Function at 0x426f80
Capabilities:
Check mutex on windows
Get common file path
Log keystrokes via polling

Disassembly:
sub esp, 0x284
mov eax, dword [0x4bacc0]
xor eax, esp
mov dword [esp + 0x280], eax
push ebx
mov ebx, dword [esp + 0x294]
push ebp
push esi
mov esi, dword [esp + 0x294]
push edi
mov dl, 0x69
mov cl, 0x2c
mov al, 0xbc
xor ebp, ebp
push ebp
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x84], 0x8d
mov byte [esp + 0x85], 0x78
mov byte [esp + 0x86], 0xaf
mov byte [esp + 0x87], 0xa0
mov byte [esp + 0x88], 0xa7
mov byte [esp + 0x89], dl
mov byte [esp + 0x8a], cl
mov byte [esp + 0x8b], 0x17
mov byte [esp + 0x8c], al
mov byte [esp + 0x8d], 0x24
mov byte [esp + 0x8e], 0x89
mov byte [esp + 0x8f], 0x1f
mov byte [esp + 0x90], al
mov byte [esp + 0x91], 0x41
mov byte [esp + 0x92], 0xa
mov byte [esp + 0x93], 0x28
mov dword [esp + 0x18], ebp
mov dword [esp + 0x74], 0x9e7beacb
mov word [esp + 0x78], 0x33f4
mov word [esp + 0x7a], 0x4c97
mov byte [esp + 0x7c], 0x97
mov byte [esp + 0x7d], 0x75
mov byte [esp + 0x7e], 0x23
mov byte [esp + 0x7f], 0x9b
mov byte [esp + 0x80], 0xb8
mov byte [esp + 0x81], cl
mov byte [esp + 0x82], dl
mov byte [esp + 0x83], 0xe
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 8
mov dword [esp + 0x24], 0x4ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov dword [0x4def38], esi
call fcn.0046d190
push 0x4defbc
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x4dec2c
push 0x4dec28
call fcn.004323d0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100
lea ecx, [esp + 0x94]
push ecx
push ebp
call esi
push 0x4deeb8
push 0x4dee38
push 0x4dedb8
push 0x4ded98
push 0x4ded18
push 0x4dec98
push 0x4dec94
push ebp
push 0x4dec90
lea edx, [esp + 0xb4]
push 0x4dec8c
push edx
call fcn.00475b00
mov eax, dword [0x49f2f0]
mov cl, byte [0x49f2f4]
add esp, 0x2c
mov dword [0x4dec98], eax
mov byte [0x4dec9c], cl
push 0x100
lea edx, [esp + 0x94]
mov eax, dword [0x4def38]
push edx
push eax
call esi
lea ecx, [esp + 0x90]
push 0x5c
push ecx
call fcn.004818d0
mov edx, dword [str.Reso.dll]
add eax, 1
mov dword [eax], edx
mov ecx, dword [0x49f2e8]
mov dword [eax + 4], ecx
mov dl, byte [0x49f2ec]
mov byte [eax + 8], dl
add esp, 8
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebp
mov dword [0x4def3c], eax
jne 0x42719d
mov ecx, dword [0x4def38]
mov dword [0x4def3c], ecx
push 0x60
call fcn.0046d6b0
add esp, 4
mov edx, 0x509fb8
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx], cl
add eax, 1
add edx, 1
test cl, cl
jne 0x4271b0
mov edx, dword [0x4def38]
push 0x84
push edx
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push str.SoftwareEasySystemsZulu2
mov dword [0x4defb8], eax
call fcn.004700b0
add esp, 4
push str.JJAPPMAIN
push 1
push ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x427255
push ebp
push str.JJAPPMAIN
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
jne 0x427221
push 5
push esi
call edi
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x427231
push 9
push esi
call edi
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
movzx eax, ax
push eax
push 0x465
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x427b35
mov eax, dword [0x4dec28]
cmp eax, 0x44b
jl 0x427b17
cmp eax, 0x5dc
je 0x427b17
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x42729e
mov ecx, dword [0x4def38]
push ebp
push 0x469030
push ebp
push 0x8a
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test eax, eax
je 0x427b35
cmp dword [0x4dec28], 0x834
jge 0x4272bc
push str.QueryCancelAutoPlay
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x4defd4], eax
jmp 0x4272e6
call fcn.0045e4e0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x74]
push eax
call fcn.0045d540
add esp, 8
cmp dword [0x50a364], ebp
je 0x4272e6
push str.ZuluCancelAutoplay
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
cmp dword [0x4dec08], ebp
mov esi, eax
je 0x427309
mov dword [0x4defd8], 0x10
jmp 0x427317
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [0x4defd8], eax
mov ecx, dword [0x4fcfbc]
push esi
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [0x50a3b4], ebp
je 0x427346
call fcn.0046d4b0
test eax, eax
je 0x427346
push 0xc8
push 0x96
call dword [sym.imp.KERNEL32.dll_Beep]
call fcn.0045de10
call fcn.0045e150
xor eax, eax
cmp dword [0x50a178], ebp
mov edi, 0x44c
je 0x42736e
cmp dword [0x4dec28], edi
setle al
lea eax, [eax + eax + 0xc]
jmp 0x42737b
cmp dword [0x4dec28], edi
setle al
lea eax, [eax + eax + 0xb]
push ebp
push ebp
push 0x4dec6c
lea edx, [esp + 0x8c]
push edx
push eax
mov dword [0x4dec0c], eax
xor esi, esi
call fcn.00430f80
cmp eax, 0x5c
je 0x4273fe
mov ebp, 0xd
mov ebx, 0xb
test eax, eax
je 0x427487
test esi, esi
jne 0x42743e
xor eax, eax
cmp dword [0x4dec28], edi
mov esi, 1
jg 0x4273d2
cmp dword [0x4dec0c], ebp
sete al
add eax, ebp
jmp 0x4273dd
cmp dword [0x4dec0c], ebx
sete al
add eax, ebx
push 0
push 0
push 0x4dec6c
lea ecx, [esp + 0x8c]
push ecx
push eax
mov dword [0x4dec0c], eax
call fcn.00430f80
cmp eax, 0x5c
jne 0x4273a6
push eax
push 0
call fcn.0046de30
add esp, 8
lea edx, [esp + 0x90]
mov cl, byte [eax]
mov byte [edx], cl
add eax, 1
add edx, 1
test cl, cl
jne 0x427410
push 0x10
push 0x4dec98
lea edx, [esp + 0x98]
push edx
push 0
call fcn.00470860
add esp, 0x10
xor ebp, ebp
jmp 0x427937
push eax
xor eax, eax
cmp dword [0x4dec28], edi
setle al
add eax, 0x191
push eax
call fcn.0046d6b0
add esp, 4
push eax
lea ecx, [esp + 0x98]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x10
push 0x4dec98
lea edx, [esp + 0xa4]
push edx
push 0
call fcn.00470860
add esp, 0x1c
xor ebp, ebp
jmp 0x427937
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100
lea eax, [esp + 0x94]
push eax
call esi
lea eax, [esp + 0x90]
add eax, 0xffffffff
cmp dword [0x4dec0c], ebp
jne 0x4274e8
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x4274b0
mov ecx, dword [str.IosubsysPzVXD.vxd]
mov edx, dword [0x49f2a0]
mov dword [eax], ecx
mov ecx, dword [0x49f2a4]
mov dword [eax + 4], edx
mov edx, dword [0x49f2a8]
mov dword [eax + 8], ecx
mov ecx, dword [0x49f2ac]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
jmp 0x427529
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x4274e8
mov edx, dword [str.DriversPzWDM.sys]
mov ecx, dword [0x49f28c]
mov dword [eax], edx
mov edx, dword [0x49f290]
mov dword [eax + 4], ecx
mov ecx, dword [0x49f294]
mov dword [eax + 8], edx
mov dx, word [0x49f298]
mov dword [eax + 0xc], ecx
mov cl, byte [0x49f29a]
mov word [eax + 0x10], dx
mov byte [eax + 0x12], cl
push 0
push 0
push 0
push 0
push 0
push 0
push 0x4dec18
push 0
push 0x4dec14
lea edx, [esp + 0xb4]
push 0x4dec10
push edx
call fcn.00475b00
mov eax, dword [0x4dec0c]
add eax, 0xfffffff5
add esp, 0x2c
cmp eax, 3
ja case.default.0x427567
jmp dword [eax*4 + 0x427b78]
mov eax, dword [str.PzWDM.sys]
mov ecx, dword [0x49f280]
mov dx, word [0x49f284]
mov dword [0x4dec7c], eax
mov dword [0x4dec80], ecx
mov word [0x4dec84], dx
jmp 0x427621
mov eax, dword [0x49f274]
mov cl, byte [0x49f278]
mov dword [0x4dec7c], eax
mov byte [0x4dec80], cl
jmp 0x427621
mov edx, dword [str.PzVXD.vxd]
mov cx, word [0x49f270]
mov eax, dword [0x49f26c]
mov dword [0x4dec7c], edx
mov word [0x4dec84], cx
jmp 0x42761c
mov edx, dword [str.WinASPI32]
mov cx, word [0x49f264]
mov eax, dword [0x49f260]
mov dword [0x4dec7c], edx
mov word [0x4dec84], cx
jmp 0x42761c
mov edx, dword [str.Device_Driver]
mov ecx, dword [0x49f254]
mov eax, dword [0x49f250]
mov dword [0x4dec7c], edx
mov dx, word [0x49f258]
mov dword [0x4dec84], ecx
mov word [0x4dec88], dx
mov dword [0x4dec80], eax
push 0x100
lea eax, [esp + 0x94]
push eax
call esi
lea eax, [esp + 0x90]
add eax, 0xffffffff
lea ebx, [ebx]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x427640
mov ecx, dword [str.wmvcore.dll]
mov edx, dword [0x49f240]
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [eax], ecx
mov ecx, dword [0x49f244]
push 0x4dec24
mov dword [eax + 4], edx
mov dl, byte [0x49f248]
push 0
mov dword [eax + 8], ecx
push 0x4dec20
mov byte [eax + 0xc], dl
lea eax, [esp + 0xb4]
push 0x4dec1c
push eax
call fcn.00475b00
add esp, 0x2c
cmp dword [0x4dea00], 0
je 0x4276af
push 0x4dea04
push 1
call fcn.004324e0
call fcn.00467150
xor eax, eax
jmp 0x4276c0
mov cl, byte [eax + 0x4dec7c]
mov byte [esp + eax + 0x190], cl
add eax, 1
test cl, cl
jne 0x4276c0
mov eax, dword [0x4dec0c]
cmp eax, ebx
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x4276e7
cmp eax, ebp
jne 0x427723
lea eax, [esp + 0x190]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4276f1
mov ecx, dword [0x4dec18]
push ecx
mov ecx, dword [0x4dec10]
sub eax, edx
mov edx, dword [0x4dec14]
push edx
push ecx
lea edx, [esp + eax + 0x19c]
push str.__d._d._03d
push edx
call esi
add esp, 0x14
mov ecx, dword [0x4dec94]
mov edx, dword [0x4dec90]
lea eax, [esp + 0x190]
push eax
mov eax, dword [0x4dec8c]
push 0x4dec6c
push ecx
push edx
push eax
lea ecx, [esp + 0x224]
push str._d._d._03d__PzMDK__s_via__s_
push ecx
call esi
mov edx, dword [0x4dec24]
mov eax, dword [0x4dec20]
mov ecx, dword [0x4dec1c]
push edx
push eax
push ecx
lea edx, [esp + 0x1b8]
push str._d._d._03d
push edx
call esi
lea eax, [esp + 0x1c0]
push eax
push 0x4dec2c
lea ecx, [esp + 0x248]
push ecx
push 0x4dec98
push 0x6a5
call fcn.004683f0
mov edx, dword [0x4def38]
add esp, 0x44
push 0x83
push edx
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push 0x30
mov dword [esp + 0x14], eax
lea eax, [esp + 0x44]
push 0
push eax
call fcn.00481440
mov ecx, dword [0x4def38]
add esp, 0xc
push 0x7f00
push 0
mov dword [esp + 0x48], 0x30
mov dword [esp + 0x70], str.JJAPPMAIN
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x50], 0x422a60
call dword [sym.imp.USER32.dll_LoadCursorA]
push 5
mov dword [esp + 0x60], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edx, dword [0x4def38]
mov esi, dword [sym.imp.USER32.dll_LoadImageA]
push 0x40
push 0
push 0
push 1
push 0x1389
push edx
mov dword [esp + 0x78], eax
call esi
push 0
push 0x10
push 0x10
push 1
mov dword [esp + 0x68], eax
mov eax, dword [0x4def38]
push 0x1389
push eax
call esi
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x70], eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x4dec98]
mov byte [esp + eax + 0x90], cl
add eax, 1
test cl, cl
jne 0x427850
mov edx, dword [0x4def38]
mov eax, dword [0x50a184]
mov ecx, dword [0x50a18c]
push 0
push edx
mov edx, dword [0x50a188]
push 0
push 0
sub ecx, eax
push ecx
mov ecx, dword [0x50a180]
sub edx, ecx
push edx
mov edx, dword [esp + 0x80]
push eax
mov eax, dword [0x50a190]
neg eax
sbb eax, eax
push ecx
and eax, 0x1000000
or eax, 0xcf0000
push eax
lea ecx, [esp + 0xb4]
push ecx
push edx
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov eax, dword [0x4fcfbc]
mov ecx, dword [0x4def38]
push 0
push 0x463750
push eax
push 0x6c
push ecx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 0x3e8
mov dword [0x4fcf2c], eax
call fcn.0045db70
add esp, 4
push eax
call fcn.00432430
call fcn.00469810
test eax, eax
jne 0x42799c
push 0xfa
call fcn.00432430
cmp dword [0x50a17c], 0
jle 0x42791a
push 0
call fcn.0045eae0
add esp, 4
mov eax, dword [0x4def3c]
cmp eax, dword [0x4def38]
je 0x42792e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebp, dword [esp + 0x10]
call fcn.00432530
cmp dword [0x4dec28], 0x834
jl 0x427b35
cmp dword [esp + 0x14], 0
je 0x427b35
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
push str.ZuluCancelAutoplay
call esi
movzx eax, ax
test ax, ax
je 0x427982
mov edi, dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
lea ecx, [ecx]
push eax
call edi
push str.ZuluCancelAutoplay
call esi
movzx eax, ax
test ax, ax
jne 0x427970
mov eax, dword [esp + 0x14]
test eax, eax
je 0x427b35
push eax
call fcn.0045d440
add esp, 4
jmp 0x427b35
mov ebx, dword [esp + 0x18]
mov edi, 0x49f160
mov esi, ebx
mov ecx, 4
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4279db
mov eax, dword [0x4fcfbc]
push edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1f4
call fcn.0045db70
add esp, 4
push eax
call fcn.00432430
mov ecx, dword [0x4fcf2c]
push ecx
jmp 0x427a24
mov edi, 0x49f158
mov esi, ebx
mov ecx, 4
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x427a34
mov ecx, dword [0x4fcfbc]
xor eax, eax
cmp dword [0x50a190], edx
setne al
lea eax, [eax + eax + 1]
push eax
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1f4
call fcn.0045db70
add esp, 4
push eax
call fcn.00432430
mov edx, dword [0x4fcf2c]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x4fcf2c], 0
cmp byte [ebx], 0
je 0x427a5b
push 0x3e8
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, dword [0x4fcfbc]
movzx eax, ax
push eax
push 0x465
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0
push 0
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x427adf
mov esi, dword [sym.imp.USER32.dll_TranslateAcceleratorA]
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageA]
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x427a90
mov ecx, dword [esp + 0x10]
mov edx, dword [0x4fcfbc]
lea eax, [esp + 0x24]
push eax
push ecx
push edx
call esi
test eax, eax
jne 0x427aca
mov eax, dword [0x4fcf38]
test eax, eax
je 0x427abc
lea ecx, [esp + 0x24]
push ecx
push eax
call edi
test eax, eax
jne 0x427aca
lea edx, [esp + 0x24]
push edx
call ebp
lea eax, [esp + 0x24]
push eax
call ebx
push 0
push 0
push 0
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x427a90
mov ebp, dword [esp + 0x2c]
call fcn.00469eb0
push 0
push 0
push 0x49e5e0
push 0x49e5e0
push 0x6a6
call fcn.004683f0
call fcn.004672b0
push str.SoftwareEasySystemsZulu2
call fcn.0046d270
add esp, 0x18
jmp 0x427932
push 0x10
push 0x4dec98
push 0x195
call fcn.0046d6b0
add esp, 4
push eax
push ebp
call fcn.00470860
add esp, 0x10
push 0x4defbc
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [0x4def3c]
cmp eax, dword [0x4def38]
je 0x427b54
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x290]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.004810ab
add esp, 0x284
ret 0x10