Function at 0x409acc
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Create process suspended
Terminate process

Disassembly:
sub esp, 0x5c
mov eax, dword [0x417c2c]
xor eax, esp
mov dword [esp + 0x58], eax
push esi
xor esi, esi
push edi
xor edi, edi
inc esi
cmp dword [0x41a27c], edi
mov dword [esp + 8], edi
mov dword [esp + 0x14], esi
je 0x409af8
mov eax, esi
jmp 0x409e9c
call fcn.00409aa8
test al, al
jne 0x409af1
cmp dword [0x41a010], edi
mov dword [0x419ffc], 0xc
mov dword [0x41a000], edi
mov dword [0x41a004], esi
jne 0x409b28
call fcn.00409a35
test al, al
je 0x409af1
push ebx
push ebp
mov ebp, 0x104
mov esi, ebp
mov ebx, 0x41a178
call fcn.004099a9
test al, al
jne 0x409b47
xor eax, eax
inc eax
jmp 0x409e9a
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
xor edi, edi
push edi
push edi
push edi
mov esi, 0x419ffc
push esi
call ebx
push edi
push edi
push edi
push esi
mov dword [0x41a27c], eax
call ebx
push edi
push edi
mov ebx, eax
push esi
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push 1
push 0x1f0fff
lea ecx, [esp + 0x1c]
push ecx
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x409e00
cmp dword [0x41a27c], edi
je 0x409e00
cmp ebx, edi
je 0x409e1a
cmp dword [esp + 0x18], edi
je 0x409e00
cmp dword [esp + 0x10], edi
je 0x409e00
mov esi, 0x9c9c
push esi
push edi
push dword [0x41a010]
call sub.MSVCR80.dll_memset
mov eax, dword [0x41a010]
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov dword [eax + 0x28], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x41a010]
mov dword [ecx + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x41a010]
mov dword [ecx + 0xc], eax
mov eax, dword [0x41a27c]
mov dword [ecx + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 0x24], eax
mov eax, dword [esp + 0x70]
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], ebx
mov dword [ecx], esi
mov dword [ecx + 4], 0x20000
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ecx + 0x10], eax
mov eax, dword [0x41a008]
dec eax
je 0x409c58
dec eax
je 0x409c48
dec eax
jne 0x409e06
mov dword [ecx + 0x30], 1
jmp 0x409c5b
mov dword [ecx + 0x2c], 8
mov dword [ecx + 0x30], 1
jmp 0x409c5e
mov dword [ecx + 0x30], edi
mov dword [ecx + 0x2c], edi
mov al, byte [0x41a00c]
mov dl, al
neg dl
mov ebx, dword [sym.imp.MSVCR80.dll_wcsncpy_s]
push 0xffffffffffffffff
push dword [0x417bd4]
mov dword [ecx + 0x34], edi
mov dword [ecx + 0x3c], edi
push 0x38
sbb edx, edx
and edx, 0xfffffff0
add edx, 0x10
or edx, 4
mov dword [ecx + 0x38], edx
xor edx, edx
inc edx
neg al
mov dword [ecx + 0x44], edx
sbb eax, eax
and eax, 0x10
or eax, edx
mov dword [ecx + 0x4c], eax
add ecx, 0x21ac
push ecx
call ebx
mov eax, dword [sym.imp.MSVCR80.dll__wpgmptr]
push 0xffffffffffffffff
push dword [eax]
mov eax, dword [0x41a010]
add eax, 0x258
push ebp
push eax
call ebx
push 0x12
pop ecx
push 0x48
lea eax, [esp + 0x44]
push eax
mov eax, dword [0x41a010]
add eax, 0x460
push ebp
mov esi, str.HKLMSoftwareMicrosoftInternet_ExplorerRegistrationDigitalProductID
lea edi, [esp + 0x4c]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.MSVCR80.dll_memcpy_s]
mov eax, dword [0x41a010]
push 0xffffffffffffffff
push dword [0x417bd0]
add eax, 0x7a4
push ebp
push eax
call ebx
add esp, 0x40
push dword [0x41a014]
mov edi, 0x41a070
push str.dw20.exe__x__s__u
push ebp
push edi
call dword [sym.imp.MSVCR80.dll_sprintf_s]
push 0x44
pop ebx
push ebx
xor ebp, ebp
push ebp
mov esi, 0x41a028
push esi
call sub.MSVCR80.dll_memset
add esp, 0x1c
push 0x41a018
push esi
push ebp
push ebp
push 0x4000020
push 1
push ebp
push ebp
push edi
push 0x41a178
mov dword [0x41a028], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x409dfe
push dword [0x41a018]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x41a01c]
call esi
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov bl, 1
mov edi, 0x4e20
push edi
push dword [0x41a27c]
call esi
test eax, eax
jne 0x409d95
push 1
push dword [esp + 0x18]
call esi
test eax, eax
jne 0x409dda
xor bl, bl
jmp 0x409dda
push edi
mov edi, dword [esp + 0x1c]
push edi
call esi
cmp eax, 0x102
je 0x409de7
cmp eax, 0x80
je 0x409de0
push 1
push dword [0x41a27c]
call esi
test eax, eax
je 0x409dc5
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x409dd1
push 1
push dword [esp + 0x18]
call esi
test eax, eax
jne 0x409dd3
xor bl, bl
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test bl, bl
jne 0x409d73
jmp 0x409de7
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [0x41a010]
xor edi, edi
test byte [ecx + 0x9a84], 0x10
je 0x409e06
mov dword [esp + 0x1c], ebp
jmp 0x409e06
xor edi, edi
mov ecx, dword [0x41a010]
cmp dword [esp + 0x14], edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x409e26
push dword [esp + 0x14]
call esi
jmp 0x409e20
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x41a010]
cmp dword [esp + 0x18], edi
je 0x409e38
push dword [esp + 0x18]
call esi
mov ecx, dword [0x41a010]
cmp dword [esp + 0x10], edi
je 0x409e4a
push dword [esp + 0x10]
call esi
mov ecx, dword [0x41a010]
mov eax, dword [0x41a27c]
cmp eax, edi
je 0x409e62
push eax
call esi
mov ecx, dword [0x41a010]
mov dword [0x41a27c], edi
cmp ecx, edi
je 0x409e73
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [0x41a010], edi
mov eax, dword [0x41a014]
cmp eax, edi
je 0x409e85
push eax
call esi
mov dword [0x41a014], edi
cmp byte [0x417bd8], 0
je 0x409e96
push 1
call dword [sym.imp.MSVCR80.dll_exit]
mov eax, dword [esp + 0x1c]
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
pop edi
pop esi
xor ecx, esp
call fcn.0040bb82
add esp, 0x5c
ret