Function at 0x100295b0
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x18c
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x188], eax
push ebx
push ebp
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
xor ebx, ebx
cmp ebp, ebx
jne 0x100295f4
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x188]
xor ecx, esp
call fcn.100d0738
add esp, 0x18c
ret
mov ecx, dword [0x101e2d1c]
cmp ecx, ebx
je 0x1002960d
mov eax, dword [ecx]
mov edx, dword [eax + 8]
push 1
call edx
mov dword [0x101e2d1c], ebx
push esi
push 0x58
call fcn.100d164d
add esp, 4
cmp eax, ebx
je 0x10029627
push ebx
push ebx
mov esi, eax
call fcn.10029070
jmp 0x10029629
xor eax, eax
push edi
push ebx
mov dword [0x101e2d1c], eax
push 0x1a
lea eax, [esp + 0x9c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [esp + 0x10]
mov ecx, 0x104
lea edx, [esp + 0x94]
call fcn.10004070
test eax, eax
jl 0x10029676
mov eax, dword [esp + 0x10]
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax + 0x94]
mov eax, str.360Decryptor_PrivateKey.ini
call fcn.100040d0
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x94]
push ecx
push 0x400
push ebp
push 0x10128b0a
push str.userkey
push 0x1012c9a0
call edi
and eax, 0xfffffffe
cmp eax, 0x40
je 0x100296ca
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [0x101e2d1c]
cmp ecx, ebx
je 0x100296c3
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push 1
call eax
mov dword [0x101e2d1c], ebx
xor eax, eax
jmp 0x1002989a
xor edx, edx
lea esp, [esp]
mov al, byte [ebp + edx*2]
cmp al, 0x30
jb 0x100296e4
cmp al, 0x39
ja 0x100296e4
movzx eax, al
sub eax, 0x30
jmp 0x10029706
cmp al, 0x61
jb 0x100296f4
cmp al, 0x66
ja 0x100296f4
movzx eax, al
sub eax, 0x57
jmp 0x10029706
cmp al, 0x41
jb 0x10029704
cmp al, 0x46
ja 0x10029704
movzx eax, al
sub eax, 0x37
jmp 0x10029706
xor eax, eax
mov cl, byte [ebp + edx*2 + 1]
cmp cl, 0x30
jb 0x1002971c
cmp cl, 0x39
ja 0x1002971c
movzx ecx, cl
sub ecx, 0x30
jmp 0x10029742
cmp cl, 0x61
jb 0x1002972e
cmp cl, 0x66
ja 0x1002972e
movzx ecx, cl
sub ecx, 0x57
jmp 0x10029742
cmp cl, 0x41
jb 0x10029740
cmp cl, 0x46
ja 0x10029740
movzx ecx, cl
sub ecx, 0x37
jmp 0x10029742
xor ecx, ecx
shl al, 4
add al, cl
mov byte [esp + edx + 0x14], al
inc edx
cmp edx, 0x20
jl 0x100296d0
mov ebx, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
mov esi, dword [0x101e2d1c]
push 0x20
lea ecx, [esp + 0x18]
push ecx
call ebx
test eax, eax
jne 0x10029781
push 0x20
lea edx, [esp + 0x18]
push edx
add esi, 0x1c
push esi
call fcn.100d0e10
add esp, 0xc
lea eax, [esp + 0x94]
push eax
push 0x400
push ebp
push 0x10128b0a
push str.userIV
push 0x1012c9a0
call edi
and eax, 0xfffffffe
cmp eax, 0x20
je 0x100297d3
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [0x101e2d1c]
test ecx, ecx
je 0x100297cc
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push 1
call eax
mov dword [0x101e2d1c], 0
xor eax, eax
jmp 0x1002989a
xor edx, edx
mov al, byte [ebp + edx*2]
cmp al, 0x30
jb 0x100297e9
cmp al, 0x39
ja 0x100297e9
movzx eax, al
sub eax, 0x30
jmp 0x1002980b
cmp al, 0x61
jb 0x100297f9
cmp al, 0x66
ja 0x100297f9
movzx eax, al
sub eax, 0x57
jmp 0x1002980b
cmp al, 0x41
jb 0x10029809
cmp al, 0x46
ja 0x10029809
movzx eax, al
sub eax, 0x37
jmp 0x1002980b
xor eax, eax
mov cl, byte [ebp + edx*2 + 1]
cmp cl, 0x30
jb 0x10029821
cmp cl, 0x39
ja 0x10029821
movzx ecx, cl
sub ecx, 0x30
jmp 0x10029847
cmp cl, 0x61
jb 0x10029833
cmp cl, 0x66
ja 0x10029833
movzx ecx, cl
sub ecx, 0x57
jmp 0x10029847
cmp cl, 0x41
jb 0x10029845
cmp cl, 0x46
ja 0x10029845
movzx ecx, cl
sub ecx, 0x37
jmp 0x10029847
xor ecx, ecx
shl al, 4
add al, cl
mov byte [esp + edx + 0x14], al
inc edx
cmp edx, 0x10
jl 0x100297d5
mov esi, dword [0x101e2d1c]
push 0x10
lea ecx, [esp + 0x18]
push ecx
call ebx
test eax, eax
jne 0x10029884
push 0x10
lea edx, [esp + 0x18]
push edx
lea eax, [esi + 0x3c]
push eax
call fcn.100d0e10
add esp, 0xc
mov byte [esi + 0x4c], 1
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [0x101e2d1c]
mov byte [ecx + 0x4c], 1
mov eax, 1
mov ecx, dword [esp + 0x198]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x18c
ret