Function at 0x401000
Capabilities:
Get common file path
Log keystrokes via polling
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404ae0
lea ecx, [ebp - 0x2c]
call fcn.00405380
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 9], al
lea ecx, [ebp - 0x2c]
call fcn.00405380
sub eax, 2
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0x5d], al
mov dword [0x429fc8], 0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
xor edx, edx
test ecx, ecx
setl dl
mov word [ebp - 8], dx
call fcn.0040a1e0
movsx eax, word [ebp - 8]
push eax
mov ecx, dword [str.WinMain]
push ecx
push str._s__control_key_is__d
call fcn.0040a290
add esp, 0xc
push 0xff
lea edx, [ebp - 0x160]
push edx
push str.LAX_DEBUG
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
push str.TRUE
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x4010aa
mov byte [0x42a0e8], 1
push str.true
lea ecx, [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x4010c7
mov byte [0x42a0e8], 1
movzx edx, byte [0x42a0e8]
test edx, edx
je 0x4010e7
push 0x429da0
push 0x100
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
call fcn.00403ed0
call fcn.0040a1e0
movzx eax, byte [0x42a0e8]
test eax, eax
je 0x401103
mov dword [ebp - 0x168], 0x422258
jmp 0x40110d
mov dword [ebp - 0x168], 0x42225c
mov ecx, dword [ebp - 0x168]
push ecx
mov edx, dword [str.WinMain]
push edx
push str._s__LAX_DEBUG_is__s
call fcn.0040a290
add esp, 0xc
movsx eax, word [ebp - 8]
test eax, eax
jne 0x40113b
movzx ecx, byte [0x42a0e8]
test ecx, ecx
je 0x401156
mov byte [0x42a0e8], 1
movsx edx, word [ebp - 8]
test edx, edx
je 0x401151
mov byte [0x42a0ea], 1
call fcn.00403f40
push str.Self_Extractor_execution_begins.
call fcn.00403d90
add esp, 4
movzx eax, byte [ebp - 9]
test eax, eax
jne 0x401238
movzx ecx, byte [ebp - 0x5d]
test ecx, ecx
jne 0x401238
mov edx, dword [ebp + 8]
mov dword [0x429fac], edx
mov dword [ebp - 0x5c], 0x30
mov dword [ebp - 0x58], 3
mov dword [ebp - 0x54], 0x401640
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
push 0x428064
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x44], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x40], eax
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 0x428064
mov dword [ebp - 0x34], 0x428064
push 0x428064
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
push str.Window_class_registered.
call fcn.00403d90
add esp, 4
push 0
push 0x4035f0
push 0
push str.PROGRESSINDICATOR
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push str.Dialog_initialized.
call fcn.00403d90
add esp, 4
jmp 0x401267
movzx edx, byte [ebp - 9]
test edx, edx
je 0x40124d
push str.Running_in_Silent_Mode
call fcn.00403d90
add esp, 4
movzx eax, byte [ebp - 0x5d]
test eax, eax
je 0x401262
push str.Running_in_Console_Mode
call fcn.00403d90
add esp, 4
call fcn.00401e50
mov dword [ebp - 4], 0
cmp dword [0x42a0d8], 0
je 0x4012d0
mov ecx, dword [0x429fb8]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push str.Initiating_self_extraction...
call fcn.00403d90
add esp, 4
push 0xffffffffffffffff
mov edx, dword [0x429fb4]
push edx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
mov ecx, dword [0x429fb4]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
mov edx, dword [ebp - 4]
push edx
push str._The_process_has_terminated_with_an_exit_code_of__ld_
call fcn.00403d90
add esp, 8
mov eax, dword [0x429fb4]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x4012d7
mov dword [ebp - 4], 0xffffffff
cmp dword [0x429fc8], 0
je 0x401307
cmp dword [0x42a0dc], 0
je 0x401307
push str.User_requested_ABORT:_Clean_up_temporary_directory
call fcn.00403d90
add esp, 4
push 1
mov ecx, dword [0x42a0dc]
push ecx
call fcn.00403c10
add esp, 8
movzx edx, byte [0x42a0e8]
test edx, edx
je 0x40132f
movzx eax, byte [0x42a0ea]
test eax, eax
je 0x40132f
push str._n_n_nPlease_press_a_key_to_close_this_window._n_n
call fcn.00403d90
add esp, 4
call fcn.00403f30
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x164], ecx
lea ecx, [ebp - 0x2c]
call fcn.00403fb0
mov eax, dword [ebp - 0x164]
mov esp, ebp
pop ebp
ret 0x10