Function at 0x407521
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Delete file
Terminate process

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x4d8
mov eax, dword [0x43bfc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.kaishi
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
mov byte [ebp - 0x440], 0
lea ecx, [ebp - 0x470]
push dword [ebp - 0x440]
mov byte [ebp - 0x43c], 0
push dword [ebp - 0x43c]
push dword [ebp - 0x43c]
call fcn.0040683a
mov ecx, eax
call fcn.00406267
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x407621
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x407621
mov byte [ebp - 0x43c], 0
lea ecx, [ebp - 0x400]
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], 0
push dword [ebp - 0x440]
push dword [ebp - 0x43c]
call fcn.00406569
mov ecx, eax
call fcn.004062f9
mov byte [ebp - 0x43c], 0
lea ecx, [ebp - 0x470]
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], 0
mov esi, eax
push dword [ebp - 0x440]
push dword [ebp - 0x43c]
call fcn.00406aff
mov ecx, eax
call fcn.00406267
push 0
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov edi, 0x43c398
mov ecx, edi
call fcn.00405566
mov byte [ebp - 0x43c], 0
lea ecx, [ebp - 0x400]
mov byte [ebp - 0x440], 0
test al, al
jne 0x4076ab
push dword [ebp - 0x43c]
push dword [ebp - 0x440]
push dword [ebp - 0x43c]
call fcn.00406569
mov ecx, eax
call fcn.004062f9
mov byte [ebp - 0x43c], 0
lea ecx, [ebp - 0x470]
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], 0
mov esi, eax
push dword [ebp - 0x440]
push dword [ebp - 0x43c]
call fcn.00406c32
mov ecx, eax
call fcn.00406267
xor edi, edi
push edi
push 0x10
push esi
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxExW]
push edi
jmp 0x40761b
sub esp, 0x18
mov esi, esp
push dword [ebp - 0x43c]
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.00406d84
mov ecx, eax
call fcn.004062f9
push eax
mov ecx, esi
call fcn.00405429
call fcn.00416936
add esp, 0x18
mov dword [0x43c2f4], eax
cmp eax, 2
jne 0x40779c
call fcn.00416b01
cmp eax, 1
je 0x40777b
mov ecx, edi
call fcn.004057d9
mov byte [ebp - 0x43c], 0
lea ecx, [ebp - 0x400]
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], 0
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.00406569
mov ecx, eax
call fcn.004062f9
mov byte [ebp - 0x43c], 0
lea ecx, [ebp - 0x470]
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], 0
mov esi, eax
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.00406db9
mov ecx, eax
call fcn.00406267
xor ecx, ecx
push ecx
push ecx
push esi
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxExW]
push 0
jmp 0x40761b
push 0
push 0
call fcn.00416abf
push 0xfa
push 0xa
push 0x3c
push 8
call fcn.00416ad9
mov eax, dword [0x43c2f4]
add esp, 0x18
cmp eax, 1
jne 0x40784c
call fcn.0041636a
mov dword [0x43c2f0], eax
test eax, eax
jns 0x407825
mov ecx, edi
call fcn.004057d9
mov byte [ebp - 0x43c], 0
lea ecx, [ebp - 0x410]
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], 0
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.00406569
mov ecx, eax
call fcn.004062f9
mov byte [ebp - 0x43c], 0
lea ecx, [ebp - 0x460]
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], 0
mov esi, eax
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.00406e18
mov ecx, eax
call fcn.004062f9
jmp 0x407767
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x400]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x3f4]
push dword [ebp - 0x3f8]
call fcn.0041632d
pop ecx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov ecx, edi
call fcn.00405795
test al, al
jne 0x4078e5
mov byte [ebp - 0x43c], al
lea ecx, [ebp - 0x460]
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], al
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.00406569
mov ecx, eax
call fcn.004062f9
mov byte [ebp - 0x43c], 0
lea ecx, [ebp - 0x410]
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], 0
mov esi, eax
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.0040659e
mov ecx, eax
call fcn.004062f9
xor edi, edi
push edi
push 0x10
push esi
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxExW]
mov ecx, 0x43c398
call fcn.004057d9
jmp 0x4076a5
mov ecx, edi
call fcn.004057d9
push 0x3e8
lea eax, [ebp - 0x3f0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
push eax
push eax
push eax
push 1
push 1
call fcn.00421980
add esp, 0x20
mov byte [ebp - 0x43c], 0
mov byte [ebp - 0x440], 0
lea ecx, [ebp - 0x420]
push dword [ebp - 0x43c]
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.00406712
mov ecx, eax
call fcn.00406267
mov byte [ebp - 0x43c], 0
lea ecx, [ebp - 0x4d0]
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], 0
mov edi, eax
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.00406608
mov ecx, eax
call fcn.00406f12
mov byte [ebp - 0x43c], 0
lea ecx, [ebp - 0x460]
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], 0
mov esi, eax
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.004065d3
mov ecx, eax
call fcn.004062f9
push 0
push 0
push edi
push esi
push 0x1a86
push eax
call fcn.004219f0
lea eax, [ebp - 0x3f0]
push eax
call fcn.00428f00
add esp, 0x1c
test al, al
je 0x4079d5
mov byte [0x43c2ed], 1
sub esp, 0x18
mov byte [ebp - 0x43c], 0
mov esi, esp
mov byte [ebp - 0x440], 0
lea ecx, [ebp - 0x460]
push dword [ebp - 0x43c]
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.00406771
mov ecx, eax
call fcn.004062f9
push eax
mov ecx, esi
call fcn.00405429
lea eax, [ebp - 0x438]
push eax
call fcn.004166fe
lea eax, [ebp - 0x438]
push 0x434545
push eax
call fcn.00406e4d
add esp, 0x24
test al, al
je 0x407aa3
mov byte [ebp - 0x43c], 0
lea ecx, [ebp - 0x460]
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], 0
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.00406569
mov ecx, eax
call fcn.004062f9
mov byte [ebp - 0x43c], 0
lea ecx, [ebp - 0x420]
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], 0
mov esi, eax
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.004067a6
mov ecx, eax
call fcn.00406267
jmp 0x407767
xor eax, eax
lea ecx, [ebp - 0x438]
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x3f0]
push eax
call fcn.00404582
push eax
call fcn.00428890
add esp, 0x18
lea ecx, [ebp - 0x460]
test al, al
je 0x407cb6
mov byte [ebp - 0x43c], 0
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], 0
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.00406805
mov ecx, eax
call fcn.004062f9
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
push eax
call esi
pop ecx
mov byte [ebp - 0x43c], 0
lea ecx, [ebp - 0x460]
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], 0
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.00406962
mov ecx, eax
call fcn.004062f9
push eax
call esi
pop ecx
mov byte [ebp - 0x43c], 0
lea ecx, [ebp - 0x460]
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], 0
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.00406997
mov ecx, eax
call fcn.004062f9
push eax
call esi
pop ecx
mov byte [ebp - 0x43c], 0
lea ecx, [ebp - 0x460]
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], 0
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.004069cc
mov ecx, eax
call fcn.004062f9
push eax
call esi
push 1
xor eax, eax
push eax
push eax
push eax
mov eax, 0x407386
cdq
push 0xc0
push edx
push eax
call fcn.00416030
push 1
xor eax, eax
push eax
push eax
push eax
mov eax, fcn.00407383
cdq
push 0x70
push edx
push eax
call fcn.00416030
push 1
xor eax, eax
push eax
push eax
push eax
mov eax, 0x4071e1
cdq
push 0x24
push edx
push eax
call fcn.00416030
add esp, 0x58
push 1
xor eax, eax
push eax
push eax
push eax
mov eax, 0x40715f
cdq
push 0x23
push edx
push eax
call fcn.00416030
add esp, 0x1c
lea ecx, [ebp - 0x460]
xor eax, eax
mov byte [ebp - 0x43c], al
mov byte [ebp - 0x440], al
push eax
push 0x40
push dword [ebp - 0x43c]
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.00406a01
mov ecx, eax
call fcn.004062f9
push eax
lea eax, [ebp - 0x3f0]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxExA]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea edi, [ebp - 0x41c]
push 7
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
jmp 0x407c7e
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x41c]
push eax
call esi
test eax, eax
jne 0x407c64
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
lea ecx, [ebp - 0x438]
call fcn.00403d61
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041d5bd
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10
xor eax, eax
push eax
mov byte [ebp - 0x43c], al
push dword [ebp - 0x43c]
mov byte [ebp - 0x440], al
push dword [ebp - 0x440]
push dword [ebp - 0x444]
call fcn.00406a36
mov ecx, eax
call fcn.004062f9
push eax
lea eax, [ebp - 0x3f0]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x407619