Function at 0x402750
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1950
call fcn.00413340
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x194c], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov dword [esp + 0x10], 0x34333231
mov dword [esp + 0x14], 0x373635
push edi
test eax, eax
je 0x4027c2
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402790
sub eax, edx
sar eax, 1
cmp eax, 5
jne 0x4027ad
mov byte [esp + 0x19], cl
jmp 0x40284b
cmp eax, 6
je 0x402910
mov ecx, 7
xor esi, esi
cmp eax, ecx
cmove esi, ecx
push 0x7ff
lea eax, [esp + 0x955]
mov dword [esp + 0xc], 0
push 0
push eax
mov byte [esp + 0x95c], 0
call fcn.0040f3c0
add esp, 8
mov dword [esp + 0x10], 0
lea eax, [esp + 0x954]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00403510
cmp dword [esp + 0xc], 0
jne 0x402aac
push ecx
lea eax, [esp + 0x954]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004039d0
cmp dword [esp + 0xc], 0
jne 0x402aac
call fcn.00403440
test eax, eax
jne 0x402aac
test esi, esi
jne 0x402910
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [esp + 0x1c], 0x540041
mov word [esp + 0x44], ax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
mov dword [esp + 0x2c], 0x3a004c
mov dword [esp + 0x30], 0x4c0043
mov dword [esp + 0x34], 0x530041
mov dword [esp + 0x38], 0x4e0053
mov dword [esp + 0x3c], 0x4d0041
mov dword [esp + 0x40], 0x410045
mov dword [esp + 0x44], 0x540053
mov dword [esp + 0x48], 0x490050
mov dword [esp + 0x4c], 0x50004d
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x402aac
push 0x103
lea eax, [esp + 0x4d]
mov byte [esp + 0x4c], 0
push 0
push eax
call fcn.0040f3c0
add esp, 0xc
lea eax, [esp + 0x48]
push 0x104
push eax
push dword [0x546150]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.004026c0
test eax, eax
je 0x402aac
xor eax, eax
push 0x3fe
push eax
mov word [esp + 0x158], ax
lea eax, [esp + 0x15a]
push eax
call fcn.0040f3c0
add esp, 0xc
xor eax, eax
mov word [esp + 0x550], ax
push 0x3fe
push eax
lea eax, [esp + 0x55a]
push eax
call fcn.0040f3c0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x402aac
lea eax, [esp + 0x150]
push eax
push dword [esp + 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [esp + 0x150]
push eax
lea eax, [esp + 0x554]
push 0x200
push eax
call fcn.00408045
add esp, 0xc
lea ecx, [esp + 0x150]
call fcn.00402490
lea eax, [esp + 8]
mov dword [esp + 8], 0x5c
push eax
lea ecx, [esp + 0x20]
call fcn.00402ad0
xor eax, eax
push 0x3fe
push eax
mov word [esp + 0x1158], ax
lea eax, [esp + 0x115a]
push eax
call fcn.0040f3c0
add esp, 0xc
xor eax, eax
mov word [esp + 0x1550], ax
push 0x3fe
push eax
lea eax, [esp + 0x155a]
push eax
call fcn.0040f3c0
add esp, 0xc
xor eax, eax
mov word [esp + 0x950], ax
push 0x3fe
push eax
lea eax, [esp + 0x95a]
push eax
call fcn.0040f3c0
add esp, 0xc
lea eax, [esp + 0x1c]
cmp dword [esp + 0x30], 8
cmovae eax, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x1154]
push 0x200
push eax
call fcn.00408045
add esp, 0xc
lea eax, [esp + 0x1c]
cmp dword [esp + 0x30], 8
cmovae eax, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x1554]
push 0x200
push eax
call fcn.00408045
add esp, 0xc
lea eax, [esp + 0x1c]
cmp dword [esp + 0x30], 8
cmovae eax, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x954]
push 0x200
push eax
call fcn.00408045
add esp, 0xc
cmp dword [esp + 0x30], 8
jb 0x402a97
push dword [esp + 0x1c]
call fcn.00407e6a
add esp, 4
lea eax, [esp + 0x150]
push eax
lea eax, [esp + 0x554]
push eax
call fcn.00401720
mov ecx, dword [esp + 0x1954]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00407dbf
mov esp, ebp
pop ebp
ret 4