Function at 0x10002fb0
Capabilities:
Get common file path
Log keystrokes

Disassembly:
mov eax, 0x10063772
call fcn.100630d8
sub esp, 0x128
push ebx
mov dword [ebp - 0x1c], 0x1ac6
cmp dword [ebp - 0x1c], 0x5b5
push esi
push edi
mov dword [ebp - 0x18], edx
jge 0x10003084
jmp 0x1000306a
lea eax, [ebp - 0x134]
push eax
push 0x1006ce64
call fcn.1004c36b
lea eax, [ebp - 0x134]
push eax
call fcn.1004c2e0
mov ecx, dword [ebp - 0x30]
xor edx, edx
div ecx
add esp, 0xc
xor edi, edi
mov ebx, eax
test ecx, ecx
jle 0x1000305f
xor esi, esi
test ebx, ebx
jle 0x1000305a
mov eax, esi
and eax, 0x80000001
jns 0x10003022
dec eax
or eax, 0xfffffffe
inc eax
jne 0x10003035
mov eax, esi
imul eax, ecx
add eax, edi
movsx eax, byte [ebp + eax - 0x134]
jmp 0x10003045
lea eax, [esi + 1]
imul eax, ecx
sub eax, edi
movsx eax, byte [ebp + eax - 0x135]
push eax
push 0x1006ce68
call fcn.1004c653
pop ecx
inc esi
pop ecx
mov ecx, dword [ebp - 0x30]
cmp esi, ebx
jl 0x10003014
inc edi
cmp edi, ecx
jl 0x1000300e
push 0x1006ce6c
call fcn.1004c653
pop ecx
lea eax, [ebp - 0x30]
push eax
push 0x1006ca80
call fcn.1004c36b
cmp dword [ebp - 0x30], 0
pop ecx
pop ecx
jne 0x10002fdf
cmp byte [ebp + 0x1c], 0
je 0x10003531
mov dword [ebp - 0x1c], 0x9ac78948
xor ebx, ebx
mov dword [ebp - 0x1c], 0
inc ebx
mov dword [ebp - 0x1c], 0x95768819
mov dword [ebp - 0x1c], 0xb5c6f8b8
mov dword [ebp - 0x1c], 0xa592
mov dword [ebp - 0x1c], 0x2632c5b6
mov dword [ebp - 0x1c], 0xcefbde28
push 2
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0
pop ecx
jmp 0x100030e2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8c], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100030d1
inc dword [ebp - 0x14]
xor eax, eax
and dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
and dword [ebp - 4], eax
push ecx
push eax
push ecx
lea eax, [ebp - 0x70]
push eax
push ecx
push ecx
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x3e6c
call fcn.10002ec9
mov eax, dword [0x1035e90c]
add esp, 0x24
test al, 1
jne 0x10003146
or eax, ebx
mov dword [0x1035e90c], eax
push 0x160ef
mov byte [ebp - 4], bl
call fcn.100147dc
mov word [0x1035e910], ax
mov byte [ebp - 4], 0
mov eax, dword [0x1035e90c]
pop ecx
test al, 2
jne 0x1000316c
push 2
pop ecx
or eax, ecx
mov dword [0x1035e90c], eax
push 0x19f32
mov byte [ebp - 4], cl
call fcn.100147dc
pop ecx
mov word [0x1035e908], ax
mov byte [ebp - 4], 0
mov dword [ebp - 0x18], 0x6575
cmp dword [ebp - 0x18], 0x67a0
jle 0x100031d7
push 0x56a
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor esi, esi
mov dword [ebp - 0x14], esi
mov edi, esi
mov esi, 0x5b98
mov eax, edi
lea ecx, [ebp - 0xd4]
cdq
push edx
push eax
call fcn.10001ab5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100031af
mov eax, dword [eax]
push eax
call fcn.1004c653
pop ecx
push 0
push ebx
lea ecx, [ebp - 0xd4]
call fcn.100050bb
dec edi
dec esi
jne 0x10003195
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x6c2b
jl 0x1000318e
cmp dword [ebp - 0x18], 0x6206
jge 0x100031eb
push str.orufs_xno_trepd_ewggluhn_osrnq_mpi_uihqmvr_kgehczg_xkviyiph_kbrt_qqq
call fcn.1004c653
pop ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
jmp 0x1000320d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x78], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100031ff
push 0xb31
push 0x5d19
push 0x1def
push ecx
mov byte [ebp - 0x2b], cl
lea edx, [ebp - 0x2b]
push ebx
mov ecx, 0x7579
call fcn.10002d5e
add esp, 0x14
mov dword [ebp - 0x18], 0
jmp 0x10003294
push ecx
push ecx
push ebx
push ecx
mov dword [ebp - 0x14], 0x951fe77d
lea ecx, [ebp - 0x2a]
mov byte [ebp - 0x2a], 0
mov edx, 0x2503
call fcn.100029b7
mov dword [ebp - 0x14], 0
add esp, 0x10
cmp dword [ebp - 0x14], 0
jl 0x10003291
push ecx
push ecx
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0xb8f3
push eax
call fcn.10003ac9
add esp, 0xc
mov edx, 0x2aa5
xor cl, cl
call fcn.10003b2e
dec dword [ebp - 0x14]
jns 0x1000326b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0
jle 0x1000323f
lea eax, [ebp - 0x70]
push eax
push 0
push 0x1035e910
push ecx
push ecx
push 0x1035e908
lea edx, [ebp + 0xc]
call fcn.100029da
add esp, 0x18
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x28], 0x590f0234
lea ecx, [ebp - 0x40]
push ebx
call fcn.10004d6b
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 5
push eax
push ecx
lea eax, [ebp - 0x74]
mov dword [ebp - 0x34], ebx
push eax
mov dl, bl
call fcn.10002dad
mov eax, dword [ebp - 0x24]
add esp, 0xc
cmp dword [ebp - 0x24], 0
jne 0x10003305
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x24]
jle 0x10003305
xor edx, edx
jmp 0x10003307
mov edx, ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
cmp dword [ebp - 0x28], ecx
je 0x100033d8
mov dword [ebp - 0x18], 2
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jg 0x100033a2
jmp 0x10003341
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x58], 0xf1d65f4e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10003333
mov dword [ebp - 0x28], ecx
jmp 0x10003389
mov dword [ebp - 0x14], 0x196e86ff
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x58], ecx
jne 0x10003373
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x18], 6
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff9
jle 0x1000334c
jmp 0x100033b4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x84], 0xaf1ba137
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10003391
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x28], eax
push ecx
push ebx
push ecx
push 0x6da6
push ecx
push ecx
push 0x1d59
push ecx
lea eax, [ebp - 0x29]
mov byte [ebp - 0x29], cl
push eax
call fcn.10002ec9
add esp, 0x24
jmp 0x10003501
mov dword [ebp - 0x20], 0x689bb5c1
mov dword [ebp - 0x18], 0x6f38f68c
mov dword [ebp - 0x1c], 0x31764c7f
mov dword [ebp - 0x1c], 0xc8d4e572
push 2
mov dword [ebp - 0x14], ecx
pop ecx
jmp 0x1000340a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x48], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100033fc
push ecx
lea eax, [ebp - 0x24]
push eax
push ecx
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push 0x7e36
push eax
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x20]
call fcn.10002c3d
mov eax, dword [ebp - 0x40]
xor ecx, ecx
add esp, 0x1c
mov esi, dword [eax]
mov eax, dword [ebp - 0x20]
cmp eax, esi
setl cl
xor edx, edx
cmp ecx, esi
setg dl
xor eax, eax
cmp edx, 0x7a7558cd
setle al
cmp eax, 0xfffffff6
jg 0x1000345a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp dword [eax], 0x3475f540
setl cl
cmp ecx, 0x99b6
jle 0x10003476
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
push 2
pop ecx
sub ecx, eax
cmp ecx, 0xfffffff9
je 0x10003495
mov eax, dword [ebp - 0x40]
cmp dword [eax], 0
jne 0x10003495
xor esi, esi
jmp 0x10003497
mov esi, ebx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
neg esi
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x24]
cmp esi, eax
mov eax, dword [ebp - 0x20]
setg cl
imul eax, ecx
cmp edx, eax
jg 0x100034be
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
test eax, eax
mov eax, dword [ebp - 0x40]
setle cl
xor edx, edx
cmp ecx, dword [eax]
setle dl
xor eax, eax
test edx, edx
sets al
cmp eax, dword [ebp - 0x34]
jl 0x100034f1
cmp dword [ebp - 0x48], 0
jne 0x100034f1
xor ecx, ecx
jmp 0x100034f3
mov ecx, ebx
mov eax, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.10004dc8
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x70]
cmp ecx, eax
je 0x10003521
push 0xffffffffffffffff
push 0
push eax
call fcn.100050ff
push 0
push ebx
lea ecx, [ebp - 0x70]
call fcn.1000522d
jmp 0x10003667
mov dword [ebp - 0x1c], 0x55a5
cmp dword [ebp - 0x1c], 0x5708
push 1
pop ebx
jle 0x10003592
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0xa4]
push edx
push eax
call fcn.10001ab5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000356b
mov eax, dword [eax]
push eax
call fcn.1004c653
pop ecx
push 0
push ebx
lea ecx, [ebp - 0xa4]
call fcn.100050bb
inc edi
cmp edi, 0x7680
jl 0x10003550
inc esi
cmp esi, 0x5780
jl 0x1000354e
cmp dword [ebp - 0x1c], 0x5512
jge 0x100035a6
push str.czhnlpo_iwa_lvcfvdiuu_btmaug_qujkprj_oqocoxvvy_vnvhhcgv_ovaxzabt_tyqkhkrkp_txtsxx_vqkckybv_didepqyx_xtg_putkgn
call fcn.1004c653
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x1f3d
cmp dword [ebp - 0x14], 0x1fd3
jle 0x10003622
push ebx
push 0
push 0
call dword [sym.imp.USER32.dll_AttachThreadInput]
xor esi, esi
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0xbc]
xor eax, esi
cdq
push edx
push eax
call fcn.10001ab5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100035ec
mov eax, dword [eax]
push eax
call fcn.1004c653
pop ecx
push 0
push ebx
lea ecx, [ebp - 0xbc]
call fcn.100050bb
mov ecx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x2066
jl 0x100035ce
inc edi
cmp edi, 0x6b56
jl 0x100035c9
inc esi
cmp esi, 0x2dcf
jl 0x100035c7
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [edx]
cmp eax, ebx
mov eax, dword [edx]
setne cl
xor edx, edx
add ecx, 0x89a6
cmp ecx, eax
mov eax, dword [ebp + 0x18]
setge dl
xor ecx, ecx
mov eax, dword [eax]
add eax, 0xb7ce
cmp eax, edx
mov eax, dword [ebp - 0x18]
setle cl
mov dword [eax], ecx
cmp dword [ebp - 0x14], 0x1eb8
jge 0x10003667
push str.wuvvvcchi_ntlzhzs_fsxse_ohqmqmg_kivu_bsaumwibq_atjysxyvk_zszg_qzzktknyo
call fcn.1004c653
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret