Function at 0x43dbd0
Capabilities:
Check mutex on windows
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0xf0]
sub esp, 0xf0
push 0xffffffffffffffff
push 0x52c9bb
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x55bb24]
xor eax, ebp
mov dword [ebp + 0xec], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x100]
call fcn.004d00f8
push 0xe
xor eax, eax
mov ebx, 7
xor esi, esi
push str.praetorian.log
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], esi
mov word [ebp - 0x38], ax
call fcn.0040b490
mov dword [ebp - 4], esi
call fcn.004cefff
push 0x1ff
push 0x800000
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x11
xor edx, edx
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x14], 0
push str.YandexPraetorian
mov esi, eax
mov word [ecx + 4], dx
call fcn.0040b490
lea eax, [ebp + 0xc8]
push eax
call fcn.004d055b
add esp, 0x24
mov byte [ebp - 4], 1
mov edx, dword [esi]
mov edx, dword [edx]
push eax
lea eax, [ebp - 0x3c]
push eax
mov ecx, esi
call edx
cmp dword [ebp + 0xe0], 8
jb 0x43dcab
mov eax, dword [ebp + 0xcc]
push eax
call fcn.004f0cfc
add esp, 4
xor esi, esi
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 8
mov dword [ebp + 0xe0], ebx
mov dword [ebp + 0xdc], esi
mov word [ebp + 0xcc], cx
jb 0x43dcdb
mov edx, dword [ebp - 0x38]
push edx
call fcn.004f0cfc
add esp, 4
call fcn.004cd12c
call fcn.0043c610
mov ebx, dword [sym.imp.ole32.dll_CoInitialize]
push esi
call ebx
mov dword [0x5615a4], 0x1388
mov dword [0x5615a8], 0x3e8
call fcn.0043fe40
push 0x53ba68
push edi
call fcn.004f2a04
add esp, 8
test eax, eax
jne 0x43e62d
push str._shutdown
push edi
call fcn.004f2a04
add esp, 8
test eax, eax
jne 0x43e62d
push str.__stat_callback
push edi
call fcn.004f2a04
add esp, 8
test eax, eax
je 0x43dd5c
push esi
call ebx
push edi
call fcn.00467110
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x43e6e3
push 0x53bad4
push edi
call fcn.004f2a04
add esp, 8
test eax, eax
jne 0x43e290
push str._suicide
push edi
call fcn.004f2a04
add esp, 8
test eax, eax
jne 0x43e290
mov eax, dword [0x53bb80]
mov cx, word [0x53bb84]
mov dword [ebp + 0xe4], eax
lea ebx, [ebp + 0xe4]
mov eax, edi
mov dword [ebp - 0x18], esi
mov word [ebp + 0xe8], cx
mov byte [ebp - 0x11], 1
call fcn.0043f780
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x43de3b
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.UnregServer
push edi
call esi
test eax, eax
je 0x43de0a
push str.RegServer
push edi
call esi
test eax, eax
je 0x43de20
push str.Automation
push edi
call esi
test eax, eax
je 0x43de3b
push str.Embedding
push edi
call esi
test eax, eax
je 0x43de3b
lea ebx, [ebp + 0xe4]
mov eax, edi
call fcn.0043f780
mov edi, eax
xor ebx, ebx
test edi, edi
jne 0x43ddc3
jmp 0x43de3b
push ebx
push 0x65
push 0x561560
xor ecx, ecx
call fcn.00442580
call fcn.0043fd80
jmp 0x43de35
push 1
push 0x65
push 0x561560
xor ecx, ecx
call fcn.00442580
call fcn.0043f710
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x18], eax
push str.PRAETORIAN_4C56B8C0_F222_4063_9C5B_3E086B924B0E
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
je 0x43de62
call esi
cmp eax, 5
jne 0x43dee9
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 8
call eax
test al, al
je 0x43dee1
push 0x534dc4
push str.Praetorian_already_running.
push 0x534dd4
push 0x8d
push 0x534dd8
push str.wWinMain
push 0x534dc0
call fcn.004cf0d6
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00402b90
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push 8
call fcn.004cf0e5
or eax, 0xffffffff
jmp 0x43e6e5
cmp byte [ebp - 0x11], bl
je 0x43e169
mov dword [ebp - 4], 5
call fcn.00413ac0
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 0x100
call eax
cmp al, bl
je 0x43df92
call fcn.004cf0d6
push 0x534dc0
push eax
call fcn.00405660
add esp, 8
push str.wWinMain
push eax
call fcn.00405660
add esp, 8
push 0x534dd8
push eax
call fcn.00405660
add esp, 8
push 0x96
push eax
call fcn.00402b90
push 0x534dd4
push eax
call fcn.00405660
add esp, 8
push str.ThreadId:
push eax
call fcn.00405660
add esp, 8
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push esi
call fcn.0041f0d0
push 0x534dc4
push eax
call fcn.00405660
add esp, 8
push 0x100
call fcn.004cf0e5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea ecx, [ebp]
push ecx
call fcn.004459f0
push ebx
push ebx
push ebx
lea edx, [ebp]
push ebx
mov dword [0x561358], edx
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x1c], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.0043f4d0
call fcn.0043f3c0
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
push 0x561568
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp + 0xac], 0x53bca4
mov dword [ebp + 0xb0], ebx
mov dword [ebp + 0xb4], ebx
mov dword [ebp + 0xb8], ebx
mov dword [ebp + 0xbc], ebx
mov dword [ebp + 0xc0], ebx
mov dword [ebp + 0xc4], ebx
lea ecx, [ebp + 0xac]
push ecx
mov byte [ebp - 4], 7
call fcn.0043f2d0
lea eax, [ebp]
call fcn.004460c0
cmp al, bl
jne 0x43e0dd
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 8
call eax
cmp al, bl
je 0x43e0b5
call fcn.004cf0d6
push 0x534dc0
push eax
call fcn.00405660
add esp, 8
push str.wWinMain
push eax
call fcn.00405660
add esp, 8
push 0x534dd8
push eax
call fcn.00405660
add esp, 8
push 0xaa
push eax
call fcn.00402b90
push 0x534dd4
push eax
call fcn.00405660
add esp, 8
push str.Main_window_creation_failed_
push eax
call fcn.00405660
add esp, 8
push 0x534dc4
push eax
call fcn.00405660
add esp, 8
push 8
call fcn.004cf0e5
lea esi, [ebp + 0xac]
mov dword [0x561358], ebx
call fcn.0043e710
lea ecx, [ebp]
push ecx
mov byte [ebp - 4], 5
call fcn.00445b90
mov eax, 0xfffffffe
jmp 0x43e6e5
lea edi, [ebp]
call fcn.004477a0
lea edi, [ebp + 0xac]
call fcn.0043f1f0
mov edx, dword [ebp + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43e108
mov eax, dword [ebp + 4]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
call fcn.0043f100
call fcn.0043f020
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x53b9d8
call fcn.0040b580
call fcn.004ce3cb
mov eax, dword [0x56159c]
add esp, 0x1c
cmp eax, ebx
je 0x43e146
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x43e146
mov dword [0x56159c], ebx
call fcn.0043ef00
call dword [sym.imp.ole32.dll_CoUninitialize]
lea esi, [ebp + 0xac]
call fcn.0043e710
lea ecx, [ebp]
push ecx
mov byte [ebp - 4], 5
call fcn.00445b90
mov eax, dword [ebp - 0x18]
jmp 0x43e6e5
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 0x40
call eax
test al, al
je 0x43e30c
push 0x534dc4
push str.Get_suicide_command...
push 0x534dd4
push 0x4f
push 0x534dd8
push str.wWinMain
push 0x534dc0
call fcn.004cf0d6
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00402b90
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push 0x40
call fcn.004cf0e5
sub esp, 0x1c
mov ecx, esp
lea edi, [ebp - 0x18]
mov dword [ebp - 0x1c], esp
call fcn.004cca4b
call fcn.004ce773
add esp, 0x1c
test al, al
je 0x43e481
cmp dword [ebp - 0x18], 1
jle 0x43e481
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x53b9d8
call fcn.0040b580
call fcn.004ce2e3
mov edi, eax
add esp, 0x1c
cmp edi, esi
jne 0x43e3e1
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 8
call eax
test al, al
je 0x43e3e1
push 0x534dc4
push 0x53b9d8
push str.Cant_create_event:
push 0x534dd4
push 0x56
push 0x534dd8
push str.wWinMain
push 0x534dc0
call fcn.004cf0d6
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00402b90
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.004390f0
push eax
call fcn.00405660
add esp, 8
push 8
call fcn.004cf0e5
call fcn.0043d9e0
cmp edi, esi
je 0x43e481
push 0x2710
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
jne 0x43e47a
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 0x40
call eax
test al, al
je 0x43e47a
push 0x534dc4
push str.Praetorian_shutdowned.
push 0x534dd4
push 0x5b
push 0x534dd8
push str.wWinMain
push 0x534dc0
call fcn.004cf0d6
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00402b90
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push 0x40
call fcn.004cf0e5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 0x100
call eax
test al, al
je 0x43e503
push 0x534dc4
push str.Unregister_COM...
push 0x534dd4
push 0x60
push 0x534dd8
push str.wWinMain
push 0x534dc0
call fcn.004cf0d6
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00402b90
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push 0x100
call fcn.004cf0e5
push esi
push 0x65
push 0x561560
xor ecx, ecx
call fcn.00442580
call fcn.0043fd80
call fcn.004676d0
lea edi, [ebp - 0x3c]
call fcn.004cc9db
mov edx, str._fixhosts.exe
mov ecx, eax
lea edi, [ebp + 0xc8]
mov dword [ebp - 4], 2
call fcn.0041ad70
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 4
call fcn.00402d80
cmp dword [ebp + 0xe0], 8
mov eax, dword [ebp + 0xcc]
jae 0x43e55e
lea eax, [ebp + 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x43e61d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 8
call eax
test al, al
je 0x43e61d
push str.Cant_remove_fixhosts.exe._Error:
push 0x534dd4
push 0x6a
push 0x534dd8
push str.wWinMain
push 0x534dc0
call fcn.004cf0d6
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00402b90
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
cmp eax, esi
jne 0x43e5e8
xor ecx, ecx
jmp 0x43e5ef
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
mov edx, dword [ecx + 0x10]
push 0x534dc4
and edx, 0xfffff9ff
push edi
or edx, 0x800
push eax
mov dword [ecx + 0x10], edx
call fcn.0041f0d0
push eax
call fcn.00405660
add esp, 8
push 8
call fcn.004cf0e5
lea ecx, [ebp + 0xc8]
call fcn.00402d80
jmp 0x43e6e3
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 0x40
call eax
test al, al
je 0x43e6a9
push 0x534dc4
push str.Get_Shutdown_command...
push 0x534dd4
push 0x41
push 0x534dd8
push str.wWinMain
push 0x534dc0
call fcn.004cf0d6
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00402b90
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push eax
call fcn.00405660
add esp, 8
push 0x40
call fcn.004cf0e5
sub esp, 0x1c
mov ecx, esp
mov dword [ecx + 0x14], esi
mov eax, str.__xml_version_1.0__encoding_utf_8____commands__command__action_shutdown__action___command___commands_
mov dword [ecx + 0x18], 0xf
mov dword [ebp - 0x1c], esp
mov byte [ecx + 4], 0
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x43e6c7
sub eax, esi
push eax
push str.__xml_version_1.0__encoding_utf_8____commands__command__action_shutdown__action___command___commands_
call fcn.00403c20
call fcn.0043d7a0
add esp, 0x1c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xec]
xor ecx, ebp
call fcn.004f070d
add ebp, 0xf0
mov esp, ebp
pop ebp
ret 0x10