Function at 0x1001a6be
Capabilities:
Extract resource via kernel32 functions
Log keystrokes
Query environment variable

Disassembly:
mov eax, 0x1008b7fd
call fcn.1008afe8
sub esp, 0x1b0
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x20], 0x90ac204e
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x20], 0xfffffff7
jmp 0x1001a6f4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff5
jge 0x1001a6eb
push ebx
xor ebx, ebx
mov byte [ebp - 0x11], bl
push esi
push edi
cmp byte [ebp - 0x11], bl
je 0x1001a70f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push dword [ebp - 0x7c]
movdqa xmm0, xmmword [0x10009430]
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x190]
mov dword [ebp - 0x78], ebx
push eax
push ebx
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
movdqu xmmword [ebp - 0x190], xmm0
mov dword [ebp - 0x70], ebx
call fcn.10019dab
mov dword [ebp - 0x10], 0xfffffffc
mov dword [ebp - 0x20], 0xc37fc054
mov dword [ebp - 0x1c], 0x8e2294b
mov dword [ebp - 0x24], 0x53005475
push 3
mov dword [ebp - 0x38], 0x20a3d576
pop edi
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], ebx
jl 0x1001a84d
mov esi, dword [ebp - 0x78]
mov dword [ebp - 0x2c], 0xffffffff
xor edx, edx
mov dword [ebp - 0x1c], 0x468a07c6
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x28], 0x9843c6bc
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x78]
mov eax, dword [ecx + eax*4]
cmp eax, dword [ecx]
mov ecx, 0x89d221e9
setle dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [esi + 0xc], 1
setl al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x78]
mov eax, dword [ecx + eax*4]
cmp eax, dword [ecx]
setle dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x78]
cmp dword [eax + ecx*4], ebx
je 0x1001a806
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x3c]
imul ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x78]
push 0
cmp ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [esi + 8]
pop edx
setne dl
sub edx, eax
mov eax, dword [ebp - 0x38]
neg edx
sbb edx, edx
neg edx
add ecx, edx
xor edx, edx
cmp ecx, eax
setne dl
sub edx, 0x1e745c5b
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x1c], edx
dec dword [ebp - 0x10]
jns 0x1001a777
lea ecx, [ebp - 0x78]
call fcn.10019041
mov dword [ebp - 0x30], 0xfffffffa
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x24], 0x837bc752
push 1
call fcn.10018816
push 1
lea ecx, [ebp - 0x168]
mov dword [ebp - 4], ebx
call fcn.10018816
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x1001a8a2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], 0xf6af1124
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1001a88f
mov dword [ebp - 0x18], ebx
jmp 0x1001a8bd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1a4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001a8ac
mov dword [ebp - 0x18], ebx
jmp 0x1001a8db
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x168]
mov dword [eax + ecx*4], 0x1dfe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1001a8c8
mov eax, dword [ebp - 0x108]
mov dword [eax], 0xe
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001a8fd
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
lea ecx, [ebp - 0x168]
call fcn.10019041
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x108]
call fcn.10019041
mov dword [ebp - 0x30], 0xfffffffd
lea ecx, [ebp - 0xdc]
mov dword [ebp - 0x30], 0xe1ca2961
push edi
call fcn.10018816
mov dword [ebp - 0x18], 0xbbdebf88
mov dword [ebp - 0x28], 0xb56cef3c
mov dword [ebp - 0x1c], ebx
jmp 0x1001a954
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xdc]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001a944
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0xdc]
xor eax, eax
cmp dword [esi + 8], 1
setne al
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], 0xfffffff8
jge 0x1001aa45
push 2
pop edx
mov dword [ebp - 0x10], edx
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x130], eax
test eax, eax
je 0x1001a9cd
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x18], 0xffffffe8
jmp 0x1001a9c5
mov eax, dword [esi + 8]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x30
jne 0x1001a9bc
jmp 0x1001a9fe
mov dword [ebp - 0x10], ebx
jmp 0x1001a9f9
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001a9f6
push 0x16c2
push ebx
push 0x1068
push ebx
push 0xa7c
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 2
pop edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x1001a9d2
mov dword [ebp - 0x18], ebx
jmp 0x1001aa33
mov dword [ebp - 0x10], ebx
jmp 0x1001aa2b
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], ebx
jmp 0x1001aa23
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xdc]
mov dword [eax + ecx*4], 0xa18394d2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001aa10
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x1001aa08
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x1001aa03
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff8
jl 0x1001a981
lea ecx, [ebp - 0xdc]
call fcn.10019041
push 4
pop edi
mov dword [ebp - 0x80], 0x39e3
lea ecx, [ebp - 0xf4]
push edi
call fcn.10018816
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x2c], 0xd767c8fa
mov dword [ebp - 0x2c], 0x307b364f
mov dword [ebp - 0x1c], ebx
jmp 0x1001aa8f
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf4]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001aa7c
push 3
mov dword [ebp - 0x18], ebx
pop esi
jmp 0x1001ab0b
mov dword [ebp - 0x10], 0xf37d45db
mov dword [ebp - 0x10], ebx
jmp 0x1001aac0
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001aabd
push ebx
push 0xdf2
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x1001aaa8
mov dword [ebp - 0x10], ebx
jmp 0x1001ab03
mov dword [ebp - 0x20], 0x85faafe3
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], ebx
jl 0x1001ab00
mov dword [ebp - 0x1c], 0x2df3d37a
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], ebx
jl 0x1001aafb
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xf4]
cmp dword [eax + ecx*4], ebx
jne 0x1001aafb
dec dword [ebp - 0x1c]
jns 0x1001aae8
dec dword [ebp - 0x20]
jns 0x1001aad9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x1001aaca
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1001aa9c
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xffffffee
push 8
pop ecx
jne 0x1001abcb
mov esi, dword [ebp - 0xf4]
jmp 0x1001ab2b
push 8
pop ecx
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x38], 0x3ccd2466
mov eax, dword [ebp - 0x38]
xor eax, eax
cmp dword [esi + 4], ebx
mov dword [ebp - 0x20], 1
mov edx, dword [ebp - 0x38]
setne al
cmp eax, ecx
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x20]
neg edx
sbb edx, edx
sub ecx, eax
inc edx
sub ecx, edx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edi
setl al
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x18], ebx
je 0x1001ab84
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
push 8
pop ecx
cmp ecx, eax
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffee
je 0x1001ab28
push 3
pop esi
lea ecx, [ebp - 0xf4]
call fcn.10019041
mov dword [ebp - 0x38], 0xfff6
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x28], 0x6df7
push 1
call fcn.10018816
xor edx, edx
inc edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x2c], 0x6aed1d25
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x10], ebx
jmp 0x1001ac20
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], 0x5d6c05ba
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001ac0d
mov dword [ebp - 0x10], ebx
jmp 0x1001ac3b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x19c], 0xb1dab551
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001ac2a
mov eax, dword [ebp - 0xc0]
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov dword [eax], ebx