Function at 0x1000190d
Capabilities:
Check mutex on windows
Create thread
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
cmp byte [0x10046cf2], 0
je 0x10001923
xor al, al
leave
ret
push ebx
push esi
push edi
call fcn.1001cd5a
push 0x100467f4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push str.MessageBoxTimeoutA
push str.user32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov dword [0x100468d8], eax
test eax, eax
je 0x10001b61
call fcn.1001cf6c
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 5
pop eax
cmp eax, dword [ebp - 0x90]
push 0x10000000
push ebx
sbb al, al
push ebx
inc al
push str.default
mov byte [0x10046810], al
call dword [sym.imp.USER32.dll_OpenDesktopA]
push 4
mov dword [0x1004680c], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0x10045b14
push 1
push 1
push 8
push 8
mov dword [0x100468d0], eax
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [0x100468d4], eax
call esi
call fcn.10005578
call fcn.1000871c
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 0x10046818
push 0x28
mov dword [0x100468dc], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push 0x7f00
push ebx
mov dword [0x10046814], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x100468b8
push eax
mov dword [0x100468cc], eax
call dword [sym.imp.USER32.dll_GetIconInfo]
push dword [0x100468c4]
call esi
push dword [0x100468c8]
call esi
push str..NET_CLR_Networking_Perf_Library_Lock_PID_0
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x10046d00], eax
test eax, eax
je 0x10001b66
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov edi, 0xb7
cmp eax, edi
je 0x10001b61
push str.RemoteAccess_Perf_Library_Lock_PID_0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x10046d18], eax
test eax, eax
je 0x10001b61
call esi
cmp eax, edi
je 0x10001b61
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push str.AtlDebugAllocator_FileMappingNameStatic3_0
push 0x4b0
push ebx
push 4
push ebx
push 0xffffffffffffffff
call edi
mov dword [0x10046cfc], eax
test eax, eax
je 0x10001b61
call esi
cmp eax, 0xb7
je 0x10001b61
push ebx
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0xf001f
push dword [0x10046cfc]
call ebx
mov dword [0x10046d14], eax
test eax, eax
je 0x10001b5f
push str..NET_Data_Provider_for_SqlServer_Perf_Library_Lock_PID_0
push 0xd
push 0
push 4
push 0
push 0xffffffffffffffff
call edi
mov dword [0x10046d0c], eax
test eax, eax
je 0x10001b5f
call esi
mov edi, 0xb7
cmp eax, edi
je 0x10001b5f
xor eax, eax
push eax
push eax
push eax
push 0xf001f
push dword [0x10046d0c]
call ebx
mov dword [0x10046d04], eax
test eax, eax
je 0x10001b5f
call fcn.10001433
push str.ASP.NET_2.0.50727_Perf_Library_Lock_PID_0
xor ebx, ebx
mov dword [0x10046cf4], eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x10046d08], eax
test eax, eax
je 0x10001b61
call esi
cmp eax, edi
je 0x10001b61
push ebx
push ebx
push ebx
push 0x10001653
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
call fcn.1001cef9
mov byte [0x10046cf2], 1
jmp 0x10001b61
xor ebx, ebx
mov eax, dword [0x10046d00]
cmp byte [0x10046cf2], 0
jne 0x10001b8c
test eax, eax
je 0x10001b80
mov ecx, eax
call fcn.1001cef9
mov dword [0x10046d00], ebx
mov byte [0x10046cf2], 1
call fcn.10001ba2
mov al, byte [0x10046cf2]
pop edi
pop esi
pop ebx
leave
ret