Function at 0x401ac0
Capabilities:
Check mutex on windows
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [0x40f050]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [ebp + 8]
push esi
push edi
push str.User_Registration_IJRMF.EXE
push 1
push 0
mov dword [0x410e30], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
test edi, edi
jne 0x401b5f
call fcn.00401150
push 0x104
lea eax, [esp + 0xc]
push eax
push dword [0x410e30]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 4
push edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push str.IJRMF_DELETE_END_EVENT
push edi
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x401b47
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00401e96
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401bd9
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
call fcn.00401150
push 0x104
lea eax, [esp + 0xc]
push eax
push dword [0x410e30]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 4
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push str.IJRMF_DELETE_END_EVENT
push 0
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x401b47
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call edi
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00401e96
mov esp, ebp
pop ebp
ret 0x10
call fcn.004015a0
test eax, eax
jne 0x401c52
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
call fcn.00401150
push 0x104
lea eax, [esp + 0xc]
push eax
push dword [0x410e30]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 4
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push str.IJRMF_DELETE_END_EVENT
push 0
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x401c37
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call edi
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00401e96
mov esp, ebp
pop ebp
ret 0x10
push 0
mov edx, 0x40de9c
mov ecx, 0x410c28
call fcn.00401760
add esp, 4
cmp dword [0x410c24], 0
je 0x401ca5
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x410c28
call esi
test eax, eax
je 0x401ca5
call fcn.00401960
test eax, eax
je 0x401ca5
push 0
mov edx, 0x40de9c
mov ecx, 0x410c28
call fcn.00401760
add esp, 4
dec dword [0x410c24]
jne 0x401c75
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
call fcn.00401150
push 0x104
lea eax, [esp + 0xc]
push eax
push dword [0x410e30]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 4
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push str.IJRMF_DELETE_END_EVENT
push 0
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x401cfa
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call edi
mov ecx, dword [esp + 0x214]
mov eax, dword [0x410e34]
pop edi
pop esi
xor ecx, esp
call fcn.00401e96
mov esp, ebp
pop ebp
ret 0x10