Function at 0x41bd95
Capabilities:
Check mutex on windows
Get file version info
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x120]
sub esp, 0x1a0
mov eax, dword [0x449748]
push ebx
xor ebx, ebx
mov dword [ebp + 0x11c], eax
mov eax, connect
push edi
lea ecx, [ebp + 0x10]
mov dword [ebp], ebx
mov byte [ebp + 0x17], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], ebx
call fcn.0042376d
push str.NoMutex
xor eax, eax
call fcn.00406731
test eax, eax
pop ecx
jne 0x41be16
push str.Rnsfldr
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41be16
push ebx
push 0x43b8f0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
mov byte [ebp + 0x17], 1
call fcn.0042528e
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
and ax, 0x3ff
cmp ax, 0x11
je 0x41be49
push 0x24
push str.Warning
push str.In_this_environment__this_software_may_not_run._Do_you_continue_
push ebx
call edi
cmp eax, 7
je 0x41c520
push esi
call fcn.0041ff8e
mov word [0x44c960], ax
call fcn.0042002d
mov word [0x44c958], ax
call fcn.00420639
mov word [0x44c95c], ax
mov eax, dword [ebp + 0x128]
push 0x8e
push eax
mov dword [0x44eef4], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov esi, connect
push esi
lea ecx, [ebp + 0x10]
call fcn.00424c76
test al, al
je 0x41bed2
push 1
push str.RestrictRun
lea ecx, [ebp + 0x10]
call fcn.00424be0
test eax, eax
jne 0x41beca
push str.RestrictRun
lea ecx, [ebp + 0x10]
call fcn.00423c0a
lea ecx, [ebp + 0x10]
call fcn.00423c52
push 1
push str.AppEventsSchemesApps.Default.Default
push esi
lea ecx, [ebp + 0x10]
call fcn.00424c76
test al, al
je 0x41beee
lea ecx, [ebp + 0x10]
call fcn.00423c52
push 0xa2
push ebx
push dword [ebp + 0x128]
call fcn.004260cc
add esp, 0xc
test eax, eax
jne 0x41c51f
push ebx
call fcn.0042619c
pop ecx
push ebx
push str.SoftwareUpcheck
push esi
lea ecx, [ebp + 0x10]
call fcn.00424c76
test al, al
je 0x41c0dc
lea ecx, [ebp + 0xc]
call fcn.0042376d
lea ecx, [ebp + 8]
call fcn.0042376d
push 1
push str.ayacy_yoshibaworks.com
lea ecx, [ebp + 0x10]
mov esi, 0x11170
call fcn.00423773
push eax
lea ecx, [ebp + 0xc]
call fcn.00424c76
test al, al
je 0x41c0c4
push ebx
push 0x444d8c
push str.Author
lea ecx, [ebp + 0xc]
call fcn.00424bf5
push ebx
push str.http:__www.yoshibaworks.com_ayacy_inasoft_update.inf
push str.InfoURL
lea ecx, [ebp + 0xc]
call fcn.00424bf5
push ebx
push str.www.yoshibaworks.com
push str.DisplayHost
lea ecx, [ebp + 0xc]
call fcn.00424bf5
push 1
push 0x444d18
lea ecx, [ebp + 0xc]
call fcn.00423773
push eax
lea ecx, [ebp + 8]
call fcn.00424c76
test al, al
je 0x41c0bc
push 0x104
lea eax, [ebp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41bfcd
mov byte [ebp + 0x18], bl
push ebx
lea eax, [ebp + 0x18]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, ebx
mov dword [ebp - 0x28], eax
jbe 0x41c06e
add eax, 2
push eax
call fcn.0042629a
cmp eax, ebx
pop ecx
mov dword [ebp + 4], eax
je 0x41c06e
push eax
push dword [ebp - 0x28]
lea eax, [ebp + 0x18]
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x41c065
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x30]
push eax
push str.StringFileInfo041104b0FileVersion
push dword [ebp + 4]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41c065
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
push str._u__u__u__u
push dword [ebp - 0x30]
call fcn.004262ac
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp - 0x10]
lea eax, [eax + eax*4]
lea esi, [ecx + eax*2]
imul esi, esi, 0x64
add esp, 0x18
add esi, dword [ebp - 0x1c]
push dword [ebp + 4]
call fcn.004262e0
pop ecx
push esi
push str.Build
lea ecx, [ebp + 8]
call fcn.00424c13
push ebx
push 0x444d18
push str.DistinctName
lea ecx, [ebp + 8]
call fcn.00424bf5
push ebx
push 0x43f764
push str.DisplayName
lea ecx, [ebp + 8]
call fcn.00424bf5
push ebx
lea eax, [ebp + 0x18]
push eax
push str.FilePath
lea ecx, [ebp + 8]
call fcn.00424bf5
lea ecx, [ebp + 8]
call fcn.00423c52
lea ecx, [ebp + 0xc]
call fcn.00423c52
lea ecx, [ebp + 0x10]
call fcn.00423c52
lea ecx, [ebp + 8]
call fcn.00424888
lea ecx, [ebp + 0xc]
call fcn.00424888
mov edx, dword [0x44c350]
cmp edx, 1
jle 0x41c27f
mov esi, dword [0x44c354]
mov eax, dword [esi + 4]
cmp byte [eax], 0x2f
jne 0x41c1f2
mov cl, byte [eax + 1]
cmp cl, 0x49
je 0x41c10a
cmp cl, 0x69
jne 0x41c131
cmp byte [eax + 2], bl
jne 0x41c131
call fcn.0040e2a1
cmp byte [ebp + 0x17], bl
je 0x41c51f
push 0x40
push 0x444ce4
push 0x444bc0
push ebx
call edi
jmp 0x41c51f
cmp cl, 0x44
je 0x41c13f
cmp cl, 0x64
jne 0x41c27f
cmp edx, 2
jne 0x41c16a
cmp byte [ebp + 0x17], bl
je 0x41c160
push 0x10
push 0x444ba8
push 0x444b48
push ebx
call edi
xor ebx, ebx
inc ebx
jmp 0x41c51f
call fcn.0040e46f
jmp 0x41c51f
cmp byte [ebp + 0x17], bl
je 0x41c178
push 0x10
push 0x444b30
jmp 0x41c150
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x3c
push eax
call fcn.0042629a
cmp eax, ebx
pop ecx
mov dword [ebp + 4], eax
je 0x41c51f
mov ecx, dword [0x44c354]
push dword [ecx + 8]
push 0x444b04
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x24
mov esi, 0x444b30
push esi
push dword [ebp + 4]
push ebx
call edi
cmp eax, 6
jne 0x41c1e4
mov eax, dword [0x44c354]
push dword [eax + 8]
call fcn.0040e448
test al, al
pop ecx
mov eax, 0x444ae0
jne 0x41c1dd
mov eax, 0x444abc
push 0x40
push esi
push eax
push ebx
call edi
push dword [ebp + 4]
call fcn.004262e0
pop ecx
jmp 0x41c51f
cmp byte [ebp + 0x17], bl
je 0x41c208
push 0x10
push 0x444aa0
push 0x444a00
jmp 0x41c155
mov eax, dword [ebp + 0x128]
push 0x69
push eax
mov dword [ebp - 0x60], 0x30
mov dword [ebp - 0x5c], 3
mov dword [ebp - 0x58], 0x40db27
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push ebx
mov dword [ebp - 0x48], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x3c], 0x9d
mov dword [ebp - 0x38], str.helpdlg_rnsf7
mov dword [ebp - 0x34], ebx
call dword [sym.imp.USER32.dll_RegisterClassExA]
mov eax, dword [0x44c354]
mov eax, dword [eax + 4]
push ebx
call fcn.00416998
pop ecx
mov ebx, eax
jmp 0x41c51f
cmp byte [ebp + 0x17], bl
je 0x41c2cd
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x41c2bb
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x41c29f
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x41c158
push 0x30
push dword [0x44ac80]
push 0x444988
jmp 0x41c155
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
test ah, ah
jns 0x41c2ef
push 0x12
call esi
test ah, ah
jns 0x41c2ef
push 0x11
call esi
test ah, ah
js 0x41c42e
push ebx
push str.SoftwareInaSoftAnsRnsf7CurrentVersion
push connect
lea ecx, [ebp + 0x10]
call fcn.00424c76
test al, al
je 0x41c418
push 1
push str.bCategory
lea ecx, [ebp + 0x10]
call fcn.00424be0
test eax, eax
push 1
setne al
push str.bNavigator
lea ecx, [ebp + 0x10]
mov byte [0x44ac7c], al
call fcn.00424be0
test eax, eax
push ebx
setne al
push str.bDisableSplashWindow
lea ecx, [ebp + 0x10]
mov byte [0x44c9f1], al
call fcn.00424be0
push ebx
test eax, eax
push str.NoSaveSettings
lea ecx, [ebp + 0x10]
setne byte [ebp + 0x17]
call fcn.00424be0
test eax, eax
jne 0x41c3c7
mov esi, connect
push esi
push str.wLeft
lea ecx, [ebp + 0x10]
call fcn.00424be0
push ebx
push str.wTop
lea ecx, [ebp + 0x10]
mov dword [ebp - 8], eax
call fcn.00424be0
push esi
push str.wWidth
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x14], eax
call fcn.00424be0
push ebx
push str.wHeight
lea ecx, [ebp + 0x10]
mov dword [ebp - 0xc], eax
call fcn.00424be0
push ebx
push str.wMAX
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x18], eax
call fcn.00424be0
test eax, eax
je 0x41c3c7
mov dword [ebp + 0x134], 3
push ebx
push str.wLVStyle
lea ecx, [ebp + 0x10]
call fcn.00424be0
push ebx
push str.bLVFirstItemFile
lea ecx, [ebp + 0x10]
mov word [0x44c8b0], ax
call fcn.00424be0
test eax, eax
push ebx
setne al
push str.AutoUpdateCheck
lea ecx, [ebp + 0x10]
mov byte [0x44c8ac], al
call fcn.00424be0
test eax, eax
setne al
lea ecx, [ebp + 0x10]
mov byte [0x44c9f2], al
call fcn.00423c52
cmp byte [ebp + 0x17], bl
jne 0x41c42e
push 0xff
push str.RNSF7.BMP
call fcn.0041d283
pop ecx
pop ecx
mov dword [0x44eebc], eax
mov ebx, dword [ebp + 0x128]
call fcn.0041c541
test ax, ax
jne 0x41c457
call fcn.0041d387
push 0x10
push dword [0x44ac80]
xor ebx, ebx
push 0x444920
jmp 0x41c129
push dword [ebp + 0x134]
push dword [ebp - 0x18]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 8]
push ebx
call fcn.0041c5e0
mov esi, eax
xor ebx, ebx
add esp, 0x18
cmp esi, ebx
jne 0x41c491
call fcn.0041d387
push 0x10
push dword [0x44ac80]
push 0x4448f4
jmp 0x41c129
push ebx
push ebx
push 0x8003
push esi
mov byte [0x44c9e0], 1
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.0041d3a8
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x41c4f2
cmp eax, 0xffffffff
je 0x41c4ff
lea eax, [ebp - 0x7c]
push eax
push dword [0x44eecc]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x41c4f2
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x2c]
push esi
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x41c4f2
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x7c]
push ebx
push eax
call edi
cmp eax, ebx
jne 0x41c4b3
push ebx
push ebx
push ebx
call dword [sym.imp.WINMM.dll_PlaySoundA]
cmp dword [ebp], ebx
je 0x41c516
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ebx, dword [ebp - 0x74]
pop esi
lea ecx, [ebp + 0x10]
call fcn.00424888
mov ecx, dword [ebp + 0x11c]
pop edi
mov eax, ebx
pop ebx
call fcn.00428306
add ebp, 0x120
leave
ret 0x10