Function at 0x10040ff
Capabilities:
Check mutex on windows
Enumerate gui resources
Log keystrokes via polling
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0x1001594
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, edi
mov dword [ebp - 4], eax
je 0x100444b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100444b
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
mov dword [0x100ed24], eax
call fcn.01003dcb
mov esi, eax
cmp esi, 4
mov dword [ebp - 8], esi
jne 0x1004166
push 0x1001ea8
call fcn.01003310
push 0x83
call fcn.01003911
jmp 0x100442d
call fcn.0100401d
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
jne 0x1004195
cmp dword [0x100ed3c], edi
jne 0x1004460
push 0xfffffffffffffff7
pop eax
cdq
xor eax, edx
sub eax, edx
add eax, 0x69
push eax
call fcn.01003911
jmp 0x100442e
cmp eax, edi
jne 0x10041ba
cmp esi, edi
je 0x10041ba
push esi
push 0x1001e70
call fcn.01003310
push 0x83
call fcn.01003911
add esp, 0xc
jmp 0x1004460
call fcn.01003f01
test eax, eax
je 0x10041e6
push 0x1001e30
call fcn.01003310
cmp dword [0x100ed3c], edi
pop ecx
jne 0x10041de
push 0x67
call fcn.01003911
pop ecx
or eax, 0xffffffff
jmp 0x1004463
call fcn.01003369
test eax, eax
jne 0x100421b
push 0x1001de8
call fcn.01003310
cmp dword [0x100ed3c], edi
pop ecx
jne 0x1004214
push 0xfffffffffffffff1
pop eax
cdq
xor eax, edx
sub eax, edx
add eax, 0x69
push eax
call fcn.01003911
pop ecx
push 0xfffffffffffffff1
jmp 0x1004462
push esi
call fcn.01003a62
test eax, eax
jne 0x1004235
push 0x1001dc0
call fcn.01003310
pop ecx
jmp 0x1004173
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
push 0x8001
call esi
push 0x1001aa8
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebx
mov dword [0x100ed34], eax
call esi
mov eax, dword [0x100ed34]
cmp eax, edi
pop ebx
je 0x1004431
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001db0
push eax
call esi
push 0x1001d98
push dword [0x100ed34]
mov dword [0x100ed28], eax
call esi
push 0x1001d80
push dword [0x100ed34]
mov dword [0x100ed2c], eax
call esi
cmp dword [0x100ed28], edi
mov dword [0x100ed30], eax
je 0x10043f7
mov ecx, dword [0x100ed2c]
cmp ecx, edi
je 0x10043f7
cmp eax, edi
je 0x10043f7
mov esi, 0x10036ee
push esi
call ecx
mov eax, dword [0x100ed2c]
cmp eax, edi
je 0x10042db
cmp dword [0x100ed3c], edi
je 0x10042db
push esi
call eax
mov ecx, dword [ebp - 8]
cmp ecx, 3
jne 0x100435f
push 0x2010098
push edi
push edi
call dword [0x100ed28]
mov esi, eax
mov dword [ebp + 0x10], esi
call fcn.01003b3f
cmp esi, 1
jne 0x100433e
push 0x68
call fcn.01003911
pop ecx
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x1004324
push 0x1001b3c
call fcn.01003310
pop ecx
jmp 0x10043e9
push 1
call fcn.01003edb
call fcn.01003bd2
push edi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x10043e9
cmp esi, 0xfffffff7
jne 0x100434d
call fcn.01003c6f
jmp 0x10043e9
mov eax, esi
cdq
xor eax, edx
sub eax, edx
add eax, 0x69
push eax
call fcn.01003911
jmp 0x100431e
cmp ecx, 1
je 0x10043c2
cmp ecx, 2
je 0x10043c2
cmp dword [0x100ed3c], edi
jne 0x10043c2
cmp ecx, edi
jne 0x10043b8
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [0x100ed34]
cmp eax, edi
je 0x10043ae
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x10043a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x10043a8
push eax
push 0x1001d50
call fcn.01003310
pop ecx
pop ecx
jmp 0x10043ae
mov dword [0x100ed34], edi
push dword [ebp + 8]
call fcn.010059cd
jmp 0x10043e4
push 0x1001d2c
jmp 0x1004319
cmp dword [0x100ed40], edi
mov eax, 0x2010098
je 0x10043d8
cmp ecx, edi
jne 0x10043d8
mov eax, 0x2014098
push eax
push edi
push edi
call dword [0x100ed28]
mov dword [ebp + 0x10], eax
call fcn.01003b3f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x10]
jmp 0x1004463
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push 0x1001cfc
call fcn.01003310
pop ecx
pop ecx
push dword [0x100ed34]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x1004460
call esi
cmp eax, edi
je 0x1004460
push eax
push 0x1001cbc
call fcn.01003310
pop ecx
pop ecx
jmp 0x1004460
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001c8c
call fcn.01003310
pop ecx
pop ecx
call fcn.01003c6f
jmp 0x1004460
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0x1003f57
call dword [sym.imp.USER32.dll_EnumWindows]
push 0xfffffffffffffff7
pop eax
pop edi
pop esi
leave
ret 0x10