Function at 0x1005af6
Capabilities:
Check mutex on windows
Enumerate gui resources
Log keystrokes via polling
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
push 0x1001978
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x1005ef8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1005eef
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0x10]
mov dword [0x1014294], eax
call fcn.010058ba
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, 4
jne 0x1005b6e
push 0x1001da0
push edi
push edi
push 0x1001d98
push 0x413
push 0x10017b8
call fcn.0100470a
push 0x83
call fcn.01005551
add esp, 0x1c
jmp 0x1005bb0
call fcn.010059ff
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
je 0x1005c4f
cmp eax, edi
jne 0x1005bbc
cmp esi, edi
je 0x1005bbc
push esi
push 0x1001d50
push edi
push edi
push 0x1001d98
push 0x421
push 0x10017b8
call fcn.0100470a
push 0x83
call fcn.01005551
add esp, 0x20
mov dword [ebp + 0x10], 0xfffffff7
jmp 0x1005ee0
call fcn.01004fd0
test eax, eax
je 0x1005bfc
push 0x1001d0c
push edi
push edi
push 0x1001d98
push 0x429
push 0x10017b8
call fcn.0100470a
add esp, 0x18
cmp dword [0x10142ac], edi
jne 0x1005bf3
push 0x67
call fcn.01005551
pop ecx
or dword [ebp + 0x10], 0xffffffff
jmp 0x1005ee0
call fcn.010049e8
test eax, eax
jne 0x1005c27
push 0x1001ccc
push edi
push edi
push 0x1001d98
push 0x431
push 0x10017b8
call fcn.0100470a
add esp, 0x18
push 0xfffffffffffffff1
jmp 0x1005c51
push esi
call fcn.01004d14
test eax, eax
jne 0x1005c73
push 0x1001cac
push edi
push edi
push 0x1001d98
push 0x45d
push 0x10017b8
call fcn.0100470a
add esp, 0x18
push 0xfffffffffffffff7
pop esi
cmp dword [0x10142ac], edi
jne 0x1005c6b
mov eax, esi
cdq
xor eax, edx
sub eax, edx
add eax, 0x69
push eax
call fcn.01005551
pop ecx
mov dword [ebp + 0x10], esi
jmp 0x1005ee0
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
push 0x8001
call esi
push 0x1001abc
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebx
mov dword [0x10142a4], eax
call esi
mov eax, dword [0x10142a4]
cmp eax, edi
je 0x1005eaf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001c9c
push eax
call esi
push 0x1001c84
push dword [0x10142a4]
mov dword [0x1014298], eax
call esi
push 0x1001c6c
push dword [0x10142a4]
mov dword [0x101429c], eax
call esi
mov dword [0x10142a0], eax
cmp dword [0x1014298], edi
je 0x1005e53
mov ecx, dword [0x101429c]
cmp ecx, edi
je 0x1005e53
cmp eax, edi
je 0x1005e53
mov esi, 0x1005312
push esi
call ecx
mov eax, dword [0x101429c]
cmp eax, edi
je 0x1005d18
cmp dword [0x10142ac], edi
je 0x1005d18
push esi
call eax
mov eax, dword [ebp - 8]
cmp eax, 3
jne 0x1005da4
push 0x2010098
push edi
push edi
call dword [0x1014298]
mov esi, eax
mov dword [ebp + 0x10], esi
call fcn.01004e32
cmp esi, 1
jne 0x1005d7f
push 0x68
call fcn.01005551
pop ecx
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1005d61
push 0x1001898
call fcn.010045b8
jmp 0x1005d9e
push 0x10018ac
call fcn.010045b8
pop ecx
call fcn.01004f05
push edi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1005edf
cmp esi, 0xfffffff7
jne 0x1005d8e
call fcn.010056fc
jmp 0x1005edf
mov eax, esi
cdq
xor eax, edx
sub eax, edx
add eax, 0x69
push eax
call fcn.01005551
pop ecx
jmp 0x1005edf
cmp eax, 1
je 0x1005e39
cmp eax, 2
je 0x1005e39
cmp dword [0x10142ac], edi
jne 0x1005e39
cmp eax, edi
jne 0x1005e16
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [0x10142a4]
cmp eax, edi
je 0x1005e0c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x1005e06
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x1005e06
push edi
push eax
push 0x1001874
push 0x1001d98
push 0x4d3
push 0x10017b8
call fcn.0100470a
add esp, 0x18
jmp 0x1005e0c
mov dword [0x10142a4], edi
push dword [ebp + 8]
call fcn.01007764
jmp 0x1005e49
push 0x1001c50
push edi
push edi
push 0x1001d98
push 0x4de
push 0x10017b8
call fcn.0100470a
add esp, 0x18
jmp 0x1005edf
push 0x2010098
push edi
push edi
call dword [0x1014298]
mov dword [ebp + 0x10], eax
call fcn.01004e32
jmp 0x1005edf
push 0x1001c3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10015ec
mov ebx, 0x1001d98
push ebx
push 0x47a
mov esi, 0x10017b8
push esi
call fcn.0100470a
add esp, 0x18
push dword [0x10142a4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x1005ed8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x1005ed8
push edi
push eax
push 0x1001874
push ebx
push 0x47d
push esi
call fcn.0100470a
add esp, 0x18
jmp 0x1005ed8
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001588
push 0x1001d98
push 0x486
push 0x10017b8
call fcn.0100470a
add esp, 0x18
call fcn.010056fc
mov dword [ebp + 0x10], 0xfffffff7
pop ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x10]
pop esi
jmp 0x1005f07
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0x100502a
call dword [sym.imp.USER32.dll_EnumWindows]
push 0xfffffffffffffff7
pop eax
pop edi
leave
ret 0x10