Function at 0x401aff
Capabilities:
Check mutex on windows
Create process on windows
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x51ac1f
mov eax, dword fs:[0]
push eax
sub esp, 0xa48
mov eax, dword [0x565470]
xor eax, esp
mov dword [esp + 0xa40], eax
push ebx
push esi
push edi
mov eax, dword [0x565470]
xor eax, esp
push eax
lea eax, [esp + 0xa58]
mov dword fs:[0], eax
mov dword [esp + 0x20], ecx
call fcn.0040f84e
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x546be0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
cmp esi, ebx
je 0x401b98
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xb7
jne 0x401b98
push 0x25
push 0x546c44
push 0x546c4c
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
je 0x401b48
jmp 0x401ebf
mov esi, 0x10000
push esi
call fcn.00404bb4
pop ecx
push esi
mov edi, eax
push ebx
push edi
mov dword [esp + 0x20], edi
call fcn.004f99b0
add esp, 0xc
mov esi, 0x8000
push esi
push edi
push str._SystemRoot___SystemRoot__system32__Path_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
mov edi, str.Path
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push esi
push dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push dword [esp + 0x14]
call fcn.00404bbf
pop ecx
call fcn.0040e5e5
push eax
lea ecx, [esp + 0x18]
call fcn.00401759
lea edi, [esp + 0x1c]
mov dword [esp + 0xa60], ebx
call fcn.00402e0d
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xa64], 1
call fcn.0040216c
mov byte [esp + 0xa60], bl
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.004017be
mov eax, dword [esp + 0x14]
mov eax, dword [eax - 0xc]
cmp eax, ebx
je 0x401e6d
push 0x547030
lea ecx, [esp + 0x1c]
call fcn.0040400a
mov edi, 0x54706c
push edi
mov byte [esp + 0xa64], 2
call fcn.00403fcb
pop ecx
push eax
push edi
lea ecx, [esp + 0x20]
call fcn.00403b2d
mov edi, 0x5470a4
push edi
call fcn.00403fcb
pop ecx
push eax
push edi
lea ecx, [esp + 0x20]
call fcn.00403b2d
mov edi, 0x5470d4
push edi
call fcn.00403fcb
pop ecx
push eax
push edi
lea ecx, [esp + 0x20]
call fcn.00403b2d
push 0x23
push 0x546c44
push dword [esp + 0x20]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [esp + 0x1c], eax
cmp eax, 2
jne 0x401cc4
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.004017be
jmp 0x401eb3
push 0xb
mov edi, str._N_vz
call fcn.004048ff
pop ecx
push 0xb
mov edi, 0x5470fc
call fcn.004048ff
pop ecx
mov esi, 0x547104
push 0xb
mov edi, esi
call fcn.004048ff
pop ecx
push 0xb
call fcn.00404abc
pop ecx
push ebx
call fcn.0040483a
cmp dword [esp + 0x20], 7
pop ecx
jne 0x401d1b
mov byte [esp + 0xa60], bl
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.004017be
jmp 0x401e6d
push dword [esp + 0x14]
mov edi, 0x104
push str._s_fssvc.exe
lea eax, [esp + 0x634]
push edi
push eax
call fcn.00403a18
add esp, 0x10
push ebx
push ebx
push str._UnregServer
lea eax, [esp + 0x638]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x401ee5
push 0xa
lea ebx, [esp + 0x630]
call fcn.00402fe0
pop ecx
test eax, eax
js 0x401cb3
push dword [esp + 0x14]
lea eax, [esp + 0x630]
push str._s_fss.exe
push edi
push eax
call fcn.00403a18
push 1
lea ebx, [esp + 0x640]
call fcn.00402fe0
add esp, 0x14
test eax, eax
js 0x401cb3
call fcn.00401435
call fcn.004013cc
push dword [esp + 0x14]
mov eax, ebx
push str._s_npf6.sys
push edi
push eax
call fcn.00403a18
push 1
call fcn.00402fe0
add esp, 0x14
test eax, eax
js 0x401cb3
push dword [esp + 0x14]
mov eax, ebx
push str._sconfigure.exe
push edi
push eax
call fcn.00403a18
push 1
call fcn.00402fe0
add esp, 0x14
test eax, eax
js 0x401cb3
push 0x16
pop ebx
push ebx
mov edi, esi
call fcn.004048ff
pop ecx
push ebx
mov edi, 0x5471e0
call fcn.004048ff
pop ecx
push ebx
mov edi, esi
call fcn.00404abc
pop ecx
push 0x19
call fcn.0040483a
mov dword [esp], 0x5471f4
call fcn.004049c0
mov dword [esp], 0x547210
call fcn.004049c0
pop ecx
push ebx
mov edi, 0x5471fc
call fcn.00404abc
pop ecx
push 0x19
call fcn.0040483a
pop ecx
push dword [esp + 0x14]
call fcn.00402ec7
pop ecx
call fcn.00402d91
mov byte [esp + 0xa60], 0
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.004017be
xor ebx, ebx
lea eax, [esp + 0x24]
push eax
call fcn.004022d7
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xe0]
mov byte [esp + 0xa64], 3
call fcn.0040216c
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x24]
mov dword [ecx + 0x20], eax
mov ecx, eax
call fcn.004102fa
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xa64], bl
call fcn.00401f2b
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004017be
xor eax, eax
mov ecx, dword [esp + 0xa58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa40]
xor ecx, esp
call fcn.004f8839
mov esp, ebp
pop ebp
ret
cmp eax, 2
je 0x401d71
cmp eax, 3
je 0x401d71
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x54714c
lea eax, [esp + 0x844]
push edi
push eax
call fcn.00403a18
add esp, 0x10
push 0x10
push ebx
lea eax, [esp + 0x844]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401cb3