Function at 0x401040
Capabilities:
Check mutex on windows
Get common file path
Log keystrokes via application hook
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43ec33
mov eax, dword fs:[0]
push eax
sub esp, 0x4b8
mov eax, dword [0x44a2b8]
xor eax, esp
mov dword [esp + 0x4b0], eax
push ebx
push esi
push edi
mov eax, dword [0x44a2b8]
xor eax, esp
push eax
lea eax, [esp + 0x4c8]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push 0xffffffffffffffff
mov dword [esp + 0x38], edi
call sub.IMM32.dll_ImmDisableIME
mov dword [0x44cd88], edi
call fcn.00418b90
test eax, eax
je 0x401596
mov ecx, esi
call fcn.004224f0
xor edi, edi
cmp dword [0x451528], edi
je 0x4010d1
call fcn.004015c0
call fcn.00401870
test eax, eax
jne 0x401596
call fcn.00422a10
jmp 0x401596
call fcn.00401690
test eax, eax
je 0x40128b
mov esi, 7
mov dword [esp + 0x8c], esi
mov dword [esp + 0x88], edi
mov word [esp + 0x78], di
mov dword [esp + 0x4d0], edi
mov dword [esp + 0x70], esi
mov dword [esp + 0x6c], edi
mov word [esp + 0x5c], di
mov edx, 0x441834
lea eax, [esp + 0x3c]
mov byte [esp + 0x4d0], 1
call fcn.00401c90
mov edx, 0x441840
lea eax, [esp + 0x18]
mov byte [esp + 0x4d0], 2
call fcn.00401c90
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x7c]
mov byte [esp + 0x4d8], 3
call fcn.004173f0
mov ebx, 8
add esp, 8
cmp dword [esp + 0x30], ebx
jb 0x40116c
mov edx, dword [esp + 0x1c]
push edx
call fcn.004250ac
add esp, 4
mov byte [esp + 0x4d0], 1
cmp dword [esp + 0x54], ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], di
jb 0x401194
mov eax, dword [esp + 0x40]
push eax
call fcn.004250ac
add esp, 4
mov edx, 0x441834
lea eax, [esp + 0x3c]
call fcn.00401c90
mov edx, 0x4418d4
lea eax, [esp + 0x18]
mov byte [esp + 0x4d0], 4
call fcn.00401c90
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x60]
mov byte [esp + 0x4d8], 5
call fcn.004173f0
add esp, 8
cmp dword [esp + 0x30], ebx
jb 0x4011e9
mov eax, dword [esp + 0x1c]
push eax
call fcn.004250ac
add esp, 4
cmp dword [esp + 0x54], ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], di
jb 0x401209
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004250ac
add esp, 4
cmp dword [esp + 0x70], ebx
mov ecx, dword [esp + 0x5c]
jae 0x401217
lea ecx, [esp + 0x5c]
cmp dword [esp + 0x8c], ebx
mov eax, dword [esp + 0x78]
jae 0x401228
lea eax, [esp + 0x78]
push 0x40
push ecx
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [0x450878], 5
mov dword [0x45087c], 1
call fcn.0041dd90
cmp dword [esp + 0x70], ebx
jb 0x40125f
mov edx, dword [esp + 0x5c]
push edx
call fcn.004250ac
add esp, 4
cmp dword [esp + 0x8c], ebx
mov dword [esp + 0x70], esi
mov dword [esp + 0x6c], edi
mov word [esp + 0x5c], di
jb 0x401596
mov eax, dword [esp + 0x78]
push eax
call fcn.004250ac
add esp, 4
jmp 0x401596
call fcn.00401870
test eax, eax
jne 0x401596
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x44cd88]
push eax
push ecx
push 0x412c60
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov edx, dword [0x44cd88]
push edi
push 0x44b6c4
push 0x44cd8c
mov dword [0x44ef78], eax
mov dword [0x44cd90], edx
call sub.gdiplus.dll_GdiplusStartup
call fcn.004114b0
push 0x44d6a0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
push str._TXQQCRM0824
push 1
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x44d8c8], eax
call ebx
cmp eax, 0xb7
jne 0x401322
push 0x30
push 0x4418d4
push edi
mov ecx, 0x44191c
call fcn.00407d60
add esp, 0xc
jmp 0x401596
push str._TXTM0824
push 1
push edi
call esi
mov esi, eax
call ebx
cmp eax, 0xb7
jne 0x401351
push 0x30
push 0x4418d4
push edi
mov ecx, 0x441968
call fcn.00407d60
add esp, 0xc
jmp 0x401596
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00418df0
test eax, eax
je 0x401591
push 1
xor ecx, ecx
call fcn.0041ca60
add esp, 4
test eax, eax
jne 0x401389
mov eax, 2
mov dword [0x450878], eax
mov dword [0x45087c], eax
jmp 0x401591
call fcn.0041c970
call fcn.004015c0
mov eax, dword [0x44cd88]
push edi
push 0x406ec0
push edi
push 0x3ea
push eax
mov dword [0x44d8cc], edi
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 1
jne 0x40151d
call fcn.004019f0
cmp eax, 9
mov dword [esp + 0x38], eax
jle 0x4014ba
mov dword [esp + 0x8c], 7
mov dword [esp + 0x88], edi
mov word [esp + 0x78], di
mov edx, 0x441834
lea eax, [esp + 0x58]
mov dword [esp + 0x4d0], 6
call fcn.00401c90
mov edx, 0x4418d4
lea eax, [esp + 0x3c]
mov byte [esp + 0x4d0], 7
call fcn.00401c90
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x40]
mov ebx, 8
push edx
lea ecx, [esp + 0x7c]
mov byte [esp + 0x4d8], bl
call fcn.004173f0
add esp, 8
lea esi, [esp + 0x3c]
call fcn.00401cd0
lea esi, [esp + 0x58]
mov byte [esp + 0x4d0], 6
call fcn.00401cd0
mov eax, dword [esp + 0x38]
push eax
push 0x4419d4
push 0x208
lea ecx, [esp + 0xb8]
push 0x104
push ecx
call fcn.00425032
add esp, 0x14
lea edx, [esp + 0xac]
lea eax, [esp + 0x90]
call fcn.00401c90
mov dword [0x450878], ebx
mov dword [0x45087c], 1
call fcn.0041dd90
lea esi, [esp + 0x90]
call fcn.00401cd0
lea esi, [esp + 0x74]
mov dword [esp + 0x4d0], 0xffffffff
call fcn.00401cd0
xor ecx, ecx
call fcn.00407700
mov edx, dword [esp + 0x34]
push 0x6d
push edx
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov ebx, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
mov esi, eax
push edi
lea eax, [esp + 0x24]
push eax
call ebx
test eax, eax
je 0x40151d
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push ecx
push esi
push edx
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x40150f
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push edi
push edi
push edi
lea edx, [esp + 0x24]
push edx
call ebx
test eax, eax
jne 0x4014e4
lea eax, [esp + 0x14]
push eax
push 0x2b
push edi
mov dword [esp + 0x20], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x2b4]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [esp + 0x2b4]
push eax
call fcn.0041cf90
add esp, 4
mov esi, 0x44cb80
call fcn.0041b9a0
push 0x44d6a0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.004118b0
mov ecx, dword [0x44cd8c]
push ecx
call sub.gdiplus.dll_GdiplusShutdown
mov edx, dword [0x44ef78]
push edx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [0x44d8c8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0041dd90
xor eax, eax
mov ecx, dword [esp + 0x4c8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4b0]
xor ecx, esp
call fcn.00424e88
mov esp, ebp
pop ebp
ret 0x10