Function at 0x402c70
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0xa48
mov eax, dword [0x4280f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x801
lea eax, [ebp - 0x820]
push 0
push eax
call fcn.0040b2e0
push 0
call fcn.0040cb35
mov dword [ebp - 0x828], eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x84c]
push eax
mov dword [ebp - 0x824], edx
call fcn.0040c8bd
push 0x420560
call fcn.0040a680
push 0x14
lea eax, [ebp - 0x18]
push eax
push 0x42d40c
mov dword [ebp - 0x18], 0x20202020
mov dword [ebp - 0x14], 0x20202020
mov dword [ebp - 0x10], 0x20202020
mov dword [ebp - 0xc], 0x20202020
mov dword [ebp - 8], 0x20202020
call fcn.0040c030
push 0x42d40c
lea eax, [ebp - 0x820]
push str.checkMain:
push eax
call fcn.0040b03e
lea eax, [ebp - 0x820]
push eax
call fcn.0040a680
add esp, 0x38
call fcn.00404600
test al, al
jne 0x402d68
push 0x420598
call fcn.0040a680
push 0x4205dc
call fcn.0040a680
add esp, 8
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b2c3
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00404000
mov byte [0x42c3e1], al
call fcn.0040a550
call fcn.00404bb0
call fcn.00405a40
test al, al
jne 0x402da6
push 0x4205f8
call fcn.0040a680
add esp, 4
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00405a40
test al, al
je 0x402d53
push 0
call fcn.0040cb35
mov dword [ebp - 0x828], eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x884]
push eax
mov dword [ebp - 0x824], edx
call fcn.0040c8bd
mov eax, dword [ebp - 0x84c]
cdq
mov esi, eax
mov eax, dword [ebp - 0x884]
push edx
cdq
push esi
push edx
push eax
call fcn.0040c7e6
add esp, 0x1c
fstp qword [ebp - 0xa40]
cvttsd2si eax, qword [ebp - 0xa40]
mov dword [0x42c3e8], eax
call fcn.00404220
test eax, eax
jne 0x402e30
push 0x420644
call fcn.0040a680
push 0x4205dc
call fcn.0040a680
add esp, 8
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b2c3
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00404500
xorps xmm0, xmm0
push 0x42e240
movq qword [0x42e240], xmm0
movq qword [0x42e248], xmm0
mov word [0x42e250], 0
call fcn.004011f0
call fcn.00403b00
push 0
call fcn.0040cb35
mov dword [ebp - 0x828], eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x84c]
push eax
mov dword [ebp - 0x824], edx
call fcn.0040c8bd
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add esp, 0x10
push 0x42e254
call edi
cmp byte [0x42c3e2], 1
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
je 0x403243
lea esp, [esp]
lea eax, [ebp - 0xa30]
push eax
push 0x42d428
mov byte [ebp - 0xa31], 1
mov dword [ebp - 0xa30], 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
movzx ecx, byte [ebp - 0xa31]
xor edx, edx
cmp eax, 0xffffffff
cmove ecx, edx
push eax
mov dword [ebp - 0xa3c], ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [ebp - 0xa3c], 0
jne 0x402f05
push str.X400100002.exe
call fcn.0040a680
add esp, 4
call fcn.00403e80
test al, al
jne 0x402f1b
push 0x42068c
call fcn.0040a680
add esp, 4
push str.Mutex_object_for_X400100002W.exe
push 0
push 0x1f0001
mov byte [ebp - 0xa31], 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov esi, eax
movzx eax, byte [ebp - 0xa31]
mov ecx, 1
test esi, esi
cmovne eax, ecx
push esi
mov dword [ebp - 0xa3c], eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0xa3c], 0
jne 0x402fce
push 0x4206cc
call fcn.0040a680
push 0x44
lea eax, [ebp - 0x8f0]
xorps xmm0, xmm0
push 0
push eax
movdqa xmmword [ebp - 0x860], xmm0
call fcn.0040b2e0
add esp, 0x10
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x8f0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x42d428
push 0
mov dword [ebp - 0x8f0], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x402fce
push str.X400100002
call fcn.0040a680
add esp, 4
call fcn.00403f30
mov byte [0x42bfdb], al
call fcn.00404dd0
cmp byte [0x42bfdb], 0
je 0x402fef
cmp byte [0x42bfda], 0
jne 0x403041
call fcn.004032b0
test al, al
je 0x403023
call fcn.00409260
call fcn.004026a0
test al, al
je 0x403023
call fcn.004022f0
test al, al
je 0x403016
push 0x4206f4
jmp 0x40301b
push 0x42070c
call fcn.0040a680
add esp, 4
push 0x12
push 0x42e240
push str.LastCheck
push str.SoftwareX400100001Wcheck
push bind
call fcn.0040a130
add esp, 0x14
push 0
call fcn.0040cb35
mov dword [ebp - 0x828], eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x884]
push eax
mov dword [ebp - 0x824], edx
call fcn.0040c8bd
mov eax, dword [ebp - 0x84c]
cdq
mov esi, eax
mov eax, dword [ebp - 0x884]
push edx
cdq
push esi
push edx
push eax
call fcn.0040c7e6
mov ecx, 0xdbba0
fstp qword [ebp - 0xa40]
cvttsd2si eax, qword [ebp - 0xa40]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
imul eax, eax, 0x3e8
cdq
idiv ecx
mov eax, dword [0x428004]
imul eax, eax, 0x3e8
add esp, 0x1c
push 0x42e254
sub eax, edx
mov dword [0x42c3e8], eax
call esi
push dword [0x42c3e8]
push dword [0x42e03c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4031d6
push 0x42e254
call edi
cmp byte [0x42c3e2], 1
push 0x42e254
je 0x403248
call esi
push 0x42e254
call edi
cmp byte [0x42c3e2], 1
je 0x4031aa
xor edi, edi
lea esp, [esp]
push 0x42e254
call esi
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
add edi, 0x14
call fcn.0040cb35
mov dword [ebp - 0x828], eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x8a8]
push eax
mov dword [ebp - 0x824], edx
call fcn.0040c8bd
mov eax, dword [ebp - 0x84c]
cdq
mov esi, eax
mov eax, dword [ebp - 0x8a8]
push edx
cdq
push esi
push edx
push eax
call fcn.0040c7e6
mov ecx, dword [0x42c3e8]
fstp qword [ebp - 0xa40]
cvttsd2si eax, qword [ebp - 0xa40]
add esp, 0x1c
imul eax, eax, 0x3e8
cmp eax, ecx
jge 0x4031b3
cmp edi, ecx
jge 0x4031b3
push 0x42e254
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x42c3e2], 1
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jne 0x403110
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x42e254
call esi
jmp 0x4031bf
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x42e254
call edi
cmp byte [0x42c3e2], 1
push 0x42e254
je 0x403248
call esi
xorps xmm0, xmm0
push 0x42e240
mov dword [0x42c3e8], 0
movq qword [0x42e240], xmm0
movq qword [0x42e248], xmm0
mov word [0x42e250], 0
call fcn.004011f0
push 0
call fcn.0040cb35
mov dword [ebp - 0x828], eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x84c]
push eax
mov dword [ebp - 0x824], edx
call fcn.0040c8bd
add esp, 0x10
push 0x42e254
call edi
cmp byte [0x42c3e2], 1
jne 0x402eb0
push 0x42e254
call esi
push 0x42e254
call edi
cmp byte [0x42c3e3], 0
jne 0x40325f
call fcn.00408760
mov eax, dword [0x42c7f4]
test eax, eax
je 0x40326f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4205dc
call fcn.0040a680
add esp, 4
push 0x42e254
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.0040b2c3
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret