Function at 0x1000c81c
Capabilities:
Check mutex on windows
Create thread
Get session user name

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor esi, esi
push 0x1002b488
mov dword [esp + 0x14], esi
call edi
mov eax, 0x1002b480
mov dword [0x1002b484], eax
mov dword [0x1002b480], eax
mov dword [0x1002b4a4], esi
push 0x5c
mov dword [0x1002b4a0], esi
call fcn.100012ea
mov dword [0x1002b478], eax
cmp eax, esi
je 0x1000c886
push 0x5c
push esi
push eax
call sub.ntdll.dll_memset
mov eax, dword [0x1002b478]
add esp, 0xc
add eax, 0x40
push eax
call edi
mov eax, dword [0x1002b478]
mov dword [eax], 0x1002d1ef
xor ebx, ebx
jmp 0x1000c889
push 8
pop ebx
cmp ebx, esi
jne 0x1000cad8
push dword [0x1002b1dc]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x1002b1e0], eax
cmp eax, esi
je 0x1000cad6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000cad6
call fcn.1000f825
mov ebx, eax
cmp ebx, esi
jne 0x1000cad8
call fcn.1000ab8e
mov ebx, eax
cmp ebx, esi
jne 0x1000cad8
mov edi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [esp + 0x10]
push eax
push esi
call edi
cmp dword [esp + 0x10], esi
je 0x1000c912
push dword [esp + 0x10]
push esi
push dword [0x1002b100]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x1002b130], eax
cmp eax, esi
je 0x1000c912
lea ecx, [esp + 0x10]
push ecx
push eax
call edi
mov eax, dword [0x1002b1b4]
cmp eax, 0x261a7bbe
je 0x1000c93f
cmp eax, 0xd32098b1
je 0x1000c93f
cmp eax, 0x8878a677
je 0x1000c93f
push dword [esp + 0x1c]
call fcn.100205ec
mov ebx, eax
cmp ebx, esi
jne 0x1000cad8
call fcn.1000c795
call fcn.1000a7cd
mov ebx, eax
cmp ebx, esi
jne 0x1000cad8
call fcn.10003abc
push 0x18
push esi
push dword [0x1002b100]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x1002b170], eax
cmp eax, esi
je 0x1000cad8
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [eax + 4], esi
mov dword [eax], esi
lea edi, [eax + 4]
lea eax, [esp + 0x14]
push eax
push esi
push esi
push 0x1000c497
push esi
push esi
call ebp
mov ecx, dword [0x1002b170]
mov edx, dword [edi]
mov dword [ecx + edx*4 + 8], eax
mov eax, dword [edi]
cmp dword [ecx + eax*4 + 8], esi
je 0x1000cad8
inc eax
cmp dword [0x1002b1b4], 0x9aa952ca
mov dword [edi], eax
jne 0x1000ca4f
push 0x1002b1bc
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
call fcn.1001ed2b
mov ebx, eax
cmp ebx, esi
jne 0x1000cad8
test byte [0x1002a5c4], 4
je 0x1000c9f7
mov dword [0x1002b2a8], edi
mov dword [0x1002b2f4], edi
mov dword [0x1002b2c0], edi
push section..bss
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000ca17
push edi
push 0x1002ab54
push edi
push 0x1002ab48
call fcn.1000a697
mov eax, dword [0x1002b170]
mov ecx, dword [eax + 4]
lea eax, [eax + ecx*4 + 8]
push eax
call fcn.1000b264
mov ebx, eax
cmp ebx, esi
jne 0x1000cad8
mov eax, dword [0x1002b170]
inc dword [eax + 4]
cmp dword [0x1002b124], esi
je 0x1000ca5c
push 0x1002b120
call fcn.10001f47
jmp 0x1000ca5c
cmp dword [0x1002b21c], esi
je 0x1000ca5c
call fcn.1000c3d2
mov eax, dword [0x1002b1b4]
cmp eax, esi
je 0x1000cad6
cmp eax, 0x9aa952ca
jne 0x1000caa6
push 0x43
push esi
push dword [0x1002b100]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x1002b1e8], eax
cmp eax, esi
je 0x1000caa6
mov ecx, dword [0x1002b210]
movzx edx, ch
push 0x100253ef
push edx
movzx ecx, cl
push ecx
push 0x1002c0f8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov edi, dword [0x1002b170]
lea eax, [esp + 0x14]
push eax
push esi
push esi
push 0x10004c7a
push esi
push esi
add edi, 4
call ebp
mov ecx, dword [0x1002b170]
mov edx, dword [edi]
mov dword [ecx + edx*4 + 8], eax
mov eax, dword [edi]
cmp dword [ecx + eax*4 + 8], esi
je 0x1000cad8
inc eax
mov dword [edi], eax
xor ebx, ebx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
pop ecx
ret 4