Function at 0x401a70
Capabilities:
Accept command line arguments
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x60a027
mov eax, dword fs:[0]
push eax
sub esp, 0xdf8
mov eax, dword [0x685680]
xor eax, esp
mov dword [esp + 0xdf0], eax
push ebx
push esi
push edi
mov eax, dword [0x685680]
xor eax, esp
push eax
lea eax, [esp + 0xe08]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x24], ebx
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x40], 8
mov dword [esp + 0x44], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, ebx
call fcn.004ba2eb
lea eax, [esp + 0xd6c]
push eax
mov ecx, ebx
mov dword [esp + 0xd8c], 0x63696c70
mov word [esp + 0xd83], 0x7265
mov word [esp + 0xd7d], 0x6472
mov dword [esp + 0xd78], 0x7a695770
mov dword [esp + 0xd73], 0x41206c61
mov word [esp + 0xd80], 0x6547
mov word [esp + 0xd88], 0x2064
mov byte [esp + 0xd7f], 0x2d
mov word [esp + 0xd95], 0x73
mov word [esp + 0xd70], 0x6f4c
mov dword [esp + 0xd90], 0x6f697461
mov word [esp + 0xd85], 0x7461
mov word [esp + 0xd8a], 0x7041
mov byte [esp + 0xd72], 0x63
mov byte [esp + 0xd7c], 0x61
mov byte [esp + 0xd94], 0x6e
mov byte [esp + 0xd77], 0x70
mov byte [esp + 0xd87], 0x65
mov byte [esp + 0xd82], 0x6e
call fcn.004bc947
call fcn.004bcb89
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x18], eax
call fcn.004bd57a
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x401bd2
push 0x80004005
call fcn.00403360
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x38], esi
mov dword [esp + 0xe10], 0
call fcn.004bd57a
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x401c07
push 0x80004005
call fcn.00403360
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0xe10], 1
call fcn.004bd57a
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x401c39
push 0x80004005
call fcn.00403360
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [esp + 0x28], edi
mov byte [esp + 0xe10], 2
call fcn.004bd57a
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x401c6b
push 0x80004005
call fcn.00403360
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [esp + 0x34], ebx
mov edx, dword [esp + 0x18]
mov byte [esp + 0xe10], 3
mov byte [esp + 0x2c], 0
mov byte [esp + 0x17], 0
mov byte [esp + 0x30], 0
test edx, edx
je 0x401e22
mov eax, dword [esp + 0x1c]
cmp eax, 1
jle 0x401cea
mov eax, dword [edx + 4]
mov ecx, str._afterinstall
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401cd6
test dx, dx
je 0x401cd2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401cd6
add eax, 4
add ecx, 4
test dx, dx
jne 0x401cb0
xor eax, eax
jmp 0x401cdb
sbb eax, eax
or eax, 1
mov edx, dword [esp + 0x18]
test eax, eax
mov eax, dword [esp + 0x1c]
sete byte [esp + 0x2c]
cmp eax, 2
jle 0x401d41
mov eax, dword [edx + 4]
mov ecx, str._needinstall
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401d1d
test dx, dx
je 0x401d19
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401d1d
add eax, 4
add ecx, 4
test dx, dx
jne 0x401cf7
xor eax, eax
jmp 0x401d22
sbb eax, eax
or eax, 1
test eax, eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x38]
push dword [eax + 8]
sete byte [esp + 0x1b]
call fcn.004032b0
mov esi, dword [esp + 0x38]
mov eax, dword [esp + 0x1c]
cmp eax, 3
jle 0x401d88
mov eax, dword [esp + 0x18]
mov ecx, str._silent
mov eax, dword [eax + 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401d78
test dx, dx
je 0x401d74
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401d78
add eax, 4
add ecx, 4
test dx, dx
jne 0x401d52
xor eax, eax
jmp 0x401d7d
sbb eax, eax
or eax, 1
test eax, eax
mov eax, dword [esp + 0x1c]
sete byte [esp + 0x30]
cmp eax, 4
jle 0x401da1
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push dword [eax + 0x10]
call fcn.004032b0
mov eax, dword [esp + 0x1c]
cmp eax, 5
jle 0x401dbe
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x28]
push dword [eax + 0x14]
call fcn.004032b0
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
cmp eax, 6
jle 0x401dd7
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x34]
push dword [eax + 0x18]
call fcn.004032b0
mov ebx, dword [esp + 0x34]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [esp + 0x17], 0
je 0x401e22
xor cl, cl
call fcn.004295e0
push 0x646b88
push ebx
call fcn.005ce3e4
test eax, eax
sete byte [esp + 0x20]
add esp, 4
push dword [esp + 0x34]
push esi
push dword [esp + 0x24]
push edi
push dword [esp + 0x34]
push ecx
call fcn.00429f00
add esp, 0x1c
mov cl, 1
call fcn.00405fa0
push 0x63
lea eax, [esp + 0xd99]
push 0
push eax
mov byte [esp + 0xda0], 0
call fcn.005d1b40
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push eax
push str.BrowserSaferMngr_RUN_Mutex__d
lea eax, [esp + 0xd9c]
push 0x64
push eax
call fcn.005ce01a
add esp, 0x10
lea eax, [esp + 0xd94]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [esp + 0x24]
mov dword [ecx + 0xcc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401e97
mov eax, dword [esp + 0x24]
push dword [eax + 0xcc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401ee0
push ecx
push dword [esp + 0x30]
lea ecx, [esp + 0x4c]
call fcn.00403ed0
mov byte [esp + 0xe10], 4
call fcn.004be3fd
mov eax, dword [eax + 8]
push eax
lea ecx, [esp + 0x48]
call fcn.00404270
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x44]
mov dword [eax + 0x20], ecx
call fcn.004bea25
lea ecx, [esp + 0x44]
mov byte [esp + 0xe10], 3
call fcn.00401fa0
lea edx, [ebx - 0x10]
or ebx, 0xffffffff
mov eax, ebx
lea ecx, [edx + 0xc]
mov byte [esp + 0xe10], 2
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x401f04
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov ecx, ebx
lea eax, [edi + 0xc]
mov byte [esp + 0xe10], 1
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x401f25
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0xe10], 0
mov edx, dword [esp + 0x20]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x401f4a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [esp + 0xe10], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x401f6c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [esp + 0xe08]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xdf0]
xor ecx, esp
call fcn.005cd355
mov esp, ebp
pop ebp
ret