0x1003d606
jmp 0x1003d5b8
mov eax, dword [ebp - 0x18]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 0x208
call fcn.1001fcd0
mov eax, esp
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], eax
mov dword [ecx], 0x104
mov eax, dword [sym.imp.KERNEL32.dll_GetTempPathW]
call eax
mov dword [ebp - 0x30], eax
jmp 0x1003d2ee
sub esp, 4
mov eax, esp
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
call fcn.1002cf80
mov dword [ebp - 0x34], eax
jmp 0x1003d412
mov ecx, dword [ebp - 0x10]
call fcn.1007ddf0
mov dword [ebp - 0x38], eax
jmp 0x1003d531