Function at 0x410350
Capabilities:
Check mutex on windows
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c8
mov eax, dword [0x43ce30]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 0x404
call fcn.00410920
add esp, 4
push 0
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, 0x43e214
call fcn.00410950
mov dword [ebp - 8], eax
call fcn.00410010
xor ecx, ecx
je 0x410434
mov edx, dword [ebp + 8]
push edx
call fcn.00410240
add esp, 4
mov byte [ebp - 0x12d], al
movzx eax, byte [ebp - 0x12d]
test eax, eax
jne 0x410434
lea ecx, [ebp - 0x180]
call fcn.00403800
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x180]
call fcn.00410f80
cmp eax, 1
jne 0x410404
push 1
push 0
push 0
push str.http:__yydl.duowan.com_4_setup_YYSetup.exe
push 0x43571c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x43e214
call fcn.00410aa0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0x3bc], 0
lea ecx, [ebp - 0x180]
call fcn.00403840
mov eax, dword [ebp - 0x3bc]
jmp 0x4105f0
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x12c]
call fcn.00402fc0
push 0x4357d0
lea ecx, [ebp - 0x12c]
call fcn.00401d00
cmp eax, 0xffffffff
jne 0x4104c4
lea ecx, [ebp - 0x1ac]
call fcn.00402510
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x1ac]
call fcn.00410f00
cmp eax, 1
je 0x4104b7
mov ecx, 0x43e214
call fcn.00410aa0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0x3c0], 0
lea ecx, [ebp - 0x1ac]
call fcn.00402540
lea ecx, [ebp - 0x12c]
call fcn.00401860
mov eax, dword [ebp - 0x3c0]
jmp 0x4105f0
lea ecx, [ebp - 0x1ac]
call fcn.00402540
jmp 0x4104d8
push str.0980E678_72D2_484b_B983_D4E17598D5B7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x43e200], eax
push 0x114
push 0
lea edx, [ebp - 0x128]
push edx
call fcn.004227a0
add esp, 0xc
mov dword [ebp - 0x128], 0x114
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
jb 0x4105b3
call fcn.004100f0
movzx ecx, al
test ecx, ecx
je 0x410592
push 0x104
lea edx, [ebp - 0x3b8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 1
push 0
push str._admin
lea ecx, [ebp - 0x3b8]
push ecx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x4e20
mov edx, dword [0x43e20c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x43e214
call fcn.00410aa0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0x3c4], 0
lea ecx, [ebp - 0x12c]
call fcn.00401860
mov eax, dword [ebp - 0x3c4]
jmp 0x4105f0
push str.admin
lea ecx, [ebp - 0x12c]
call fcn.00401d00
cmp eax, 0xffffffff
je 0x4105b3
mov eax, dword [0x43e20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.004102f0
add esp, 8
mov dword [ebp - 4], eax
mov ecx, 0x43e214
call fcn.00410aa0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c8], eax
lea ecx, [ebp - 0x12c]
call fcn.00401860
mov eax, dword [ebp - 0x3c8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00422550
mov esp, ebp
pop ebp
ret 0x10