Function at 0x402360
Capabilities:
Get common file path
Log keystrokes via polling

Disassembly:
mov eax, dword [ebp - 0x14]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ecx
pop ebx
pop ebp
ret
push ebp
mov ebp, esp
push 0x5c
call fcn.0040a961
push ebx
push ecx
push esi
push edi
sub esp, 0x2c
push eax
mov edi, edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x10
call dword [sym.imp.USER32.DLL_GetAsyncKeyState]
cwde
test ah, 0x80
je 0x40239e
mov dword [ebp - 0x18], 0xffffffff
push 0x4136a6
call fcn.0040a9d4
add esp, 4
mov ebx, 0x104
xor edx, edx
mov eax, 0x415414
call fcn.0040aa70
push 0x104
push 0x415414
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x415414
mov eax, 0x415728
call fcn.0040c130
xor ecx, ecx
mov dword [0x41551c], ecx
mov ebx, 0x415728
mov al, byte [ebx]
test al, al
je 0x4023f0
cmp al, 0x5c
jne 0x4023ed
mov dword [0x41551c], ebx
inc ebx
jmp 0x4023dd
mov ebx, dword [0x41551c]
test ebx, ebx
je 0x402486
lea edx, [ebx + 1]
mov dword [0x41551c], edx
mov byte [ebx], al
mov eax, dword [0x41551c]
call fcn.0040aa90
mov edx, dword [0x41551c]
add eax, edx
lea ebx, [eax - 4]
mov edx, 0x4136c4
mov eax, ebx
call fcn.0040c530
test eax, eax
jne 0x402431
mov byte [ebx], 0
mov eax, dword [0x41551c]
call fcn.0040aa90
cmp eax, 8
jbe 0x402486
mov edx, dword [0x41551c]
mov ebx, 8
mov eax, 0x4136c9
call fcn.0040c570
test eax, eax
je 0x40247c
mov eax, dword [0x41551c]
call fcn.0040aa90
mov edx, dword [0x41551c]
add eax, edx
lea edx, [eax - 8]
mov eax, 0x4136c9
call fcn.0040c530
test eax, eax
jne 0x402486
mov dword [0x4142ec], 1
mov edx, 0x415728
mov eax, 0x415520
call fcn.0040c130
mov edx, 0x4136d2
mov eax, 0x415520
call fcn.0040c2b0
push 0x415414
push 0x4136de
call fcn.0040a9d4
add esp, 8
push 0x415728
push 0x4136f4
call fcn.0040a9d4
add esp, 8
mov edx, dword [0x41551c]
push edx
push 0x413708
call fcn.0040a9d4
add esp, 8
push 0x415520
push 0x41371e
call fcn.0040a9d4
add esp, 8
mov edx, 4
mov eax, 0x415520
call fcn.0040c5c0
test eax, eax
je 0x402520
call fcn.0040c5f0
mov ebx, dword [eax]
push ebx
push 0x413739
call fcn.0040a9d4
add esp, 8
xor esi, esi
mov dword [0x415208], esi
jmp 0x40252a
mov dword [0x415208], 1
xor eax, eax
mov dword [0x415518], eax
push eax
mov eax, dword [0x4142f0]
xor ecx, ecx
mov ebx, 0x413209
mov edx, 0x413765
call fcn.00401010
test eax, eax
je 0x402564
cmp byte [eax], 0
je 0x402564
call fcn.0040c160
test eax, eax
je 0x402564
mov dword [0x4142ec], 1
mov ebx, 0x104
xor edx, edx
mov eax, 0x415624
call fcn.0040aa70
mov ebx, 0x104
xor edx, edx
mov eax, 0x415104
call fcn.0040aa70
mov ecx, dword [0x4142ec]
test ecx, ecx
jne 0x4025d8
push 0x415624
push ecx
push ecx
push 0x23
push ecx
call dword [sym.imp.SHFOLDER.DLL_SHGetFolderPathA]
cmp eax, 1
jae 0x4025a9
test eax, eax
je 0x4025d8
push 0
push 0x23
push 0x415624
push 0
call dword [sym.imp.SHELL32.DLL_SHGetSpecialFolderPathA]
test eax, eax
jne 0x4025d8
mov eax, 0x413772
call fcn.0040c1b0
test eax, eax
je 0x4025d8
mov edx, eax
mov eax, 0x415624
call fcn.0040c130
cmp byte [0x415624], 0
je 0x402601
mov edx, 0x415624
mov eax, 0x415104
call fcn.0040c130
mov edx, 0x413782
mov eax, 0x415104
call fcn.0040c2b0
jmp 0x402610
mov edx, 0x415728
mov eax, 0x415104
call fcn.0040c130
push 0x415624
push 0x413799
call fcn.0040a9d4
add esp, 8
push 0x415104
push 0x4137b3
call fcn.0040a9d4
add esp, 8
mov ebx, 0x104
xor edx, edx
mov eax, 0x415000
call fcn.0040aa70
mov esi, 1
cmp esi, dword [ebp - 0x40]
jge 0x4026ce
mov ebx, esi
shl ebx, 2
add ebx, edi
mov edx, dword [ebx]
cmp byte [edx], 0x2d
jne 0x4026ce
mov eax, 0x4137cb
call fcn.0040c610
test eax, eax
jne 0x402676
inc esi
jmp 0x4026ce
mov ebx, dword [ebx]
mov bl, byte [ebx + 1]
cmp bl, 0x44
jb 0x40268e
jbe 0x402694
cmp bl, 0x50
je 0x4026a0
cmp bl, 0x49
je 0x4026ac
jmp 0x4026b5
test bl, bl
je 0x4026c8
jmp 0x4026b5
mov dword [0x4142e8], 1
jmp 0x4026c8
mov dword [0x4142ec], 1
jmp 0x4026c8
xor eax, eax
mov dword [0x4142ec], eax
jmp 0x4026c8
mov eax, esi
mov ebx, dword [edi + eax*4]
push ebx
push 0x4137ce
call fcn.0040a9d4
add esp, 8
inc esi
jmp 0x40264a
cmp esi, dword [ebp - 0x40]
jge 0x40270b
mov edx, esi
inc esi
mov edx, dword [edi + edx*4]
mov al, byte [edx]
test al, al
je 0x4026e9
cmp al, 0x2d
jne 0x4026fc
cmp byte [edx + 1], 0
jne 0x4026fc
mov ebx, 0x104
xor edx, edx
mov eax, 0x415000
call fcn.0040aa70
jmp 0x40270b
mov ebx, 0x103
mov eax, 0x415000
call fcn.0040aa30
cmp byte [0x415000], 0
jne 0x402733
mov edx, dword [0x41551c]
mov eax, 0x415000
call fcn.0040c130
mov edx, 0x4137f4
mov eax, 0x415000
call fcn.0040c2b0
mov eax, 0x415000
call fcn.0040c239
test eax, eax
je 0x402752
mov edx, 0x415000
mov eax, 0x41520c
call fcn.0040c130
jmp 0x4027bf
mov edx, 0x415728
mov eax, 0x41520c
call fcn.0040c130
mov edx, 0x413386
mov eax, 0x41520c
call fcn.0040c2b0
mov edx, 0x415000
mov eax, 0x41520c
call fcn.0040c2b0
mov edx, 4
mov eax, 0x41520c
call fcn.0040c5c0
test eax, eax
je 0x4027bf
mov edx, 0x415104
mov eax, 0x41520c
call fcn.0040c130
mov edx, 0x413386
mov eax, 0x41520c
call fcn.0040c2b0
mov edx, 0x415000
mov eax, 0x41520c
call fcn.0040c2b0
push 0x41520c
push 0x4137f9
call fcn.0040a9d4
add esp, 8
mov edx, 4
mov eax, 0x41520c
call fcn.0040c5c0
test eax, eax
je 0x402803
call fcn.0040c5f0
mov ecx, dword [eax]
push ecx
push 0x413813
call fcn.0040a9d4
add esp, 8
xor ebx, ebx
mov dword [0x415518], ebx
jmp 0x40280d
mov dword [0x415518], 1
cmp dword [ebp - 0x18], 0
je 0x402827
lea eax, [ebp - 0x1c]
call fcn.00401114
test eax, eax
je 0x402827
mov eax, dword [ebp - 0x1c]
jmp 0x4019d8
cmp dword [0x415518], 0
jne 0x40283a
mov eax, 2
jmp 0x4019d8
mov dword [ebp - 0x14], 0xffffffff
mov ebx, 0x20
xor edx, edx
lea eax, [ebp - 0x3c]
call fcn.0040aa70
push 0x20
mov eax, dword [0x4142f0]
lea ecx, [ebp - 0x3c]
mov ebx, 0x41383e
mov edx, 0x413846
call fcn.00401010
test eax, eax
je 0x4019d5
lea eax, [ebp - 0x3c]
push eax
push 0x41384e
call fcn.0040a9d4
add esp, 8
lea edx, [ebp - 0x3c]
mov eax, 0x41383e
call fcn.0040c530
mov ecx, dword [ebp - 0x40]
sub ecx, esi
mov ebx, esi
shl ebx, 2
add ebx, edi
test eax, eax
jne 0x4028ae
mov edx, ecx
call fcn.004019f4
mov dword [ebp - 0x14], eax
jmp 0x4019d5
lea edx, [ebp - 0x3c]
mov eax, 0x413298
call fcn.0040c530
test eax, eax
jne 0x4028c8
mov edx, ecx
mov eax, 1
jmp 0x4028a1
lea edx, [ebp - 0x3c]
mov eax, 0x413867
call fcn.0040c530
test eax, eax
je 0x4028fb
lea edx, [ebp - 0x3c]
mov eax, 0x41386e
call fcn.0040c530
test eax, eax
je 0x4028fb
lea edx, [ebp - 0x3c]
mov eax, 0x4132a0
call fcn.0040c530
test eax, eax
jne 0x40290e
mov ebx, esi
shl ebx, 2
add ebx, edi
mov edx, dword [ebp - 0x40]
sub edx, esi
mov eax, 2
jmp 0x4028a1
lea edx, [ebp - 0x3c]
mov eax, 0x413876
call fcn.0040c530
test eax, eax
jne 0x40292b
mov edx, ecx
mov eax, 3
jmp 0x4028a1
lea edx, [ebp - 0x3c]
mov eax, 0x41387f
call fcn.0040c530
test eax, eax
jne 0x40294a
mov edx, ebx
mov eax, ecx
call fcn.0040202a
jmp 0x4028a6
lea edx, [ebp - 0x3c]
mov eax, 0x41388a
call fcn.0040c530
test eax, eax
jne 0x402969
mov edx, ebx
mov eax, ecx
call fcn.0040233d
jmp 0x4028a6
lea eax, [ebp - 0x3c]
push eax
push 0x41388e
call fcn.0040a9d4
add esp, 8
jmp 0x4019d5