Function at 0x100012b0
Capabilities:
Extract resource via kernel32 functions
Get geographical location
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xc0
mov eax, esp
mov dword [eax], 0x4da504
mov eax, dword [sym.imp.KERNEL32.dll_LockResource]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx + 0xc], 0xb88
mov dword [ecx + 8], 0xb88
mov dword [ecx + 4], 0xb88
mov dword [ecx], 0xa8407b
mov ecx, dword [sym.imp.USER32.dll_CheckRadioButton]
mov dword [esp + 0x70], eax
call ecx
sub esp, 0x10
mov ecx, esp
lea edx, [esp + 0x78]
mov dword [ecx + 4], edx
mov dword [ecx], 0x7e5f22
mov ecx, dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov dword [esp + 0x6c], eax
call ecx
sub esp, 8
mov byte [esp + 0x8f], 0
mov ecx, esp
lea edx, [esp + 0x8f]
mov dword [ecx + 8], edx
mov dword [ecx + 0x14], 0xb55
mov dword [ecx + 0x10], 0x3de
mov dword [ecx + 0xc], str.Gk_L_o2_qIY6
mov dword [ecx + 4], 0xb55
mov dword [ecx], 0x2c7
mov ecx, dword [sym.imp.USER32.dll_ToUnicode]
mov dword [esp + 0x68], eax
call ecx
sub esp, 0x18
xor ecx, ecx
mov edx, 0x1c
lea esi, [esp + 0x98]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1c
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], ecx
mov dword [esp + 0x5c], edx
call sub.msvcrt.dll_memset
mov eax, esp
lea ecx, [esp + 0x98]
mov dword [eax + 4], ecx
mov dword [eax], 0xf707e6
mov eax, dword [sym.imp.KERNEL32.dll_SetCommState]
call eax
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0x4bc
mov dword [ecx], 0x75772e
mov ecx, dword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov dword [esp + 0x58], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0x2af
mov dword [ecx], 0xee822e
mov ecx, dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
mov dword [esp + 0x54], eax
call ecx
sub esp, 8
xor ecx, ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x4c], ecx
jmp 0x1000145e
mov eax, esp
mov dword [eax], 0x465718
mov eax, dword [sym.imp.USER32.dll_SetClipboardViewer]
call eax
sub esp, 4
mov byte [esp + 0x77], 7
mov ecx, esp
lea edx, [esp + 0x77]
mov dword [ecx + 8], edx
lea edx, [esp + 0x90]
mov dword [ecx + 4], edx
mov dword [ecx + 0xc], 0x80e
mov dword [ecx], 0x18bd73
mov ecx, dword [sym.imp.GDI32.dll_GetPath]
mov dword [esp + 0x48], eax
call ecx
sub esp, 0x10
mov dword [esp + 0x44], eax
jmp 0x10001548
mov eax, esp
mov dword [eax], 0x991
mov eax, dword [sym.imp.KERNEL32.dll_GetUserGeoID]
call eax
sub esp, 4
mov dword [esp + 0x40], eax
jmp 0x100014f1
mov eax, dword [esp + 0x4c]
mov word [esp + 0x74], 0x23
mov ecx, esp
lea edx, [esp + 0x74]
mov dword [ecx + 0xc], edx
mov dword [ecx + 8], 0xb29
mov dword [ecx + 4], str.b7G2Te__vo6
mov dword [ecx], 0xafa
mov ecx, dword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov dword [esp + 0x3c], eax
call ecx
sub esp, 0x10
mov ecx, esp
mov dword [ecx + 4], 0x921830
mov dword [ecx], 0xe4c3bd
mov ecx, dword [sym.imp.USER32.dll_ExcludeUpdateRgn]
mov dword [esp + 0x38], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx], str.O_lIrdL_7BfGE
mov ecx, dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov dword [esp + 0x34], eax
call ecx
sub esp, 4
xor ecx, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov ecx, 0xd
mov dword [esp + 0x28], eax
xor edx, edx
div ecx
cmp edx, 6
je 0x10001443
mov eax, dword [esp + 0x28]
add eax, 1
cmp eax, 0x11b
mov dword [esp + 0x2c], eax
jne 0x100014d4
mov byte [esp + 0xbb], 3
mov eax, esp
lea ecx, [esp + 0xbb]
mov dword [eax], ecx
mov eax, dword [sym.imp.USER32.dll_GetKeyboardState]
call eax
sub esp, 4
mov ecx, dword [esp + 0x3c]
sub ecx, 0x57
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
je 0x100013f4
jmp 0x10001539
mov eax, dword [esp + 0x3c]
sub eax, 0x13
mov dword [esp + 0x1c], eax
jne 0x1000155e
jmp 0x10001548
mov eax, esp
mov dword [eax], 0x8bfaf
mov eax, dword [sym.imp.USER32.dll_OpenIcon]
call eax
sub esp, 4
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x3c]
add eax, 1
cmp eax, 0x84
mov dword [esp + 0x4c], eax
jne 0x1000145e
lea esp, [ebp - 4]
pop esi
pop ebp
ret