Function at 0x10001290
Capabilities:
Log keystrokes via polling
Query service status
Resolve function by parsing pe exports
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov esi, esp
mov eax, 8
call fcn.10001a10
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov ecx, 4
mov dword [esi + 0x7c], eax
mov eax, ecx
mov dword [esi + 0x78], ecx
call fcn.10001a10
mov eax, esp
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x74], eax
mov eax, ecx
call fcn.10001a10
mov eax, esp
mov ecx, 0x1c
mov dword [esi + 0x70], eax
mov eax, ecx
call fcn.10001a10
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x860a0c
mov ecx, dword [sym.imp.KERNEL32.dll_CancelIo]
mov dword [esi + 0x6c], eax
call ecx
mov dword [esi + 0xc0], 0
mov dword [esi + 0x68], eax
jmp 0x10001412
xor eax, eax
mov ecx, 0x16
lea edx, [esi + 0xa8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0x16
mov dword [esi + 0x64], eax
mov dword [esi + 0x60], ecx
call sub.msvcrt.dll_memset
add esp, 0xc
sub esp, 8
mov eax, esp
lea ecx, [esi + 0xa8]
mov dword [eax + 4], ecx
mov dword [eax], 0xc2d80c
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x9f1f19
mov ecx, dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [esi + 0x5c], eax
call ecx
mov dword [esi + 0x58], eax
jmp 0x100014b5
jmp 0x100013e6
cmp dword [esi + 0x8c], 0xd1
jne 0x10001471
jmp 0x100014ed
sub esp, 0xc
mov eax, esp
lea ecx, [esi + 0x90]
mov dword [eax], ecx
mov dword [eax + 8], 0x82c
mov dword [eax + 4], 0x766
mov eax, dword [sym.imp.USER32.dll_InflateRect]
call eax
mov ecx, dword [sym.imp.KERNEL32.dll_AllocConsole]
mov dword [esi + 0x54], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0xd648d6
mov dword [ecx], 0xae603e
mov ecx, dword [sym.imp.GDI32.dll_InvertRgn]
mov dword [esi + 0x50], eax
call ecx
mov dword [esi + 0x4c], eax
jmp 0x10001548
sub esp, 4
mov eax, esp
mov dword [eax], 0x764
mov eax, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
call eax
mov dword [esi + 0x48], eax
jmp 0x10001639
mov eax, dword [esi + 0x70]
mov ecx, dword [eax]
add ecx, 1
mov dword [eax], ecx
jmp 0x100015ca
cmp dword [esi + 0xc0], 0x5c
je 0x10001653
sub esp, 8
mov eax, esp
mov dword [eax + 4], 0x45a
mov dword [eax], 0x9ce757
mov eax, dword [sym.imp.GDI32.dll_SetTextAlign]
call eax
sub esp, 0xc
mov ecx, esp
mov dword [ecx + 8], 0xbf7
mov dword [ecx + 4], 0x95c
mov dword [ecx], 0x343c7d
mov ecx, dword [sym.imp.USER32.dll_ShowScrollBar]
mov dword [esi + 0x44], eax
call ecx
mov dword [esi + 0x8c], 0
mov dword [esi + 0x40], eax
jmp 0x1000137f
mov eax, dword [esi + 0x8c]
mov ecx, 0xaf286bcb
mov dword [esi + 0x3c], eax
mul ecx
mov eax, dword [esi + 0x3c]
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x13
mov ecx, dword [esi + 0x3c]
sub ecx, eax
mov eax, ecx
sub eax, 3
mov dword [esi + 0x38], ecx
mov dword [esi + 0x34], eax
je 0x10001313
jmp 0x100014a8
mov eax, dword [esi + 0x38]
sub eax, 9
mov dword [esi + 0x30], eax
jne 0x100014cf
jmp 0x100014b5
sub esp, 8
mov eax, esp
mov dword [eax + 4], 0x812
mov dword [eax], 0x62a
call sub.urlmon.dll_CoInternetIsFeatureEnabled
mov dword [esi + 0x2c], eax
jmp 0x100014d1
mov eax, dword [esi + 0x8c]
add eax, 1
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x28]
mov dword [esi + 0x8c], eax
jmp 0x1000137f
mov word [esi + 0xbe], 0x58
movzx eax, word [esi + 0xbe]
sub esp, 4
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [sym.imp.USER32.dll_IsCharAlphaW]
call eax
mov ecx, dword [esi + 0xc0]
mov edx, 0xcc29786d
mov dword [esi + 0x24], eax
mov eax, ecx
mul edx
shr edx, 8
imul eax, edx, 0x141
sub ecx, eax
mov eax, ecx
sub eax, 0x3c
mov dword [esi + 0x20], ecx
mov dword [esi + 0x1c], eax
je 0x10001394
jmp 0x1000153b
mov eax, dword [esi + 0x20]
sub eax, 2
mov dword [esi + 0x18], eax
jne 0x100015c1
jmp 0x10001548
mov dword [esi + 0xa4], 0xabe
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0x7c]
mov dword [ecx], eax
mov eax, dword [esi + 0x84]
mov dword [ecx + 4], eax
sub esp, 0xc
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov edi, esp
mov dword [edi + 4], edx
mov dword [edi], eax
lea eax, [esi + 0xa4]
mov dword [edi + 8], eax
mov eax, dword [sym.imp.OLEAUT32.dll_VarI4FromDate]
call eax
mov ecx, dword [esi + 0x74]
mov byte [ecx], 0x58
mov bl, byte [ecx]
sub esp, 4
movsx edx, bl
mov edi, esp
mov dword [edi], edx
mov edx, dword [sym.imp.USER32.dll_VkKeyScanA]
mov dword [esi + 0x14], eax
call edx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x3d
mov ecx, dword [sym.imp.USER32.dll_OemKeyScan]
mov word [esi + 0x12], ax
call ecx
mov dword [esi + 0xc], eax
jmp 0x100013e6
mov eax, dword [esi + 0x70]
mov dword [eax], 0
mov eax, dword [esi + 0x70]
cmp dword [eax], 0xa
je 0x1000137d
sub esp, 0x1c
mov eax, esp
mov dword [eax + 0x18], 0xc11
mov dword [eax + 0x14], 0xc11
mov dword [eax + 0x10], 0x559
mov dword [eax + 0xc], 0xbe8
mov dword [eax + 8], 0x5dd
mov dword [eax + 4], 0x602
mov dword [eax], 0x7b70e3
mov eax, dword [sym.imp.GDI32.dll_RoundRect]
call eax
sub esp, 8
mov ecx, esp
mov edx, dword [esi + 0x6c]
mov dword [ecx + 4], edx
mov dword [ecx], 0xb7614d
mov ecx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [esi + 8], eax
call ecx
mov dword [esi + 4], eax
jmp 0x10001400
mov eax, dword [esi + 0xc0]
mov dword [esi], eax
mov eax, dword [esi]
add eax, 1
mov dword [esi + 0xc0], eax
jmp 0x10001412
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret