Function at 0x10012c27
Capabilities:
Get common file path
Get graphical window text

Disassembly:
mov eax, 0x1005fe55
call fcn.1005f130
sub esp, 0x84
push ebx
push esi
mov dword [ebp - 0x1c], 0x5eb0
xor ebx, ebx
cmp dword [ebp - 0x1c], 0x5f9c
push edi
mov dword [ebp - 0x10], esp
jle 0x10012cb4
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov dword [ebp - 0x18], ebx
mov eax, esi
mov esi, ebx
cdq
idiv edi
mov edi, edx
mov eax, edi
lea ecx, [ebp - 0x78]
or eax, esi
cdq
push edx
push eax
call fcn.10001a75
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10012c7b
mov eax, dword [eax]
push eax
call fcn.10048743
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x78]
call fcn.10004a80
inc esi
cmp esi, 0x62ae
jl 0x10012c62
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x3b5a
jl 0x10012c59
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x2d47
jl 0x10012c54
cmp dword [ebp - 0x1c], 0x5c68
jge 0x10012cc8
push str.cadacgg_rhtum_hqyrio_gwvyv_rzkwmc_khx_sonjgrc_shkumggt_kbmb_fyqurb_hhyj_bvl_koq_xjxly
call fcn.10048743
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x10012d65
sub esp, 0x18
mov ecx, esp
push dword [ebp + 0x14]
call fcn.100045a4
lea ecx, [ebp - 0x3c]
call fcn.10012659
add esp, 0x18
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x3c], eax
je 0x10012d5e
push dword [ebp - 0x28]
xor ecx, ecx
mov dword [ebp - 0x4c], 7
push eax
push dword [ebp - 0x3c]
mov word [ebp - 0x60], cx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x50], ebx
call fcn.10018615
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x60]
mov byte [ebp - 4], 3
call fcn.10012bcd
lea ecx, [ebp - 0x60]
push ebx
push 1
test eax, eax
jns 0x10012d59
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
call fcn.10004bf2
lea ecx, [ebp - 0x3c]
call fcn.1001625e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10004bf2
mov eax, dword [ebp + 0xc]
mov byte [eax], bl
jmp 0x10012d40
mov dword [ebp - 0x18], 0x80e3580d
mov dword [ebp - 0x14], ebx
jmp 0x10012d7f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x48], 0x2e0cf572
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10012d71
push 2
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x10012d9b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x30], 0xf94f378
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10012d8d
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], ebx
jl 0x10012eab
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x1c], 0xcd
cmp dword [ebp - 0x1c], 0x108
jle 0x10012e41
push 0x65a
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x1007bf18
and eax, edi
cdq
push edx
push eax
call fcn.1000448f
inc ebx
cmp ebx, 0x4a9e
jl 0x10012ddd
inc esi
push 0
pop ebx
cmp esi, 0x46f2
jl 0x10012dda
inc edi
cmp edi, 0x6231
jl 0x10012dd8
push ebx
push 0x226e
push 0x15f4
push 0x9e
push 0x267c
push 0xd47
push 0x1d3a
push 0x26c3
push 0xfe4
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 0x2167
push 0x7e25
push ebx
mov dl, 1
mov ecx, 0xad4
call fcn.10011f84
add esp, 0xc
mov dword [ebp - 4], 4
cmp dword [ebp - 0x1c], 0xfffffd54
jge 0x10012e7a
mov edx, str.dbdziebel_wfsb_xmmvgyee_qqcxs_eekkaui
mov ecx, 0x1007bf18
call fcn.10006900
or dword [ebp - 4], 0xffffffff
inc dword [ebp - 0x18]
dec dword [ebp - 0x30]
jmp 0x10012da3
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xfffffff3
jge 0x10012d48
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x20], 0x1ed8
cmp dword [ebp - 0x20], 0x1f7d
jle 0x10012f64
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov eax, esi
mov dword [ebp - 0x24], ebx
mov ecx, edi
mov esi, ebx
shl eax, cl
mov dword [ebp - 0x28], eax
mov edi, ebx
mov eax, esi
cdq
idiv edi
mov eax, dword [ebp - 0x28]
mov ecx, edx
shl eax, cl
lea ecx, [ebp - 0x90]
cdq
push edx
push eax
call fcn.10001a75
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10012f11
mov eax, dword [eax]
push eax
call fcn.10048743
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x90]
call fcn.10004a80
inc edi
cmp edi, 0x4172
jl 0x10012eed
inc esi
cmp esi, 0x1d2
jl 0x10012eeb
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x13da
jl 0x10012edd
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x1621
jl 0x10012ed8
push ebx
push 0x44a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [ebp - 0x14], ebx
jmp 0x10012f75
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x30], ebx
jne 0x10012f7b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jle 0x10012f69
cmp dword [ebp - 0x20], 0x1be9
jge 0x10012f8f
push str.phfnquruj_hkmpgwfnl_ptr_pfal_fgolt_umoubhslk_albrs_oxzsocyi_vusfrzr_sjxoyyo_thosi_wgq_sikmft_lndczukft
call fcn.10048743
pop ecx
or dword [ebp - 4], 0xffffffff
dec dword [ebp - 0x18]
jmp 0x10012eae