Function at 0x621200
Capabilities:
Enumerate gui resources
Log keystrokes via application hook
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a08d8
push 0x6745a4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbc
mov eax, dword [0x6d63d0]
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, 1
mov dword [ebp - 0xb8], esi
push fcn.00620cd0
call fcn.00674581
push fcn.00620cd0
call fcn.00671ddd
add esp, 8
call fcn.00620500
call fcn.006300c0
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
jne 0x621527
mov byte [ebp - 0xb1], bl
lea eax, [ebp - 0xb1]
push eax
push 0x620010
call dword [sym.imp.USER32.dll_EnumWindows]
cmp byte [ebp - 0xb1], bl
jne 0x621527
mov esi, dword [ebp + 8]
mov dword [0x76b690], esi
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0061fbc0
add esp, 4
call fcn.0062fc60
mov eax, esi
call fcn.006210f0
mov ecx, 0x25
xor eax, eax
lea edi, [ebp - 0xb0]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xb0], 0x94
mov byte [0x76ade0], bl
lea edx, [ebp - 0xb0]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x621302
mov eax, dword [ebp - 0xa0]
mov esi, 1
cmp eax, esi
jne 0x6212f4
mov byte [0x76ade0], bl
jmp 0x621307
cmp eax, 2
jne 0x621302
mov byte [0x76ade0], 1
jmp 0x621307
mov esi, 1
cmp byte [0x76ade0], bl
je 0x621328
push ebx
mov eax, dword [0x76b690]
push eax
push 0x61ff70
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x76b698], eax
mov eax, dword [0x76b68c]
cmp eax, ebx
je 0x621506
push 0xa
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x76b68c]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [0x76b68c]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [0x76b68c]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call fcn.0061fe60
mov ecx, dword [0x76b68c]
push ecx
call dword [sym.imp.USER32.dll_SetActiveWindow]
call fcn.0061fe60
mov dword [ebp - 0xbc], 0x68e414
call fcn.006301c0
call fcn.0061d720
cmp dword [0x76b6cc], esi
setne al
mov dword [0x76b6cc], esi
cmp al, bl
je 0x6213a7
call fcn.006206c0
xor edx, edx
cmp dword [0x76b6cc], esi
sete dl
shl edx, 6
add edx, 0x6d12d8
mov dword [0x6d1358], edx
mov esi, dword [sym.imp.USER32.dll_ShowCursor]
push ebx
call esi
test eax, eax
jge 0x6213c7
mov dword [ebp - 4], ebx
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push str._________________________________________________r_n
call fcn.00569b60
push str.True_Crime_PC_Log_File_r_n
call fcn.00569b60
push str.19:17:07
push str.Aug_12_2004
push str.Build_Time:__s__s_r_n
call fcn.00569b60
movzx ecx, word [ebp - 0xc2]
push ecx
movzx edx, word [ebp - 0xc4]
push edx
movzx eax, word [ebp - 0xcc]
push eax
movzx ecx, word [ebp - 0xc6]
push ecx
movzx edx, word [ebp - 0xca]
push edx
push str.Run_Time:__02u__02u__02u__02u:_02u_r_n
call fcn.00569b60
push str.SIMD_Version._r_n
call fcn.00569b60
push str._________________________________________________r_n
call fcn.00569b60
call fcn.004669a0
call fcn.00553b40
call fcn.005bfa00
call fcn.005a3100
call fcn.006200e0
lea eax, [ebp - 0xbc]
push eax
push ebx
call fcn.004eda90
add esp, 0x3c
mov dword [ebp - 0xb8], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x6214a8
push 1
call esi
test eax, eax
jl 0x6214a8
mov byte [0x76b69d], 1
cmp byte [0x76ade0], bl
je 0x6214cf
mov eax, dword [0x76b698]
cmp eax, ebx
je 0x6214cf
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call fcn.0061d840
call fcn.0062e020
call fcn.00620660
mov eax, dword [0x76b68c]
cmp eax, ebx
je 0x6214f4
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x76b68c], ebx
mov edx, dword [0x76b690]
push edx
push 0x6a06fc
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.00671b23
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov dword [0x76b688], esi
push ebx
call fcn.006731ab
int3