Function at 0x401000
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1045c
call fcn.00422250
mov dword [0x47e3c0], 0x19721972
mov dword [0x47e3c8], 0x19721972
mov dword [0x47e3cc], 0x19721972
mov eax, dword [0x47e3c0]
push eax
call fcn.00416be0
add esp, 4
test eax, eax
jne 0x401045
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.00422100
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [0x489404]
test eax, eax
jne 0x401084
push 0
call dword [0x489408]
call fcn.0041ae20
cmp eax, 1
jne 0x401098
mov dword [0x487914], 1
lea ecx, [ebp - 0x41c]
push ecx
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
call dword [0x4893d4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x3c4], 0xc
mov dword [ebp - 0x3c0], 0
mov dword [ebp - 0x3bc], 1
push str.1EABFBE5_8FD6_4FAE_B217_EAE9358B8BA9
push 0
lea edx, [ebp - 0x3c4]
push edx
call dword [0x4893d8]
mov dword [0x48791c], eax
cmp dword [0x48791c], 0
jne 0x4010f6
push 0
call dword [0x489408]
cmp dword [0x47f9a0], 1
jne 0x401104
call fcn.004100b0
call fcn.00409290
cmp eax, 1
jne 0x401194
push str.4A634ADD_D6CD_4A2B_A115_A14267F538DE
push 0
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0x487918], eax
cmp dword [0x487918], 0
jne 0x40113a
push 0
call dword [0x489438]
mov dword [ebp - 0x420], 0
push str.99B1893C_0E2F_4A5D_81EF_F1EBDCCC8823
push 0
push 0x100002
call dword [0x489430]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jne 0x40116d
push 0
call dword [0x489438]
mov eax, dword [ebp - 0x420]
push eax
call dword [0x489434]
mov ecx, dword [ebp - 0x420]
push ecx
call dword [0x4893e4]
call fcn.0041a780
push 0
call dword [0x489438]
call fcn.0040dad0
test eax, eax
jne 0x4011a5
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x3f8], 0
push str.B6AF8A9B_25F2_4A0B_B3F8_ED3887099DE1
push 0
push 0x100000
call dword [0x4893cc]
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0
je 0x4011e5
mov edx, dword [ebp - 0x3f8]
push edx
call dword [0x4893e4]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.B6AF8A9B_25F2_4A0B_B3F8_ED3887099DE1
push 1
push 0
call dword [0x4893d8]
test eax, eax
jne 0x401200
push 0
call dword [0x489408]
cmp dword [0x47f9a8], 1
jne 0x401269
cmp dword [0x4892b0], 0
jne 0x401269
call fcn.0041afe0
test eax, eax
jne 0x401269
call fcn.0041acd0
cmp eax, 0xa
jb 0x401269
call fcn.0041ae20
cmp eax, 1
jne 0x40124d
lea eax, [ebp - 0x218]
push eax
call fcn.00412390
add esp, 4
cmp eax, 1
jne 0x40124b
push 0
call dword [0x489408]
jmp 0x401269
lea ecx, [ebp - 0x218]
push ecx
call fcn.00410ce0
add esp, 4
cmp eax, 1
jne 0x401269
push 0
call dword [0x489408]
cmp dword [0x47e3dc], 1
jne 0x4012ce
cmp dword [0x4892b4], 0
jne 0x4012ce
call fcn.0041acd0
cmp eax, 0xa
jb 0x4012ce
call fcn.0041afe0
cmp eax, 1
jne 0x4012ce
push 0x47e3e4
mov edx, dword [0x47e3e0]
push edx
call fcn.00414ef0
add esp, 8
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
je 0x4012ce
mov eax, dword [ebp - 0x424]
push eax
call fcn.00415350
add esp, 4
mov ecx, dword [ebp - 0x424]
push ecx
call dword [0x4893f8]
push str.951F351C_EBC9_4837_9D26_7653214014FA
push 1
push 0
call dword [0x4893d8]
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0
jne 0x4012f4
push 0
call dword [0x489408]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401309
push 0
call dword [0x489408]
push str.419E8296_C595_425D_BD11_B32369576C0D
push 1
push 0
call dword [0x4893d8]
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 0
jne 0x40132f
push 0
call dword [0x489408]
push str.419E8296_C595_425D_BD11_B32369576C0D
call fcn.0041b0f0
add esp, 4
push str.4A634ADD_D6CD_4A2B_A115_A14267F538DE
push 0
push 1
push 0
call dword [0x4893fc]
mov dword [0x487918], eax
cmp dword [0x487918], 0
jne 0x401363
push 0
call dword [0x489408]
push str.4A634ADD_D6CD_4A2B_A115_A14267F538DE
call fcn.0041b0f0
add esp, 4
cmp dword [0x47dfb0], 1
jne 0x40153e
push 0x7fff
lea edx, [ebp - 0x10428]
push edx
push 0
call dword [0x489404]
test eax, eax
je 0x401536
push 0x5c
lea eax, [ebp - 0x10428]
push eax
call fcn.00401c60
add esp, 8
xor ecx, ecx
mov word [eax], cx
lea edx, [ebp - 0x1042c]
push edx
push 0x47dce8
call fcn.0040d850
add esp, 8
mov dword [ebp - 0x10430], eax
cmp dword [ebp - 0x10430], 0
je 0x40152c
push 0x5c
mov eax, dword [ebp - 0x10430]
push eax
call fcn.00401c60
add esp, 8
xor ecx, ecx
mov word [eax], cx
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 0x10434], eax
cmp dword [ebp - 0x10434], 0
je 0x40151d
mov edx, dword [ebp - 0x10434]
push edx
push 0x7fff
call dword [0x489444]
test eax, eax
je 0x401508
push 0x5c
mov eax, dword [ebp - 0x10434]
push eax
call fcn.00401c60
add esp, 8
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebp - 0x10430]
push edx
lea eax, [ebp - 0x10428]
push eax
call dword [0x489550]
test eax, eax
je 0x401506
mov ecx, dword [ebp - 0x10434]
push ecx
lea edx, [ebp - 0x10428]
push edx
call dword [0x489550]
test eax, eax
je 0x401506
call dword [0x4893d0]
mov dword [ebp - 0x10440], eax
lea eax, [ebp - 0x10438]
push eax
mov ecx, dword [ebp - 0x10440]
push ecx
call dword [0x4897ac]
mov dword [ebp - 0x1043c], eax
push str.6139DE91_A838_4CE9_A89F_B37167B410A8
mov edx, dword [ebp - 0x1043c]
mov eax, dword [edx + 4]
push eax
call dword [0x489550]
test eax, eax
je 0x401506
push str.B2DBBEC4_EA69_427C_83C7_1F220C0B55F1
mov ecx, dword [ebp - 0x1043c]
mov edx, dword [ecx + 4]
push edx
call dword [0x489550]
test eax, eax
je 0x401506
push str.07C97F72_3546_401B_8BF7_67F5CC2C13BC
mov eax, dword [ebp - 0x1043c]
mov ecx, dword [eax + 4]
push ecx
call dword [0x489550]
test eax, eax
je 0x401506
push 1
push 0x47dfb4
push 0x47e07e
push 0
call dword [0x489580]
cmp eax, 2
jne 0x401506
push 0
call dword [0x489408]
jmp 0x401510
push 0
call dword [0x489408]
mov edx, dword [ebp - 0x10434]
push edx
call dword [0x4893f8]
mov eax, dword [ebp - 0x10430]
push eax
call dword [0x4893f8]
jmp 0x401534
push 0
call dword [0x489408]
jmp 0x40153e
push 0
call dword [0x489408]
lea ecx, [ebp - 0x3b8]
push ecx
push 2
call dword [0x489860]
test eax, eax
je 0x401559
push 0
call dword [0x489408]
call fcn.0040d460
test eax, eax
jne 0x40156a
push 0
call dword [0x489408]
call fcn.004160e0
test eax, eax
jne 0x40157b
push 0
call dword [0x489408]
call fcn.00412cc0
test eax, eax
jne 0x40158c
push 0
call dword [0x489408]
call fcn.00412d80
test eax, eax
jne 0x40159d
push 0
call dword [0x489408]
call fcn.00412eb0
test eax, eax
jne 0x4015ae
push 0
call dword [0x489408]
cmp dword [0x47e2e8], 0
jne 0x4015d0
push 0x47dce8
call fcn.0040d500
add esp, 4
test eax, eax
jne 0x4015d0
push 0
call dword [0x489408]
push 0x47dce8
call fcn.0040d940
add esp, 4
test eax, eax
jne 0x4015e9
push 0
call dword [0x489408]
cmp dword [0x47e2e8], 0
jne 0x40160d
cmp dword [0x47f994], 1
jne 0x40160d
call fcn.00410350
cmp eax, 1
jne 0x40160d
push 0
call dword [0x489408]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x3fc], 0
cmp dword [0x487914], 1
jne 0x401655
lea edx, [ebp - 0x224]
push edx
push 0x43a008
call fcn.0041b960
add esp, 8
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0
jne 0x401655
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x401679
push 0
call dword [0x489408]
push 0x7fff
mov eax, dword [ebp - 0x220]
push eax
call dword [0x48942c]
test eax, eax
jne 0x401697
push 0
call dword [0x489408]
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x4016bb
push 0
call dword [0x489408]
push 0x7fff
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [0x489468]
test eax, eax
jne 0x4016d9
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4016f7
push 0
call dword [0x489408]
mov edx, dword [ebp - 0x220]
push edx
push 0x4312f8
push 0x7fff
mov eax, dword [ebp - 8]
push eax
call fcn.0042217a
add esp, 0x10
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0
jne 0x401738
push 0
call dword [0x489408]
mov ecx, dword [ebp - 0x21c]
push ecx
push 0x431318
push 0x7fff
mov edx, dword [ebp - 0x3f0]
push edx
call fcn.0042217a
add esp, 0x10
push 0xfffe
push 0x40
call dword [0x4893ec]
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0
jne 0x40177c
push 0
call dword [0x489408]
mov eax, dword [ebp - 0x21c]
push eax
push 0x431338
push 0x7fff
mov ecx, dword [ebp - 0x3cc]
push ecx
call fcn.0042217a
add esp, 0x10
mov dword [ebp - 0x3c8], 0
mov dword [ebp - 0x418], 0
xor edx, edx
mov dword [ebp - 0x414], edx
mov dword [ebp - 0x410], edx
mov dword [ebp - 0x3e8], 0
xor eax, eax
mov dword [ebp - 0x3e4], eax
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 0x40c], 0
xor ecx, ecx
mov dword [ebp - 0x408], ecx
mov dword [ebp - 0x404], ecx
cmp dword [0x4863b0], 1
jne 0x401838
mov edx, dword [ebp - 0x3c8]
mov eax, dword [ebp - 8]
mov dword [ebp + edx*4 - 0x418], eax
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp + ecx*4 - 0x3e8], 0
mov edx, dword [ebp - 0x3c8]
mov dword [ebp + edx*4 - 0x40c], 1
mov eax, dword [ebp - 0x3c8]
add eax, 1
mov dword [ebp - 0x3c8], eax
cmp dword [0x4863ac], 1
jne 0x401885
mov ecx, dword [ebp - 0x3c8]
mov edx, dword [ebp - 0x3f0]
mov dword [ebp + ecx*4 - 0x418], edx
mov eax, dword [ebp - 0x3c8]
mov dword [ebp + eax*4 - 0x3e8], 1
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp + ecx*4 - 0x40c], 1
mov edx, dword [ebp - 0x3c8]
add edx, 1
mov dword [ebp - 0x3c8], edx
cmp dword [0x4863b4], 1
jne 0x4018d2
mov eax, dword [ebp - 0x3c8]
mov ecx, dword [ebp - 0x3cc]
mov dword [ebp + eax*4 - 0x418], ecx
mov edx, dword [ebp - 0x3c8]
mov dword [ebp + edx*4 - 0x3e8], 2
mov eax, dword [ebp - 0x3c8]
mov dword [ebp + eax*4 - 0x40c], 1
mov ecx, dword [ebp - 0x3c8]
add ecx, 1
mov dword [ebp - 0x3c8], ecx
mov edx, dword [ebp - 0x3c8]
mov dword [ebp - 0x400], edx
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x401c0f
mov dword [ebp - 0x10444], 0
jmp 0x40190a
mov eax, dword [ebp - 0x10444]
add eax, 1
mov dword [ebp - 0x10444], eax
mov ecx, dword [ebp - 0x10444]
cmp ecx, dword [ebp - 0x400]
jge 0x401c0a
cmp dword [0x487914], 0
jne 0x401958
lea edx, [ebp - 0x3dc]
push edx
mov eax, dword [ebp - 0x10444]
mov ecx, dword [ebp + eax*4 - 0x40c]
push ecx
mov edx, dword [ebp - 0x10444]
mov eax, dword [ebp + edx*4 - 0x418]
push eax
call fcn.0040e6d0
add esp, 0xc
mov dword [ebp - 0x10448], eax
jmp 0x40199a
lea ecx, [ebp - 0x3dc]
push ecx
push str.99B1893C_0E2F_4A5D_81EF_F1EBDCCC8823
mov edx, dword [0x468878]
push edx
push 0x468880
mov eax, dword [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x3fc]
push ecx
mov edx, dword [ebp - 0x10444]
mov eax, dword [ebp + edx*4 - 0x418]
push eax
call fcn.00411ae0
add esp, 0x1c
mov dword [ebp - 0x10448], eax
cmp dword [ebp - 0x10448], 1
jne 0x401bfa
cmp dword [0x47e2e8], 1
jne 0x401b3a
mov ecx, dword [ebp - 0x10444]
cmp dword [ebp + ecx*4 - 0x3e8], 1
jne 0x401a32
push 0
mov edx, dword [ebp - 0x3dc]
push edx
call dword [0x48940c]
cmp eax, 0x102
jne 0x401a32
push str.FFCB05E7_D6C6_4474_A882_2F40D23A88FC
push 0
push 0x100000
call dword [0x4893cc]
mov dword [ebp - 0x10454], eax
cmp dword [ebp - 0x10454], 0
jne 0x401a1c
push 0xa
mov eax, dword [0x487918]
push eax
call dword [0x48940c]
cmp eax, 0x102
je 0x401a1a
jmp 0x401c0f
jmp 0x4019c4
cmp dword [ebp - 0x10454], 0
je 0x401a32
mov ecx, dword [ebp - 0x10454]
push ecx
call dword [0x4893e4]
mov edx, dword [ebp - 0x10444]
cmp dword [ebp + edx*4 - 0x3e8], 0
jne 0x401ab1
push 0
mov eax, dword [ebp - 0x3dc]
push eax
call dword [0x48940c]
cmp eax, 0x102
jne 0x401ab1
push str.A1CB624B_61FA_4F28_9840_76A2188B1EEF
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x10458], eax
cmp dword [ebp - 0x10458], 0
jne 0x401a9b
push 0xa
mov ecx, dword [0x487918]
push ecx
call dword [0x48940c]
cmp eax, 0x102
je 0x401a99
jmp 0x401c0f
jmp 0x401a42
cmp dword [ebp - 0x10458], 0
je 0x401ab1
mov edx, dword [ebp - 0x10458]
push edx
call dword [0x4893e4]
mov eax, dword [ebp - 0x10444]
cmp dword [ebp + eax*4 - 0x3e8], 2
jne 0x401b30
push 0
mov ecx, dword [ebp - 0x3dc]
push ecx
call dword [0x48940c]
cmp eax, 0x102
jne 0x401b30
push str.60B19E1B_EB17_47D5_92D0_3A0D3C35A79F
push 0
push 0x100000
call dword [0x4893cc]
mov dword [ebp - 0x1045c], eax
cmp dword [ebp - 0x1045c], 0
jne 0x401b1a
push 0xa
mov edx, dword [0x487918]
push edx
call dword [0x48940c]
cmp eax, 0x102
je 0x401b18
jmp 0x401c0f
jmp 0x401ac1
cmp dword [ebp - 0x1045c], 0
je 0x401b30
mov eax, dword [ebp - 0x1045c]
push eax
call dword [0x4893e4]
jmp 0x401c0f
mov dword [ebp - 0x10450], 0
xor ecx, ecx
mov dword [ebp - 0x1044c], ecx
mov edx, dword [0x487918]
mov dword [ebp - 0x10450], edx
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x1044c], eax
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x10450]
push ecx
push 2
call dword [0x489454]
push 0
mov edx, dword [0x487918]
push edx
call dword [0x48940c]
cmp eax, 0x102
je 0x401b96
mov dword [ebp - 4], 0
jmp 0x401c0a
cmp dword [ebp - 0x3dc], 0
je 0x401bae
push 0
mov eax, dword [ebp - 0x3dc]
push eax
call dword [0x489418]
cmp dword [ebp - 0x3dc], 0
je 0x401bc4
mov ecx, dword [ebp - 0x3dc]
push ecx
call dword [0x4893e4]
cmp dword [ebp - 0x3d8], 0
je 0x401bda
mov edx, dword [ebp - 0x3d8]
push edx
call dword [0x4893e4]
push 0x10
push 0
lea eax, [ebp - 0x3dc]
push eax
call fcn.00422100
add esp, 0xc
push 0x3e8
call dword [0x48946c]
jmp 0x401c05
push 0x3e8
call dword [0x48946c]
jmp 0x4018fb
jmp 0x4018e5
call fcn.0040d4f0
cmp dword [0x4863a8], 1
jne 0x401c2c
push 0xffffffffffffffff
mov ecx, dword [0x489328]
push ecx
call dword [0x48940c]
call fcn.0041ae20
cmp eax, 1
jne 0x401c43
lea edx, [ebp - 0x41c]
push edx
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push 0
call dword [0x489408]
mov esp, ebp
pop ebp
ret 0x10