Function at 0x410ac0
Capabilities:
Check mutex on windows
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c8
mov eax, dword [0x43ce30]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 0x404
call fcn.00411090
add esp, 4
push 0
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, 0x43e214
call fcn.004110c0
mov dword [ebp - 8], eax
call fcn.00410780
xor ecx, ecx
je 0x410ba4
mov edx, dword [ebp + 8]
push edx
call fcn.004109b0
add esp, 4
mov byte [ebp - 0x12d], al
movzx eax, byte [ebp - 0x12d]
test eax, eax
jne 0x410ba4
lea ecx, [ebp - 0x180]
call fcn.00403890
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x180]
call fcn.00411600
cmp eax, 1
jne 0x410b74
push 1
push 0
push 0
push str.http:__yydl.duowan.com_4_setup_YYSetup.exe
push 0x43571c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x43e214
call fcn.00411210
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0x3bc], 0
lea ecx, [ebp - 0x180]
call fcn.004038d0
mov eax, dword [ebp - 0x3bc]
jmp 0x410d60
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x12c]
call fcn.004030d0
push 0x4357d0
lea ecx, [ebp - 0x12c]
call fcn.00401d00
cmp eax, 0xffffffff
jne 0x410c34
lea ecx, [ebp - 0x1ac]
call fcn.00402620
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x1ac]
call fcn.00411580
cmp eax, 1
je 0x410c27
mov ecx, 0x43e214
call fcn.00411210
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0x3c0], 0
lea ecx, [ebp - 0x1ac]
call fcn.00402650
lea ecx, [ebp - 0x12c]
call fcn.00401860
mov eax, dword [ebp - 0x3c0]
jmp 0x410d60
lea ecx, [ebp - 0x1ac]
call fcn.00402650
jmp 0x410c48
push str.0980E678_72D2_484b_B983_D4E17598D5B7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x43e200], eax
push 0x114
push 0
lea edx, [ebp - 0x128]
push edx
call fcn.00422790
add esp, 0xc
mov dword [ebp - 0x128], 0x114
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
jb 0x410d23
call fcn.00410860
movzx ecx, al
test ecx, ecx
je 0x410d02
push 0x104
lea edx, [ebp - 0x3b8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 1
push 0
push str._admin
lea ecx, [ebp - 0x3b8]
push ecx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x4e20
mov edx, dword [0x43e20c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x43e214
call fcn.00411210
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0x3c4], 0
lea ecx, [ebp - 0x12c]
call fcn.00401860
mov eax, dword [ebp - 0x3c4]
jmp 0x410d60
push str.admin
lea ecx, [ebp - 0x12c]
call fcn.00401d00
cmp eax, 0xffffffff
je 0x410d23
mov eax, dword [0x43e20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00410a60
add esp, 8
mov dword [ebp - 4], eax
mov ecx, 0x43e214
call fcn.00411210
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c8], eax
lea ecx, [ebp - 0x12c]
call fcn.00401860
mov eax, dword [ebp - 0x3c8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00422540
mov esp, ebp
pop ebp
ret 0x10