Function at 0x414f90
Capabilities:
Accept command line arguments
Check if file exists
Check mutex on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6c4d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x70
mov eax, dword [0x4cd00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.RECSR202210121837mutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x68], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x415003
test esi, esi
je 0x4155e7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4155e7
lea ecx, [ebp - 0x2c]
call fcn.00413a40
cmp dword [ebp - 0x18], 8
lea esi, [ebp - 0x2c]
cmovae esi, dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x415033
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x415033
mov esi, 1
jmp 0x415035
xor esi, esi
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x41506f
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415065
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415607
push edx
push ecx
call fcn.0044434d
add esp, 8
xor edi, edi
test esi, esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x4151e2
mov ecx, str.CSCallUpgradeTime
call fcn.00413880
test eax, eax
je 0x4151e2
xor edi, edi
mov dword [ebp - 0x18], 7
push 3
xor eax, eax
mov dword [ebp - 0x2c], edi
push 0x4bea48
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], ax
call fcn.0040afa0
push 5
push str.lorer
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.0040b370
push 4
push str..exe
lea ecx, [ebp - 0x2c]
call fcn.0040b370
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0x64]
mov dword [ebp - 0x64], edi
cmovae ecx, dword [ebp - 0x2c]
call fcn.00428cc0
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x415164
push eax
call esi
mov ecx, str.win7
call fcn.00413210
test eax, eax
jne 0x415125
mov ecx, str.win8
call fcn.00413210
test eax, eax
jne 0x415125
call fcn.00413c00
cmp eax, 1
je 0x415164
test eax, eax
jne 0x415164
lea edi, [eax + 1]
jmp 0x415164
push 0x100
push 0
push 0
push str.Default
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov esi, eax
test esi, esi
je 0x41515e
push esi
call dword [sym.imp.USER32.dll_SwitchDesktop]
push esi
test eax, eax
jne 0x415153
call dword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x41515e
call dword [sym.imp.USER32.dll_CloseDesktop]
mov edi, 1
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x4151a5
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41519b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415607
push edx
push ecx
call fcn.0044434d
add esp, 8
test edi, edi
jne 0x4151b9
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x415091
mov ecx, str.CSCallUpgradeTime
call fcn.00413880
test eax, eax
je 0x4151cf
mov eax, dword [ebp - 0x68]
jmp 0x4155e0
mov edi, 1
call fcn.00413ae0
test eax, eax
je 0x4151e2
call fcn.00410460
push str.RECSR202210121837Event
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x64], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x50]
movlpd qword [ebp - 0x50], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor eax, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 1
call fcn.00401ad0
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x2c]
push eax
call esi
test eax, eax
je 0x41525e
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x2c]
push ecx
call fcn.00415ff0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x41529f
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415295
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41560c
push edx
push ecx
call fcn.0044434d
add esp, 8
xor eax, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 2
call fcn.00401cd0
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call esi
test eax, eax
je 0x4152ef
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x2c]
push ecx
call fcn.00415ff0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x415330
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415326
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415611
push edx
push ecx
call fcn.0044434d
add esp, 8
push ecx
call fcn.0040e310
xorps xmm0, xmm0
movups xmmword [ebp - 0x60], xmm0
call fcn.00413ae0
test eax, eax
je 0x415354
call fcn.0040f360
test eax, eax
je 0x415354
call fcn.00410460
push 1
push 0
xor edx, edx
push 1
push 0
lea ecx, [edx + 1]
call fcn.0040f470
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call fcn.00413b70
test eax, eax
je 0x41538a
mov ecx, str.CSSvcFirstStartTime
call fcn.00413510
mov eax, 0x2c1
jmp 0x415396
xor eax, eax
test edi, edi
setne al
add eax, 0x2bc
push 0
push 0
push 0
push 0
push 0
push eax
push 0
push 0
xor edx, edx
xor ecx, ecx
call fcn.00411430
xor eax, eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
mov dword [ebp - 4], 3
call fcn.00409930
call fcn.00409b00
call fcn.00409cd0
lea ecx, [ebp - 0x44]
call fcn.00409f50
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x44]
cmp edx, 8
jb 0x4153fa
test ecx, ecx
je 0x415568
cmp edx, 8
lea eax, [ebp - 0x44]
cmovae eax, ecx
cmp word [eax], 0
je 0x415568
cmp edx, 8
lea eax, [ebp - 0x44]
cmovae eax, ecx
push eax
call esi
test eax, eax
je 0x415568
xor eax, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 4
call fcn.00413ae0
test eax, eax
je 0x415494
lea ecx, [ebp - 0x80]
call fcn.004139b0
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040a760
mov edx, dword [ebp - 0x6c]
cmp edx, 8
jb 0x415494
mov ecx, dword [ebp - 0x80]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41548a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415616
push edx
push ecx
call fcn.0044434d
add esp, 8
cmp dword [ebp - 0x18], 8
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x44]
cmovae edx, dword [ebp - 0x2c]
cmp dword [ebp - 0x30], 8
cmovae ecx, dword [ebp - 0x44]
sub esp, 0x1c
call fcn.00412bb0
test eax, eax
je 0x41555c
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x415501
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4154f7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41561b
push edx
push ecx
call fcn.0044434d
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
cmp edx, 8
jb 0x4155b5
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415550
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41561b
push edx
push ecx
call fcn.0044434d
add esp, 8
jmp 0x4155b5
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.0040a700
call fcn.00408d40
call fcn.00408bb0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x4155af
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4155a5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415620
push edx
push ecx
call fcn.0044434d
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [ebp - 0x34], 0
mov ecx, str.CSCallUpgradeTime
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
call fcn.00413510
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x4155dd
push eax
call esi
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x4155e7
push eax
call esi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00443db6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00447297
call fcn.00447297
call fcn.00447297
call fcn.00447297
call fcn.00447297
call fcn.00447297
int3