Function at 0x1002fd77
Capabilities:
Get file system object information
Get system information on windows

Disassembly:
mov eax, 0x1005db23
call fcn.1005c588
sub esp, 0x50
mov byte [ebp - 0x18], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1002ff59
test dl, dl
je 0x1002fe37
mov dword [ebp - 0x1c], 0x2f1c
cmp dword [ebp - 0x1c], 0x2fe8
jle 0x1002fdfe
push 0
push 0x66a
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [ebp - 0x44]
xor eax, esi
cdq
push edx
push eax
call fcn.10001abf
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002fdd9
mov eax, dword [eax]
push eax
call fcn.10044453
pop ecx
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.1000e569
inc edi
cmp edi, 0x7f2f
jl 0x1002fdc0
inc esi
cmp esi, 0x32dc
jl 0x1002fdbe
cmp dword [ebp - 0x1c], 0x2efc
jge 0x1002fe12
push str.vnjjtt_jmo_iydban_exab_rntzfizr_gzzhmq_rbqycqn_ytsljrjim_eazpmpit_djdhkc_uzvilwbl
call fcn.10044453
pop ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
cmp ecx, dword [eax]
je 0x1002fe26
mov ecx, dword [ebp + 0x20]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x686a
cmp dword [ebp - 0x20], 0x696a
jle 0x1002fe8f
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
and dword [ebp - 0x2c], 0
mov ebx, esi
mov esi, dword [ebp - 0x2c]
mov ecx, edi
sar ebx, cl
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x10079cf8
cdq
push edx
push eax
call fcn.1000dad0
inc esi
cmp esi, 0x320d
jl 0x1002fe5b
mov esi, dword [ebp - 0x1c]
inc edi
cmp edi, 0x2a7f
jl 0x1002fe4e
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x5407
jl 0x1002fe4c
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x6506
jge 0x1002feae
mov edx, str.qteru_ojkfdv_uyduy_jlpfyfey_qkhxbsn
mov ecx, 0x10079cf8
call fcn.1001081c
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], 0x7699
cmp dword [ebp - 0x20], 0x7869
jle 0x1002feec
xor esi, esi
xor edi, edi
mov eax, esi
mov ecx, 0x10079cf8
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.1000dad0
inc edi
cmp edi, 0x569d
jl 0x1002fec6
inc esi
cmp esi, 0x5eee
jl 0x1002fec4
mov dword [ebp - 4], 4
cmp dword [ebp - 0x20], 0x7680
jge 0x1002ff0b
mov edx, str.yphg_votxbafsy_tlavr_eqfkj_wdcvcakz_yddhj
mov ecx, 0x10079cf8
call fcn.1001081c
mov eax, dword [ebp + 0x1c]
mov esi, dword [eax]
mov eax, dword [ebp + 0x24]
mov edx, dword [eax]
mov eax, dword [ebp + 0x2c]
mov ecx, dword [eax]
mov eax, dword [ecx + esi*4]
mov dword [ecx + edx*4], eax
jmp 0x1002fe26
cmp byte [ebp + 0x18], 0
je 0x10030067
mov dword [ebp - 0x20], 0x109
cmp dword [ebp - 0x20], 0x1c0
jle 0x1002ffca
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x10079cf8
or eax, esi
cdq
push edx
push eax
call fcn.1000dad0
inc ebx
cmp ebx, 0x3744
jl 0x1002ff81
inc edi
cmp edi, 0x5329
jl 0x1002ff7f
inc esi
cmp esi, 0x6eb1
jl 0x1002ff7d
push 0x322
push 0x30f
push 0
push 0x145a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [ebp - 4], 6
cmp dword [ebp - 0x20], 0xfffffea4
jge 0x1002ffe9
mov edx, str.awk_sdry_uxgt_lnpzdd_excxg_fkygbvrv_lgmbzjxou
mov ecx, 0x10079cf8
call fcn.1001081c
mov esi, dword [ebp + 0x28]
or dword [ebp - 4], 0xffffffff
mov dword [esi], 0
jmp 0x1003005d
push 0
push 0x7c12
push 0x2dac
push 0
push 1
push 0x389d
push dword [ebp + 0x14]
mov dword [ebp - 0x24], 0xfffffffa
mov edx, 0xec4
mov ecx, 0x30aa
call fcn.1002ef7b
add esp, 0x1c
lea edx, [ebp - 0x24]
push 0x77c4
push ecx
push 0x26e8
push 1
call fcn.100301b9
add esp, 0x10
inc dword [esi]
cmp dword [esi], 0x1c
jge 0x10030012
jmp 0x1002fe26
mov dword [ebp - 0x2c], 0x77d0
cmp dword [ebp - 0x2c], 0x7a6d
jle 0x100300b4
xor esi, esi
xor edi, edi
xor ebx, ebx
lea ecx, [ebx + edi]
mov eax, esi
sar eax, cl
mov ecx, 0x10079cf8
cdq
push edx
push eax
call fcn.1000dad0
inc ebx
cmp ebx, 0x3adc
jl 0x1003007d
inc edi
cmp edi, 0x4ba0
jl 0x1003007b
inc esi
cmp esi, 0x6b5a
jl 0x10030079
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 0x28], 0x147d
cmp dword [ebp - 0x28], 0x17ce
jle 0x10030140
xor edi, edi
xor esi, esi
mov dword [ebp - 0x24], esi
xor eax, eax
mov dword [ebp - 0x20], 0x7c9a
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x1c]
xor ebx, ebx
mov eax, esi
lea ecx, [ebp - 0x5c]
xor eax, ebx
xor eax, edi
cdq
push edx
push eax
call fcn.10001abf
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100300f7
mov eax, dword [eax]
push eax
call fcn.10044453
pop ecx
push 0
push 1
lea ecx, [ebp - 0x5c]
call fcn.1000e569
inc ebx
cmp ebx, 0x3474
jl 0x100300dc
mov esi, dword [ebp - 0x24]
add dword [ebp - 0x1c], esi
dec dword [ebp - 0x20]
jne 0x100300d7
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x301c
jl 0x100300cb
inc edi
cmp edi, 0x516d
jl 0x100300c6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
cmp dword [ebp - 0x28], 0x119d
jge 0x10030154
push str.xnpusjof_fkc_atomtryy_zvw_xdh_tfbru_zmkqqo_omnjs_cmi_yaata_bdhxcjlc_woyoklj_sftfw_nsoon
call fcn.10044453
pop ecx
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10030177
push 0
push 0x1826
push 0x22e1
push 0x1a1c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x2c], 0x7452
jge 0x1002fe26
mov edx, str.nyqxxc_volzezqjx_iov_cnsnjneh_gzrxvpl_xnmm_bhz
mov ecx, 0x10079cf8
call fcn.1001081c
jmp 0x1002fe26