Function at 0x4489d2
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
push 0x8007
mov dword [ebp - 0x28c], edi
mov dword [ebp - 0x290], ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x44844f
mov dword [0x653fd0], esi
mov dword [0x653fcc], ebx
call fcn.0058acb8
push ebx
push ebx
call fcn.004a7e50
add esp, 0xc
call fcn.004a73e0
mov esi, eax
test edi, edi
jne 0x448a3d
mov eax, ebx
jmp 0x448a73
push edi
call fcn.0058acf0
pop ecx
lea edi, [eax + 1]
cmp edi, 0x3fffffff
jle 0x448a59
mov edi, dword [ebp - 0x28c]
mov eax, ebx
jmp 0x448a73
lea eax, [edi + edi]
call fcn.0056fde0
mov ecx, esp
push 3
push edi
mov edi, dword [ebp - 0x28c]
mov edx, edi
call fcn.004108e0
push eax
lea ecx, [ebp - 0x284]
call fcn.00409872
lea eax, [ebp - 0x294]
mov dword [ebp - 0x294], ebx
push eax
push str.debug_modle
mov edx, str.Softwareyuntundm
call fcn.0041c651
pop ecx
pop ecx
xor ecx, ecx
inc ecx
test eax, eax
je 0x448ad4
cmp dword [ebp - 0x294], ecx
jne 0x448ad4
lea eax, [ebp - 0x294]
mov dword [ebp - 0x294], ebx
push eax
push str.debug_worker
mov edx, str.Softwareyuntundm
call fcn.0041c651
xor eax, eax
pop ecx
inc eax
pop ecx
mov dword [0x653fcc], eax
jmp 0x448ad6
mov eax, ebx
mov dword [0x653fc8], eax
mov edx, str.Softwareyuntundm
lea eax, [ebp - 0x294]
mov dword [ebp - 0x294], ebx
push eax
push str.debug_log
call fcn.0041c651
pop ecx
test eax, eax
mov eax, dword [0x653fcc]
pop ecx
je 0x448b13
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x294], ecx
cmove eax, ecx
mov dword [0x653fcc], eax
test eax, eax
je 0x448b34
push str.__type
push edi
call fcn.00588be0
pop ecx
pop ecx
test eax, eax
jne 0x448b34
push ecx
mov ecx, dword [0x659ebc]
call fcn.0044828a
push str.setdef
lea ecx, [ebp - 0x224]
call fcn.00403a6b
lea eax, [ebp - 0x224]
mov ecx, esi
push eax
call fcn.004a7db0
lea ecx, [ebp - 0x224]
mov bl, al
call fcn.00403cb7
test bl, bl
je 0x448d30
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x448bd4
push str.setdef
lea ecx, [ebp - 0x224]
call fcn.00403a6b
lea eax, [ebp - 0x224]
mov ecx, esi
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.004a7c50
push 0x601a80
mov esi, eax
call fcn.0059771b
cmp dword [esi + 0x14], 8
pop ecx
mov ecx, esi
jb 0x448bad
mov ecx, dword [esi]
push 3
pop edx
push eax
mov dword [ebp - 0x290], edx
mov edx, dword [esi + 0x10]
push ecx
call fcn.00411d32
pop ecx
pop ecx
test eax, eax
je 0x448bd4
push 3
mov byte [ebp - 0x285], 1
xor ebx, ebx
pop eax
jmp 0x448be2
mov eax, dword [ebp - 0x290]
xor ebx, ebx
mov byte [ebp - 0x285], bl
test al, 2
je 0x448c00
and eax, 0xfffffffd
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x290], eax
call fcn.00409db5
mov eax, dword [ebp - 0x290]
test al, 1
je 0x448c0f
lea ecx, [ebp - 0x224]
call fcn.00403cb7
cmp byte [ebp - 0x285], 0
je 0x448cb9
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00586790
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x29c], ebx
xorps xmm0, xmm0
mov dword [ebp - 0x2c4], eax
lea eax, [ebp - 0x2d4]
movlpd qword [ebp - 0x2b4], xmm0
push eax
movlpd qword [ebp - 0x2ac], xmm0
movlpd qword [ebp - 0x2a4], xmm0
mov dword [ebp - 0x2d4], 0x3c
mov dword [ebp - 0x2d0], ebx
mov dword [ebp - 0x2cc], ebx
mov dword [ebp - 0x2c8], 0x5fce94
mov dword [ebp - 0x2c0], 0x601a84
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2b8], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
or ebx, 0xffffffff
jmp 0x448d1e
push str.DF340E8C_428E_48A4_A80A_0E6142A0C952
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x448d17
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00586790
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0x18
lea eax, [ebp - 0x20c]
mov ecx, esp
push eax
call fcn.00409872
call fcn.0040e6ce
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x284]
call fcn.00409db5
mov eax, ebx
jmp 0x449336
push 0x5fc20c
lea ecx, [ebp - 0x224]
call fcn.00403a6b
lea eax, [ebp - 0x224]
push eax
call fcn.004a73e0
mov ecx, eax
call fcn.004a7bc0
lea ecx, [ebp - 0x224]
mov ebx, eax
call fcn.00403cb7
test ebx, ebx
je 0x448dd7
push str.crashcfg
lea ecx, [ebp - 0x224]
call fcn.00403a6b
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.004a73e0
mov ecx, eax
call fcn.004a7c50
lea ecx, [ebp - 0x224]
call fcn.00403cb7
cmp dword [ebp - 0x22c], 0
je 0x448dcc
cmp dword [ebp - 0x228], 8
lea eax, [ebp - 0x23c]
push ecx
cmovae eax, dword [ebp - 0x23c]
push eax
push ebx
call fcn.0044b876
cmp dword [0x653db0], 0
jne 0x448dcc
call fcn.0044af01
lea ecx, [ebp - 0x23c]
jmp 0x449319
call fcn.004114f1
push str.type
lea ecx, [ebp - 0x224]
call fcn.00403a6b
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.004a73e0
mov ecx, eax
call fcn.004a7c50
lea ecx, [ebp - 0x224]
call fcn.00403cb7
cmp dword [ebp - 0x244], 0
jne 0x448e21
mov ecx, str.yuntun
jmp 0x448e35
cmp dword [ebp - 0x240], 8
lea ecx, [ebp - 0x254]
cmovae ecx, dword [ebp - 0x254]
call fcn.00411508
call fcn.00448458
call fcn.0044456b
mov ecx, eax
call fcn.004445cf
push str.__type
push edi
call fcn.00588be0
pop ecx
pop ecx
test eax, eax
je 0x448fe4
mov ax, word [0x5fa498]
xor edi, edi
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.00586790
cmp dword [ebp - 0x270], 8
lea ecx, [ebp - 0x284]
lea eax, [ebp - 0x20c]
cmovae ecx, dword [ebp - 0x284]
add esp, 8
push eax
call fcn.0041d219
pop ecx
pop ecx
sub esp, 0x18
mov ebx, str.chrome_child.dll
mov ecx, esp
push ebx
test eax, eax
je 0x448f45
call fcn.00409872
sub esp, 0x18
lea eax, [ebp - 0x20c]
mov ecx, esp
push eax
call fcn.00409872
lea ecx, [ebp - 0x26c]
call fcn.0044df0e
add esp, 0x30
cmp dword [eax + 0x14], 8
jb 0x448ee5
mov eax, dword [eax]
mov ecx, eax
call fcn.0041eac2
lea ecx, [ebp - 0x26c]
mov esi, eax
call fcn.00409db5
test esi, esi
je 0x449313
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.00409872
sub esp, 0x18
lea eax, [ebp - 0x20c]
mov ecx, esp
push eax
call fcn.00409872
lea ecx, [ebp - 0x26c]
call fcn.0044df0e
add esp, 0x30
cmp dword [eax + 0x14], 8
jb 0x448f33
mov eax, dword [eax]
push 8
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea ecx, [ebp - 0x26c]
jmp 0x448fad
call fcn.00409872
lea ecx, [ebp - 0x26c]
call fcn.0044dc26
add esp, 0x18
cmp dword [eax + 0x14], 8
jb 0x448f60
mov eax, dword [eax]
mov ecx, eax
call fcn.0041eac2
lea ecx, [ebp - 0x26c]
mov esi, eax
call fcn.00409db5
test esi, esi
je 0x449313
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.00409872
lea ecx, [ebp - 0x224]
call fcn.0044dc26
add esp, 0x18
cmp dword [eax + 0x14], 8
jb 0x448f9d
mov eax, dword [eax]
push 8
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea ecx, [ebp - 0x224]
mov esi, eax
call fcn.00409db5
test esi, esi
je 0x449313
push str.ChromeShell
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x449313
push 0x659ec8
push dword [0x653fd0]
call eax
pop ecx
pop ecx
jmp 0x449313
push str.taskrun
lea ecx, [ebp - 0x224]
call fcn.00403a6b
lea eax, [ebp - 0x224]
mov ecx, esi
push eax
call fcn.004a7db0
lea ecx, [ebp - 0x224]
mov bl, al
call fcn.00403cb7
test bl, bl
je 0x449048
push str.9CD9AA43_C6F9_4DB5_8587_259262CA80AC
push 1
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x241
push str.WinMain
push str.__s__d___task_run_has_running_
call fcn.00408e0e
add esp, 0xc
push esi
jmp 0x44930d
push str.upgrade
lea ecx, [ebp - 0x224]
call fcn.00403a6b
lea eax, [ebp - 0x224]
mov ecx, esi
push eax
call fcn.004a7db0
lea ecx, [ebp - 0x224]
mov bl, al
call fcn.00403cb7
test bl, bl
je 0x4490ac
push str.62C0E131_8CEC_4DA7_846A_9F314E407768
push 1
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x44909b
call fcn.0044872e
push 0x24c
push str.WinMain
push str.__s__d___upgrade_has_running_
jmp 0x44903a
push str.dm_tray
lea ecx, [ebp - 0x224]
call fcn.00403a6b
lea eax, [ebp - 0x224]
mov ecx, esi
push eax
call fcn.004a7db0
lea ecx, [ebp - 0x224]
mov bl, al
call fcn.00403cb7
test bl, bl
je 0x449108
push str.3026B8B8_BA7A_471F_82F1_B8FC9A95B83E
push 1
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x449042
call fcn.00448631
jmp 0x449042
cmp dword [ebp - 0x274], 0
je 0x449146
push str.dm_frame
lea ecx, [ebp - 0x224]
call fcn.00403a6b
push 4
pop edx
lea eax, [ebp - 0x224]
mov dword [ebp - 0x290], edx
push eax
mov ecx, esi
call fcn.004a7db0
test al, al
jne 0x449146
xor ebx, ebx
mov byte [ebp - 0x285], bl
jmp 0x44914f
mov byte [ebp - 0x285], 1
xor ebx, ebx
mov eax, dword [ebp - 0x290]
test al, 4
je 0x449164
lea ecx, [ebp - 0x224]
call fcn.00403cb7
cmp byte [ebp - 0x285], 0
je 0x449313
push str.A9522612_7F45_4A2F_BCEC_83A95471A952
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x290], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4491ea
sub esp, 0x18
lea eax, [ebp - 0x284]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.004098c0
call fcn.0044891a
add esp, 0x18
test al, al
jne 0x4491dc
call fcn.004488fa
call fcn.0044889b
call fcn.004415f2
call fcn.00444813
mov ecx, eax
call fcn.00444938
call fcn.00448521
jmp 0x44930c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.99ECA492_19BE_4D26_8085_08C63987451E
push ebx
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x28c], eax
test eax, eax
je 0x44930c
push ebx
push 1
push 0x52c
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x5fd7bc
lea ecx, [ebp - 0x224]
call fcn.00403a6b
lea eax, [ebp - 0x224]
mov ecx, esi
push eax
call fcn.004a7db0
lea ecx, [ebp - 0x224]
mov bl, al
call fcn.00403cb7
test bl, bl
je 0x44930c
push 0x5fd7bc
lea ecx, [ebp - 0x26c]
call fcn.00403a6b
lea eax, [ebp - 0x26c]
mov ecx, esi
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.004a7c50
lea ecx, [ebp - 0x26c]
call fcn.00403cb7
cmp dword [ebp - 0x210], 8
lea eax, [ebp - 0x224]
cmovae eax, dword [ebp - 0x224]
push eax
push 0x275
push str.WinMain
push str.__s__d___GetSwitchValueNative_url:
call fcn.00408e0e
push ecx
push ecx
mov ecx, esp
lea eax, [ebp - 0x224]
xor edi, edi
push eax
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.004098c0
lea ecx, [ebp - 0x23c]
call fcn.0041f0cf
cmp dword [ebp - 0x228], 0x10
lea eax, [ebp - 0x23c]
push dword [ebp - 0x22c]
cmovae eax, dword [ebp - 0x23c]
mov edx, 0x7dd
mov ecx, dword [ebp - 0x28c]
push eax
call fcn.0044f25b
add esp, 0x20
lea ecx, [ebp - 0x23c]
call fcn.00403cb7
lea ecx, [ebp - 0x224]
call fcn.00409db5
mov edi, dword [ebp - 0x290]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x254]
call fcn.00409db5
call fcn.0044801a
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x284]
call fcn.00409db5
xor eax, eax
lea esp, [ebp - 0x2e0]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056e987
leave
ret 0x10