Function at 0x1004d57
Capabilities:
Check mutex on windows
Enumerate gui resources
Log keystrokes via polling
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
push 0x100199c
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x1005159
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1005150
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0x10]
mov dword [0x10196d4], eax
call fcn.01004b1b
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, 4
jne 0x1004dcf
push 0x1001e10
push edi
push edi
push 0x1001e08
push 0x414
push 0x10017dc
call fcn.0100390a
push 0x83
call fcn.010047af
add esp, 0x1c
jmp 0x1004e11
call fcn.01004c60
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
je 0x1004eb0
cmp eax, edi
jne 0x1004e1d
cmp esi, edi
je 0x1004e1d
push esi
push 0x1001dc0
push edi
push edi
push 0x1001e08
push 0x422
push 0x10017dc
call fcn.0100390a
push 0x83
call fcn.010047af
add esp, 0x20
mov dword [ebp + 0x10], 0xfffffff7
jmp 0x1005141
call fcn.0100422e
test eax, eax
je 0x1004e5d
push 0x1001d7c
push edi
push edi
push 0x1001e08
push 0x42a
push 0x10017dc
call fcn.0100390a
add esp, 0x18
cmp dword [0x10196ec], edi
jne 0x1004e54
push 0x67
call fcn.010047af
pop ecx
or dword [ebp + 0x10], 0xffffffff
jmp 0x1005141
call fcn.01003c3f
test eax, eax
jne 0x1004e88
push 0x1001d3c
push edi
push edi
push 0x1001e08
push 0x432
push 0x10017dc
call fcn.0100390a
add esp, 0x18
push 0xfffffffffffffff1
jmp 0x1004eb2
push esi
call fcn.01003f72
test eax, eax
jne 0x1004ed4
push 0x1001d1c
push edi
push edi
push 0x1001e08
push 0x45e
push 0x10017dc
call fcn.0100390a
add esp, 0x18
push 0xfffffffffffffff7
pop esi
cmp dword [0x10196ec], edi
jne 0x1004ecc
mov eax, esi
cdq
xor eax, edx
sub eax, edx
add eax, 0x69
push eax
call fcn.010047af
pop ecx
mov dword [ebp + 0x10], esi
jmp 0x1005141
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
push 0x8001
call esi
push 0x1001d10
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebx
mov dword [0x10196e4], eax
call esi
mov eax, dword [0x10196e4]
cmp eax, edi
je 0x1005110
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001d00
push eax
call esi
push 0x1001ce8
push dword [0x10196e4]
mov dword [0x10196d8], eax
call esi
push 0x1001cd0
push dword [0x10196e4]
mov dword [0x10196dc], eax
call esi
mov dword [0x10196e0], eax
cmp dword [0x10196d8], edi
je 0x10050b4
mov ecx, dword [0x10196dc]
cmp ecx, edi
je 0x10050b4
cmp eax, edi
je 0x10050b4
mov esi, 0x1004570
push esi
call ecx
mov eax, dword [0x10196dc]
cmp eax, edi
je 0x1004f79
cmp dword [0x10196ec], edi
je 0x1004f79
push esi
call eax
mov eax, dword [ebp - 8]
cmp eax, 3
jne 0x1005005
push 0x2010098
push edi
push edi
call dword [0x10196d8]
mov esi, eax
mov dword [ebp + 0x10], esi
call fcn.01004090
cmp esi, 1
jne 0x1004fe0
push 0x68
call fcn.010047af
pop ecx
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1004fc2
push 0x10018bc
call fcn.010037b8
jmp 0x1004fff
push 0x10018d0
call fcn.010037b8
pop ecx
call fcn.01004163
push edi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1005140
cmp esi, 0xfffffff7
jne 0x1004fef
call fcn.0100495a
jmp 0x1005140
mov eax, esi
cdq
xor eax, edx
sub eax, edx
add eax, 0x69
push eax
call fcn.010047af
pop ecx
jmp 0x1005140
cmp eax, 1
je 0x100509a
cmp eax, 2
je 0x100509a
cmp dword [0x10196ec], edi
jne 0x100509a
cmp eax, edi
jne 0x1005077
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [0x10196e4]
cmp eax, edi
je 0x100506d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x1005067
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x1005067
push edi
push eax
push 0x1001898
push 0x1001e08
push 0x4d4
push 0x10017dc
call fcn.0100390a
add esp, 0x18
jmp 0x100506d
mov dword [0x10196e4], edi
push dword [ebp + 8]
call fcn.01006964
jmp 0x10050aa
push 0x1001cb4
push edi
push edi
push 0x1001e08
push 0x4df
push 0x10017dc
call fcn.0100390a
add esp, 0x18
jmp 0x1005140
push 0x2010098
push edi
push edi
call dword [0x10196d8]
mov dword [ebp + 0x10], eax
call fcn.01004090
jmp 0x1005140
push 0x1001ca0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100160c
mov ebx, 0x1001e08
push ebx
push 0x47b
mov esi, 0x10017dc
push esi
call fcn.0100390a
add esp, 0x18
push dword [0x10196e4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x1005139
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x1005139
push edi
push eax
push 0x1001898
push ebx
push 0x47e
push esi
call fcn.0100390a
add esp, 0x18
jmp 0x1005139
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10015a8
push 0x1001e08
push 0x487
push 0x10017dc
call fcn.0100390a
add esp, 0x18
call fcn.0100495a
mov dword [ebp + 0x10], 0xfffffff7
pop ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x10]
pop esi
jmp 0x1005168
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0x1004288
call dword [sym.imp.USER32.dll_EnumWindows]
push 0xfffffffffffffff7
pop eax
pop edi
leave
ret 0x10