Function at 0x40af0a
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Query environment variable
Set environment variable
Set thread local storage value
Terminate process

Disassembly:
push ebp
sub esp, 0x248
lea ebp, [esp - 4]
mov eax, dword [0x44d948]
xor eax, ebp
mov dword [ebp + 0x248], eax
push 0x14
mov eax, 0x439385
call fcn.0041f00d
mov eax, dword [ebp + 0x258]
mov edi, dword [ebp + 0x254]
mov dword [ebp - 0x18], eax
mov eax, dword [0x44efc8]
xor ebx, ebx
mov dword [ebp - 0x20], edi
cmp eax, ebx
je 0x40af76
mov eax, dword [eax + 8]
test eax, eax
jle 0x40af76
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push dword [0x44d258]
call esi
push dword [ebp - 0x18]
push dword [0x44d25c]
call esi
mov eax, dword [0x44efc8]
jmp 0x40b359
mov eax, dword [0x450d14]
test eax, eax
je 0x40afa2
push ebx
push 0x43f3c0
push 0x43f3b4
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x40af6c
xor eax, eax
mov esi, 0x44eda0
mov dword [ebp - 0x14], ebx
cmp eax, esi
je 0x40afba
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
cmp dword [0x44efc8], ebx
je 0x40afe4
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push dword [0x44d258]
call esi
push dword [ebp - 0x18]
push dword [0x44d25c]
call esi
jmp 0x40b33c
call fcn.004015bf
push 0x103
push 0x44edb8
push eax
mov dword [0x44efcc], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 9
pop ecx
mov esi, str.mutexTSLOGV3TSLOG
lea edi, [ebp]
rep movsd dword es:[edi], dword [esi]
push 0x1e2
lea eax, [ebp + 0x26]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.00420d30
push 0x80
push str.envTSLOGTSLOG
mov esi, 0x44eca0
push esi
call fcn.00421011
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x43c6c8
mov dword [ebp - 0x1c], eax
mov edi, 0x82
lea eax, [ebp]
push edi
push eax
call fcn.0041f168
pop ecx
lea eax, [ebp + eax*2]
push eax
call fcn.00420a64
add esp, 0x10
push dword [ebp - 0x1c]
push 0x43c6c8
push edi
push esi
call fcn.0041f168
pop ecx
lea eax, [eax*2 + 0x44eca0]
push eax
call fcn.00420a64
add esp, 0x10
lea eax, [ebp]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x44efc0], eax
cmp eax, ebx
jne 0x40b0b2
push 0x10
push 0x44edb8
push str.CreateMutex_failure
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete byte [ebp - 0xd]
cmp byte [ebp - 0xd], bl
je 0x40b0d4
push 0xffffffffffffffff
push dword [0x44efc0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
push 0x3e
mov word [ebp + 0x208], ax
lea eax, [ebp + 0x20a]
push ebx
push eax
call fcn.00420d30
add esp, 0xc
push 0x20
lea eax, [ebp + 0x208]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebx
jne 0x40b17e
push 0x24c
push ebx
call edi
mov dword [0x44efc4], eax
cmp eax, ebx
jne 0x40b150
push 0x10
push 0x44edb8
push str.GlobalAlloc_failure
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [0x44efc0]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [0x44efc0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x44efc0], ebx
jmp 0x40b0aa
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0xa
lea ecx, [ebp + 0x208]
push ecx
push eax
mov dword [0x44efc8], eax
call fcn.00422ad9
add esp, 0xc
lea eax, [ebp + 0x208]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x40b190
lea eax, [ebp + 0x208]
push eax
call fcn.004213c5
pop ecx
mov dword [0x44efc8], eax
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [0x44d258]
call esi
push dword [ebp - 0x18]
push dword [0x44d25c]
call esi
mov dword [0x450d14], ebx
cmp byte [ebp - 0xd], bl
je 0x40b24c
mov eax, dword [0x44efc8]
cmp dword [eax + 0x244], 0x1000
jae 0x40b2e5
mov esi, dword [eax + 0x240]
cmp esi, ebx
je 0x40b1fe
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [0x44efc8]
mov dword [eax + 0x244], ebx
mov eax, dword [0x44efc8]
mov dword [eax + 0x240], ebx
mov esi, 0x2000
push esi
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [0x44efc8]
mov dword [ecx + 0x240], eax
mov eax, dword [0x44efc8]
add eax, 0x240
cmp dword [eax], ebx
je 0x40b2e5
push esi
push ebx
push dword [eax]
call fcn.00420d30
mov eax, dword [0x44efc8]
add esp, 0xc
mov dword [eax + 0x244], 0x1000
jmp 0x40b2e5
push 0x24c
push ebx
push dword [0x44efc8]
call fcn.00420d30
add esp, 0xc
mov esi, 0x2000
push esi
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [0x44efc8]
mov dword [ecx + 0x240], eax
mov eax, dword [0x44efc8]
add eax, 0x240
cmp dword [eax], ebx
je 0x40b2a5
push esi
push ebx
push dword [eax]
call fcn.00420d30
mov eax, dword [0x44efc8]
add esp, 0xc
mov dword [eax + 0x244], 0x1000
mov eax, dword [0x44efc8]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x44efc8]
mov dword [eax], 0x30300
mov eax, dword [0x44efc8]
mov dword [eax + 4], 0x24c
mov ecx, dword [0x44efc8]
push 1
call fcn.004082b1
mov ecx, dword [0x44efc8]
push 1
call fcn.0040a644
mov eax, dword [0x44efc8]
push 1
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov eax, dword [0x44efc8]
mov eax, dword [eax + 8]
mov ecx, dword [0x44efc8]
mov dword [0x44efd4], eax
cmp dword [ecx + 0xe8], 0xffffffff
jne 0x40b320
cmp dword [ecx + 0x2c], ebx
je 0x40b320
mov eax, dword [ecx + 0x23c]
inc eax
jmp 0x40b326
mov eax, dword [ecx + 0x23c]
mov dword [0x44efd0], eax
call fcn.00406fdb
push dword [0x44efc0]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [0x44efc8]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], ebx
je 0x40b357
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x14], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x248]
xor ecx, ebp
call fcn.0041effe
add ebp, 0x24c
leave
ret