Function at 0x40aa70
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Hash data with crc32
Inspect load icon resource
Resolve function by parsing pe exports
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x46564f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x498
mov eax, dword [esp + 0x4a8]
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push eax
push 0x66
mov dword [esp + 0x5c], ebp
call fcn.004576b5
lea esi, [ebp + 0x5c]
xor ebx, ebx
mov ecx, esi
mov dword [esp + 0x4b0], ebx
call fcn.00457c68
mov dword [esi], vtable.CButton.0
lea esi, [ebp + 0x98]
mov byte [esp + 0x4b0], 1
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CButton.0
lea esi, [ebp + 0xd4]
mov byte [esp + 0x4b0], 2
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CButton.0
lea esi, [ebp + 0x110]
mov byte [esp + 0x4b0], 3
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CButton.0
lea esi, [ebp + 0x14c]
mov byte [esp + 0x4b0], 4
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CTreeCtrl.0
lea esi, [ebp + 0x188]
mov byte [esp + 0x4b0], 5
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CButton.0
lea esi, [ebp + 0x1c4]
mov byte [esp + 0x4b0], 6
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CButton.0
lea esi, [ebp + 0x200]
mov byte [esp + 0x4b0], 7
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CComboBox.0
lea esi, [ebp + 0x23c]
mov byte [esp + 0x4b0], 8
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CStatic.0
lea esi, [ebp + 0x278]
mov byte [esp + 0x4b0], 9
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CButton.0
lea esi, [ebp + 0x2b4]
mov byte [esp + 0x4b0], 0xa
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CStatic.0
lea esi, [ebp + 0x2f0]
mov byte [esp + 0x4b0], 0xb
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CButton.0
lea esi, [ebp + 0x32c]
mov byte [esp + 0x4b0], 0xc
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CButton.0
lea esi, [ebp + 0x368]
mov byte [esp + 0x4b0], 0xd
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CButton.0
lea esi, [ebp + 0x3a4]
mov byte [esp + 0x4b0], 0xe
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CButton.0
lea esi, [ebp + 0x3e0]
mov byte [esp + 0x4b0], 0xf
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CButton.0
lea esi, [ebp + 0x41c]
mov byte [esp + 0x4b0], 0x10
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CButton.0
lea esi, [ebp + 0x458]
mov byte [esp + 0x4b0], 0x11
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CButton.0
lea esi, [ebp + 0x494]
mov byte [esp + 0x4b0], 0x12
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CComboBox.0
lea esi, [ebp + 0x4d0]
mov byte [esp + 0x4b0], 0x13
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CComboBox.0
lea esi, [ebp + 0x50c]
mov byte [esp + 0x4b0], 0x14
mov ecx, esi
call fcn.00457c68
mov dword [esi], vtable.CButton.0
lea ecx, [ebp + 0x54c]
mov byte [esp + 0x4b0], 0x15
call fcn.004562c2
mov cl, byte [esp + 0x13]
mov dword [ebp + 0x5a8], ebx
mov byte [ebp + 0x5a4], cl
mov dword [ebp + 0x5ac], ebx
mov dword [ebp + 0x5b0], ebx
mov dl, byte [esp + 0x13]
mov dword [ebp + 0x5b8], ebx
mov byte [ebp + 0x5b4], dl
mov dword [ebp + 0x5bc], ebx
mov dword [ebp + 0x5c0], ebx
mov al, byte [esp + 0x13]
mov dword [ebp + 0x5c8], ebx
mov byte [ebp + 0x5c4], al
mov dword [ebp + 0x5cc], ebx
mov dword [ebp + 0x5d0], ebx
mov byte [esp + 0x4b0], 0x19
lea ecx, [ebp + 0x5d4]
mov dl, byte [esp + 0x13]
mov al, byte [esp + 0x13]
mov byte [ecx], dl
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.0041eef0
mov dword [ebp + 0x604], ebx
mov dl, byte [esp + 0x13]
mov al, byte [esp + 0x13]
lea ecx, [ebp + 0x608]
mov byte [esp + 0x4b0], 0x1b
mov byte [ecx], dl
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.0041f7b0
lea ecx, [ebp + 0x618]
mov byte [esp + 0x4b0], 0x1c
call fcn.00437770
lea ecx, [ebp + 0x6c0]
mov byte [esp + 0x4b0], 0x1d
call fcn.00436650
mov cl, byte [esp + 0x13]
mov dword [ebp + 0x74c], ebx
mov byte [ebp + 0x748], cl
mov dword [ebp + 0x750], ebx
mov dword [ebp + 0x754], ebx
lea ecx, [ebp + 0x758]
mov byte [esp + 0x4b0], 0x1f
call fcn.004068c0
mov dl, byte [esp + 0x13]
mov al, byte [esp + 0x13]
lea ecx, [ebp + 0x1be8]
mov byte [esp + 0x4b0], 0x20
mov byte [ecx], dl
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.0041fed0
lea ecx, [ebp + 0x1bf8]
mov byte [esp + 0x4b0], 0x21
call fcn.00455ff0
mov ecx, dword [0x486ed0]
mov dword [ebp + 0x1d0c], ecx
lea ecx, [ebp + 0x1d14]
mov byte [esp + 0x4b0], 0x23
call fcn.00406c90
mov edx, dword [0x486ed0]
mov dword [ebp + 0x1d28], edx
mov eax, dword [0x486ed0]
mov dword [ebp + 0x1d2c], eax
mov ecx, dword [0x486ed0]
mov dword [ebp + 0x1d30], ecx
mov edx, dword [0x486ed0]
mov dword [ebp + 0x1d34], edx
mov eax, dword [0x486ed0]
mov dword [ebp + 0x1d38], eax
mov ecx, dword [0x486ed0]
mov dword [ebp + 0x1d3c], ecx
lea ecx, [ebp + 0x1d40]
mov byte [esp + 0x4b0], 0x2a
call fcn.00431780
mov edx, dword [0x486ed0]
mov dword [ebp + 0x1d78], edx
lea ecx, [ebp + 0x1d80]
mov byte [esp + 0x4b0], 0x2c
call fcn.00423f10
mov eax, dword [0x486ed0]
mov dword [ebp + 0x1dd0], eax
mov ecx, dword [0x486ed0]
mov dword [ebp + 0x1dd8], ecx
mov dword [ebp], method.CDialog.virtual_0
mov edx, dword [0x486ed0]
mov dword [esp + 0x14], edx
mov byte [esp + 0x4b0], 0x30
call fcn.00460f3e
call fcn.00460f3e
mov eax, dword [eax + 0xc]
push 0x80
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp + 0x548], eax
mov dword [ebp + 0x5e4], 1
mov dword [ebp + 0x5e8], ebx
mov byte [ebp + 0x5ec], bl
mov byte [ebp + 0x5ed], bl
mov dword [ebp + 0x5f0], ebx
mov dword [ebp + 0x5f4], ebx
mov byte [ebp + 0x5f8], bl
mov dword [ebp + 0x5fc], ebx
or eax, 0xffffffff
mov dword [ebp + 0x600], ebx
mov word [ebp + 0x708], ax
mov word [ebp + 0x70a], ax
mov dword [ebp + 0x70c], ebx
mov dword [ebp + 0x710], ebx
mov dword [ebp + 0x714], ebx
mov byte [ebp + 0x718], bl
mov dword [ebp + 0x71c], ebx
lea ecx, [ebp + 0x1ce0]
mov byte [ebp + 0x720], bl
xor eax, eax
mov dword [ebp + 0x724], ebx
mov dword [ebp + 0x728], ebx
mov dword [ebp + 0x72c], ebx
mov dword [ebp + 0x730], ebx
mov dword [ebp + 0x734], ebx
mov dword [ebp + 0x738], ebx
mov dword [ebp + 0x73c], ebx
mov dword [ebp + 0x740], ebx
mov dword [ebp + 0x744], ebx
mov dword [ebp + 0x1bcc], ebx
mov dword [ebp + 0x1bd0], ebx
mov dword [ebp + 0x1bd4], ebx
mov dword [ebp + 0x1bd8], ebx
mov word [ebp + 0x1be4], bx
mov dword [ecx], eax
xor edx, edx
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea eax, [ebp + 0x1cf0]
mov dword [ebp + 0x1cf0], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [ebp + 0x1d00], ebx
mov dword [ebp + 0x1d04], ebx
mov dword [ebp + 0x1d08], ebx
mov byte [ebp + 0x1d10], bl
mov byte [ebp + 0x1d11], bl
mov byte [ebp + 0x1d12], bl
mov byte [ebp + 0x1d13], bl
mov byte [ebp + 0x1d7c], bl
mov dword [ebp + 0x1dac], ebx
mov word [ebp + 0x1db0], bx
mov dword [ebp + 0x1db4], ebx
mov dword [ebp + 0x1db8], ebx
mov dword [ebp + 0x1dbc], ebx
mov dword [ebp + 0x1dc4], ebx
mov byte [ebp + 0x1dc8], bl
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0xa8]
rep stosd dword es:[edi], eax
mov dword [ebp + 0x1dcc], ebx
mov dword [ebp + 0x1dd4], ebx
mov dword [ebp + 0x1ddc], ebx
call esi
test eax, eax
je 0x40b09c
call esi
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xa8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xa8]
push 0x48217c
push ecx
call fcn.00445990
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x40b0f9
cmp byte [esi], 0x2d
jne 0x40b0e5
movsx edx, byte [esi + 1]
push edx
call fcn.0044483e
add esp, 4
sub eax, 0x4c
je 0x40b0da
dec eax
jne 0x40b0e5
mov byte [ebp + 0x5ec], 1
jmp 0x40b0e5
add esi, 2
mov ecx, ebp
push esi
call fcn.0040bdd0
push 0x48217c
push ebx
call fcn.00445990
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40b0b7
cmp byte [ebp + 0x5ec], bl
jne 0x40b162
push str.Ventrilo_Multiple_Instance
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [ebp + 0x1db4], eax
jne 0x40b12b
push ebx
push ebx
push str.Unknown_error_creating_previous_instance_trigger.
call fcn.0045ece2
push 1
call fcn.004456d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40b14b
push ebx
push ebx
push str.Another_copy_of_Ventrilo_is_already_running.
call fcn.0045ece2
push 1
call fcn.004456d0
cmp eax, ebx
je 0x40b162
push ebx
push ebx
push str.Unknown_error_detecting_previous_instance.
call fcn.0045ece2
push 1
call fcn.004456d0
push 0xd4
call fcn.0045af6a
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x4b0], 0x31
je 0x40b18f
push ebx
mov ecx, eax
call fcn.00401000
mov esi, eax
mov dword [esp + 0x18], esi
jmp 0x40b195
mov dword [esp + 0x18], ebx
mov esi, ebx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x58]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x4b8], 0x30
call fcn.004016b0
test eax, eax
jne 0x40b426
lea edx, [esp + 0x14]
lea eax, [esp + 0x58]
push edx
push eax
mov ecx, esi
call fcn.00401440
test eax, eax
jne 0x40b426
push 0x10
lea ecx, [esp + 0x5c]
push ebx
push ecx
mov byte [esp + 0x66], bl
mov byte [esp + 0x6f], bl
mov byte [esp + 0x78], bl
mov byte [esp + 0x81], bl
mov byte [esp + 0x8a], bl
call fcn.004450c9
push 0x10
lea edx, [esp + 0x6b]
push ebx
push edx
mov byte [esp + 0x50], al
call fcn.004450c9
mov esi, eax
push 0x10
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.004450c9
push 0x10
lea ecx, [esp + 0x95]
push ebx
push ecx
mov dword [esp + 0x80], eax
call fcn.004450c9
push 0x10
lea edx, [esp + 0xaa]
push ebx
push edx
mov dword [esp + 0x70], eax
call fcn.004450c9
add esp, 0x3c
lea edi, [ebp + 0x1d78]
mov ecx, edi
mov dword [esp + 0x1c], eax
push 0x4821c8
call fcn.0045b3b2
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x3c]
and eax, 0xff
push eax
push str._02X
push ecx
call fcn.004450e0
add esp, 0xc
lea edx, [esp + 0x3c]
mov ecx, edi
push edx
call fcn.0045b605
push esi
lea eax, [esp + 0x24]
push str._08X
push eax
call fcn.004450e0
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
xor edx, edx
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x40b2dc
xor ecx, ecx
mov eax, edx
mov cl, byte [esp + esi + 0x20]
and eax, 0xff
xor ecx, eax
lea edi, [esp + 0x20]
shr edx, 8
mov ecx, dword [ecx*4 + 0x480bac]
xor eax, eax
xor edx, ecx
or ecx, 0xffffffff
inc esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jl 0x40b2ae
push edx
lea edx, [esp + 0x40]
push str._08X
push edx
call fcn.004450e0
add esp, 0xc
lea eax, [esp + 0x3c]
lea ecx, [ebp + 0x1d78]
push eax
call fcn.0045b605
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x20]
push ecx
push str._08x
push edx
call fcn.004450e0
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
xor edx, edx
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x40b35b
xor eax, eax
mov ecx, edx
mov al, byte [esp + esi + 0x20]
and ecx, 0xff
xor eax, ecx
lea edi, [esp + 0x20]
shr edx, 8
mov eax, dword [eax*4 + 0x480bac]
or ecx, 0xffffffff
xor edx, eax
xor eax, eax
inc esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jl 0x40b32c
push edx
lea ecx, [esp + 0x40]
push str._08X
push ecx
call fcn.004450e0
add esp, 0xc
lea edx, [esp + 0x3c]
lea ecx, [ebp + 0x1d78]
push edx
call fcn.0045b605
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x20]
push eax
push str._08X
push ecx
call fcn.004450e0
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
xor edx, edx
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x40b3da
xor eax, eax
mov ecx, edx
mov al, byte [esp + esi + 0x20]
and ecx, 0xff
xor eax, ecx
lea edi, [esp + 0x20]
shr edx, 8
mov eax, dword [eax*4 + 0x480bac]
or ecx, 0xffffffff
xor edx, eax
xor eax, eax
inc esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jl 0x40b3ab
push edx
lea ecx, [esp + 0x40]
push str._08X
push ecx
call fcn.004450e0
add esp, 0xc
lea edx, [esp + 0x3c]
lea esi, [ebp + 0x1d78]
push edx
mov ecx, esi
call fcn.0045b605
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x3c]
push eax
push str._08X
push ecx
call fcn.004450e0
add esp, 0xc
lea edx, [esp + 0x3c]
mov ecx, esi
push edx
call fcn.0045b605
mov esi, dword [esp + 0x18]
cmp esi, ebx
je 0x40b433
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
lea ecx, [esp + 0x14]
mov byte [esp + 0x4b0], 0x2f
call fcn.0045b229
mov ecx, dword [esp + 0x4a8]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4a4
ret 4