Function at 0x1002f44
Capabilities:
Check mutex on windows
Enumerate gui resources
Log keystrokes via polling
Set current directory
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
xor esi, esi
push 0x10014d8
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, esi
mov dword [ebp - 8], eax
je 0x1003279
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1003279
mov eax, dword [ebp + 8]
push 0x104
lea ecx, [ebp - 0x110]
push ecx
push eax
mov dword [0x100ab8c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, eax
cmp ebx, esi
je 0x100328e
jle 0x1002fb4
cmp byte [ebp + ebx - 0x110], 0x5c
je 0x1002fb4
dec ebx
cmp ebx, esi
jg 0x1002fa5
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x110]
push eax
mov edi, 0x100ab98
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + 0x100ab97], 0x5c
je 0x1002fe1
dec edi
dec eax
cmp byte [edi + eax], 0x5c
jne 0x1002fda
and byte [eax + 0x100ab98], 0
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x10014cc
lea ebx, [ebp + ebx - 0x110]
push ebx
mov dword [ebp - 0xc], eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x110]
push eax
call edi
test eax, eax
mov dword [0x100aca4], eax
jne 0x1003077
push 0x10014c0
push ebx
call esi
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x10014ac
push ebx
call esi
lea eax, [ebp - 0x110]
push eax
call edi
test eax, eax
mov dword [0x100aca4], eax
jne 0x1003077
push 0x10014a8
push ebx
call esi
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x1001498
push ebx
call esi
lea eax, [ebp - 0x110]
push eax
call edi
mov dword [0x100aca4], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [0x100aca4]
test eax, eax
je 0x1003272
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001488
push eax
call esi
push 0x1001470
push dword [0x100aca4]
mov dword [0x100ab94], eax
call esi
push 0x1001458
push dword [0x100aca4]
mov dword [0x100ac9c], eax
call esi
mov dword [0x100aca0], eax
mov eax, dword [0x100ac9c]
test eax, eax
mov edi, 0x100231d
je 0x10030d5
push edi
call eax
mov esi, dword [ebp + 0x10]
push esi
call fcn.01003a03
pop ecx
push esi
call fcn.0100282e
cmp dword [0x100ac9c], 0
je 0x1003121
push 0x10013b0
push esi
call fcn.010038d0
test eax, eax
pop ecx
pop ecx
jne 0x1003110
push 0x10013a0
push esi
call fcn.010038d0
test eax, eax
pop ecx
pop ecx
je 0x1003121
push edi
call dword [0x100ac9c]
mov dword [0x100acb0], 1
test esi, esi
je 0x1003237
cmp byte [esi], 0
je 0x1003237
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ebx, 0x10013c8
push ebx
push esi
call edi
test eax, eax
je 0x1003237
cmp dword [0x100aca4], 0
je 0x1003237
push 0x10013b8
push esi
call edi
test eax, eax
jne 0x10031d6
push 0x2010098
xor esi, esi
push esi
push esi
call dword [0x100ab94]
cmp eax, 1
mov dword [ebp - 4], eax
jne 0x10031b6
push 0x68
call fcn.0100256b
pop ecx
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x100319c
push esi
call fcn.010029ff
xor eax, eax
inc eax
jmp 0x1003291
push 1
call fcn.010029ff
call fcn.01002658
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1003254
cmp eax, 0xfffffff7
jne 0x10031c5
call fcn.010026d3
jmp 0x1003254
cdq
xor eax, edx
sub eax, edx
add eax, 0x69
push eax
call fcn.0100256b
pop ecx
jmp 0x1003254
cmp dword [0x100aca4], 0
je 0x1003237
push 0x10013b0
push esi
call fcn.010038d0
test eax, eax
pop ecx
pop ecx
jne 0x1003201
push 0x10013a0
push esi
call fcn.010038d0
test eax, eax
pop ecx
pop ecx
je 0x1003237
push 0x2010098
xor edi, edi
push edi
push edi
call dword [0x100ab94]
cmp eax, 1
mov dword [ebp - 4], eax
jne 0x1003254
push ebx
push esi
call fcn.010038d0
test eax, eax
pop ecx
pop ecx
je 0x1003254
push 1
call fcn.010029ff
call fcn.01002658
push edi
jmp 0x10031a9
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
push 0x1002e15
push 0
push 0x3e8
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov eax, dword [0x100aca4]
test eax, eax
je 0x1003264
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
jmp 0x1003291
call fcn.010026d3
jmp 0x100328e
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x1002ce6
call dword [sym.imp.USER32.dll_EnumWindows]
push 0xfffffffffffffff7
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10