Function at 0x401990
Capabilities:
Check mutex on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0040e900
xor edx, edx
test al, al
setne dl
xor esi, esi
xorps xmm0, xmm0
mov byte [ebp - 1], al
mov dword [ebp - 0x18], 0
movq qword [ebp - 0x14], xmm0
mov dword [ebp - 0xc], 0
add edx, 0x819c33ae
mov dword [ebp - 8], edx
cmp word [ebx + 0x25c], si
je 0x401a0a
lea edi, [ebx + 0x25c]
lea ecx, [ecx]
mov eax, esi
and eax, 0xf
lea edx, [ebp - 0x18]
add edx, eax
mov al, byte [edi]
mov ecx, esi
and ecx, 3
inc esi
not al
xor al, byte [ebp + ecx - 8]
lea edi, [ebx + 0x25c]
xor byte [edx], al
cmp word [edi + esi*2], 0
lea edi, [edi + esi*2]
jne 0x4019e0
push ecx
push str.Local_
lea eax, [ebp - 8]
push eax
mov edx, 0x32
lea ecx, [ebp - 0x80]
call fcn.0040c370
push 0x2b
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x80]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebx + 0x24c], eax
test eax, eax
je 0x401d4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne al
xor al, byte [ebx + 0x250]
and al, 1
xor byte [ebx + 0x250], al
test byte [ebx + 0x250], 1
jne 0x401aa8
cmp byte [ebx + 0x254], 0
je 0x401a9c
cmp byte [ebp - 1], 0
jne 0x401a9c
lea ecx, [ebx + 0x24c]
call fcn.00410260
test al, al
jne 0x401ad1
mov eax, 0x202
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x20a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 1], 0
je 0x401ad1
mov cl, byte [ebx + 0x484]
and cl, 1
call fcn.0040e990
xor edx, edx
test al, al
mov ecx, 0x217
cmovne ecx, edx
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea ecx, [ebx + 0x488]
call fcn.0040b5a0
test al, al
jne 0x401afb
mov eax, 0x222
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test byte [0x41622c], 1
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jne 0x401b41
push 0x416f0c
call edi
test byte [0x41622c], 1
jne 0x401b36
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
or byte [0x41622c], 1
mov dword [0x41623c], eax
mov dword [0x416230], 0x40c790
push 0x416f0c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x78
push 0
push dword [0x41623c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x401d42
mov ecx, eax
call fcn.0040fc80
mov esi, eax
test esi, esi
je 0x401d42
push ecx
push esi
sub esp, 8
lea ecx, [ebx + 0x10]
call fcn.00409540
test eax, eax
je 0x401d3a
mov dword [ebx + 0x3c], esi
test byte [0x41622c], 1
jne 0x401bc2
push 0x416f0c
call edi
test byte [0x41622c], 1
jne 0x401bb7
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
or byte [0x41622c], 1
mov dword [0x41623c], eax
mov dword [0x416230], 0x40c790
push 0x416f0c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 4
push 0
push dword [0x41623c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x401bfd
push ecx
push esi
sub esp, 8
lea ecx, [ebx + 0x10]
mov dword [esi], 0x411558
call fcn.00409540
test eax, eax
jne 0x401bfd
push esi
push eax
push dword [0x41623c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test byte [0x41622c], 1
jne 0x401c3d
push 0x416f0c
call edi
test byte [0x41622c], 1
jne 0x401c32
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
or byte [0x41622c], 1
mov dword [0x41623c], eax
mov dword [0x416230], 0x40c790
push 0x416f0c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0xd8
push 0
push dword [0x41623c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x401d2e
mov ecx, eax
call fcn.00403a70
mov esi, eax
test esi, esi
je 0x401d2e
lea eax, [ebx + 0x10]
push eax
mov ecx, esi
call fcn.00403b60
test al, al
je 0x401d26
mov dword [ebx + 0x40], esi
test byte [0x41622c], 1
jne 0x401cbf
push 0x416f0c
call edi
test byte [0x41622c], 1
jne 0x401cb4
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
or byte [0x41622c], 1
mov dword [0x41623c], eax
mov dword [0x416230], 0x40c790
push 0x416f0c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 4
push 0
push dword [0x41623c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x401d1a
push ecx
push esi
sub esp, 8
lea ecx, [ebx + 0x10]
mov dword [esi], 0x411570
call fcn.00409540
test eax, eax
je 0x401d0b
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, ebx
call fcn.00401200
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0
push dword [0x41623c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0x250
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
mov ecx, esi
call fcn.004017e0
mov eax, 0x245
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
mov ecx, esi
call fcn.00401850
mov eax, 0x22e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x1f6
pop ebx
mov esp, ebp
pop ebp
ret