Function at 0x411e60
Capabilities:
Check mutex on windows
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c8
mov eax, dword [0x43fdf0]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 0x404
call fcn.00412450
add esp, 4
push 0
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, 0x441214
call fcn.00412480
mov dword [ebp - 8], eax
call fcn.00411af0
xor ecx, ecx
je 0x411f51
mov edx, dword [ebp + 8]
push edx
call fcn.00411d50
add esp, 4
mov byte [ebp - 0x12d], al
movzx eax, byte [ebp - 0x12d]
test eax, eax
jne 0x411f51
push str.Check_integrality_fail__please_download_from_official_website.
call fcn.004010c0
add esp, 4
lea ecx, [ebp - 0x180]
call fcn.00405050
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x180]
call fcn.00412a90
cmp eax, 1
jne 0x411f21
push 1
push 0
push 0
push str.http:__yydl.duowan.com_4_setup_YYSetup.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x441214
call fcn.004125d0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0x3bc], 0
lea ecx, [ebp - 0x180]
call fcn.00405090
mov eax, dword [ebp - 0x3bc]
jmp 0x41211a
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x12c]
call fcn.00404880
push 0x437c6c
lea ecx, [ebp - 0x12c]
call fcn.00403600
cmp eax, 0xffffffff
jne 0x411fe1
lea ecx, [ebp - 0x1ac]
call fcn.00403d90
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x1ac]
call fcn.00412a10
cmp eax, 1
je 0x411fd4
mov ecx, 0x441214
call fcn.004125d0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0x3c0], 0
lea ecx, [ebp - 0x1ac]
call fcn.00403dc0
lea ecx, [ebp - 0x12c]
call fcn.00403160
mov eax, dword [ebp - 0x3c0]
jmp 0x41211a
lea ecx, [ebp - 0x1ac]
call fcn.00403dc0
jmp 0x411ff5
push str.0980E678_72D2_484b_B983_D4E17598D5B7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x441200], eax
push 0x114
push 0
lea edx, [ebp - 0x128]
push edx
call fcn.00422d40
add esp, 0xc
mov dword [ebp - 0x128], 0x114
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
jb 0x4120dd
call fcn.00411be0
movzx ecx, al
test ecx, ecx
je 0x4120af
push 0x104
lea edx, [ebp - 0x3b8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 1
push 0
push str._admin
lea ecx, [ebp - 0x3b8]
push ecx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x4e20
mov edx, dword [0x44120c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x441214
call fcn.004125d0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0x3c4], 0
lea ecx, [ebp - 0x12c]
call fcn.00403160
mov eax, dword [ebp - 0x3c4]
jmp 0x41211a
push str.admin
lea ecx, [ebp - 0x12c]
call fcn.00403600
cmp eax, 0xffffffff
je 0x4120dd
mov eax, dword [0x44120c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str.SetEvent__let_the_first_setup.exe_quit_in_win7_or_vista.
call fcn.004010c0
add esp, 4
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00411e00
add esp, 8
mov dword [ebp - 4], eax
mov ecx, 0x441214
call fcn.004125d0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c8], eax
lea ecx, [ebp - 0x12c]
call fcn.00403160
mov eax, dword [ebp - 0x3c8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00422af0
mov esp, ebp
pop ebp
ret 0x10