Function at 0x41f500
Capabilities:
Check mutex on windows
Extract resource via kernel32 functions
Get memory capacity
Get system information on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov ecx, 0x51044a
push ebx
push esi
push edi
call fcn.004b532d
call fcn.00405240
mov ecx, eax
test ecx, ecx
je 0x41f924
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 8]
add eax, 0x10
push edi
mov dword [ebp - 8], eax
call fcn.00404300
test al, al
jne 0x41f569
test edi, edi
jne 0x41f548
xor ecx, ecx
jmp 0x41f55f
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f550
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 8]
call fcn.00406280
mov eax, 1
mov dword [ebp - 0xc], 0
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movq qword [ebp - 0x14], xmm0
pop ebx
nop
lea ebx, [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
or ebx, 0xffffffff
mov eax, dword [ebp - 0x10]
sar eax, 0x1f
test al, 1
jne 0x41f901
call fcn.0041f490
test al, al
jne 0x41f901
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x70], 2
jb 0x41f901
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
shrd ecx, eax, 0x14
cmp ecx, 0x800
jb 0x41f901
push 0
push 0
push 3
push 0
push 3
push 0
push str..PhysicalDrive0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
lea ecx, [ebp + 0x10]
push ecx
push 0x18
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0
push 0x70000
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp - 0xc]
mul dword [ebp - 0x10]
push 0
push dword [ebp - 0x14]
push edx
push eax
call fcn.004b58d0
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push edx
push eax
call fcn.004b58d0
push 0
push 0x40000000
push edx
push eax
call fcn.004b5820
cmp eax, 0x64
jb 0x41f901
push edi
lea ecx, [ebp + 0x10]
call fcn.00403700
lea eax, [ebp + 0x10]
push 0x50e40c
push eax
call fcn.0040f390
mov edx, dword [ebp + 0x10]
add esp, 8
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41f68d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.GCMainWnd
lea ecx, [ebp - 4]
call fcn.00403700
cmp byte [0x50e40d], 0
jne 0x41f79f
cmp byte [0x50e413], 0
jne 0x41f73b
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push 0x4e5e20
push eax
call fcn.00403ed0
add esp, 0xc
push dword [eax]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
lea ecx, [ebp + 0x10]
mov esi, eax
call fcn.00403a30
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x41f6f0
test esi, esi
jne 0x41f76f
push dword [ebp - 4]
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
je 0x41f8e7
cmp byte [0x50e40e], 0
jne 0x41f8e7
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0xf020
push 0x112
push edi
call esi
push 0
push 0xf120
push 0x112
push edi
call esi
jmp 0x41f8e7
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push str.Global_
push eax
call fcn.00403ed0
add esp, 0xc
push dword [eax]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
lea ecx, [ebp + 0x10]
call fcn.00403a30
cmp byte [0x50e40d], 0
jne 0x41f79f
cmp byte [0x50e40e], 0
jne 0x41f79f
cmp byte [0x50e413], 0
jne 0x41f79f
push 0x50e40c
call fcn.00410e60
add esp, 4
test al, al
je 0x41f8e7
mov edi, dword [ebp + 8]
push edi
call fcn.0042d560
add esp, 4
push 0x4e5cc0
push 0x81
call fcn.00425610
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41f837
push esi
call fcn.00425610
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41f82d
push esi
call fcn.00425610
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x41f82d
push 0
push eax
push edi
call fcn.0042d990
add esp, 0xc
push 0
push ecx
mov ecx, dword [0x50eb0c]
mov eax, esp
mov dword [eax], str.res.xml
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x50e408]
cmp eax, dword [ecx + 0x10]
jg 0x41f92e
mov ecx, dword [0x50e404]
call fcn.00439940
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edi, dword [ebp + 8]
push 0xc
call fcn.004b5382
add esp, 4
test eax, eax
je 0x41f84e
mov ecx, eax
call fcn.00421740
jmp 0x41f850
xor eax, eax
push 2
mov ecx, eax
call fcn.00421e40
push 0x7e0
call fcn.004b5382
add esp, 4
test eax, eax
je 0x41f87a
push 0x50e40c
mov ecx, eax
call fcn.0041cf90
mov esi, eax
jmp 0x41f87c
xor esi, esi
cmp byte [0x50e40e], 0
mov ecx, esi
jne 0x41f8e2
push 0
push 0
push 0
push 0
push 0xfffffc18
push 0
push 0x96ca0000
push dword [ebp - 4]
push 0
call fcn.0042e800
push 0x6b
push edi
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
push 1
push 0x80
mov ecx, esi
call fcn.00420920
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, esi
call fcn.0042e600
push 5
mov ecx, esi
call fcn.00420920
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0042a3d0
jmp 0x41f8e7
call fcn.0041df90
mov edx, dword [ebp - 4]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41f901
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41f919
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.004042d0
push 0x50e408
call fcn.004b5744
add esp, 4
cmp dword [0x50e408], 0xffffffff
jne 0x41f822
push 0x1f8
call fcn.004b5382
add esp, 4
test eax, eax
je 0x41f962
mov ecx, eax
call fcn.00439230
jmp 0x41f966
xor eax, eax
jmp 0x41f966
push 0x50e408
mov dword [0x50e404], eax
call fcn.004b56fa
add esp, 4
jmp 0x41f822