Function at 0x4010ef
Capabilities:
Check mutex on windows
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x524
push ebx
push esi
xor ebx, ebx
push edi
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x7c
xor eax, eax
pop ecx
lea edi, [ebp - 0x523]
mov byte [ebp - 0x524], bl
push 0x30
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x401138
push ebx
mov ecx, eax
push dword [ebp + 8]
call fcn.004074e1
mov dword [0x413664], eax
jmp 0x40113e
mov dword [0x413664], ebx
mov esi, 0x104
lea eax, [ebp - 0x22c]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x4135bc]
cmp eax, ebx
je 0x40161f
mov ecx, dword [0x4135c0]
mov edx, ecx
sub edx, eax
and edx, 0xfffffffc
cmp edx, 4
jne 0x401183
lea eax, [ebp - 0x22c]
push eax
call fcn.0040585e
pop ecx
jmp 0x40161f
mov edx, ecx
mov edi, 0x414024
sub edx, eax
and edx, 0xfffffffc
cmp edx, 8
jne 0x401392
push edi
call sub.MSVCRT.dll_strlen
cmp eax, 0x26
pop ecx
jne 0x401387
push 1
mov ecx, 0x4135b8
call fcn.00401878
push dword [eax]
call dword [sym.imp.MSVCRT.dll_atol]
pop ecx
mov dword [ebp - 0x14], eax
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40161f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40161f
cmp dword [ebp - 0x14], ebx
je 0x40161f
push dword [ebp - 0x14]
call fcn.00405a34
test al, al
pop ecx
je 0x40161f
lea eax, [ebp - 0x22c]
lea ecx, [ebp + 8]
push eax
call fcn.0040487d
push 0x5c
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__mbsrchr]
pop ecx
cmp eax, ebx
pop ecx
jne 0x401221
or eax, 0xffffffff
jmp 0x401224
sub eax, dword [ebp + 8]
inc eax
lea ecx, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00404b55
push eax
lea ecx, [ebp + 8]
call fcn.00404912
lea ecx, [ebp - 0x10]
call fcn.00404851
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x32f]
mov byte [ebp - 0x330], bl
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x330]
lea ecx, [ebp - 4]
push eax
call fcn.0040487d
lea eax, [ebp - 0x524]
push eax
push 0xe
push 0x40f3e8
call fcn.0040582c
mov edi, eax
add esp, 0xc
cmp edi, ebx
jne 0x401296
xor eax, eax
jmp 0x40129d
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push eax
lea ecx, [ebp - 4]
call fcn.00404aae
lea eax, [ebp + 8]
push eax
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
call fcn.0040481e
lea eax, [ebp - 8]
push eax
call fcn.0040e28a
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00404a22
push ecx
lea eax, [ebp - 0xc]
mov ecx, esp
push eax
call fcn.0040481e
call fcn.0040d476
test al, al
pop ecx
je 0x401367
lea ecx, [ebp - 0x24]
call fcn.0040d74e
lea ecx, [ebp - 0x24]
call fcn.0040d782
push ebx
push ebx
push 0x12
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x414024
push dword [ebp - 0xc]
lea eax, [ebp - 0x524]
push eax
push 0x20
push 0x40f3a0
call fcn.0040582c
add esp, 0xc
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.00405b2a
add esp, 0x10
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x401344
lea ecx, [ebp - 0xc]
call fcn.00404851
lea ecx, [ebp - 8]
call fcn.00404851
lea ecx, [ebp - 4]
call fcn.00404851
lea ecx, [ebp + 8]
jmp 0x40161a
mov ecx, dword [0x4135c0]
mov eax, dword [0x4135bc]
cmp eax, ebx
je 0x40161f
mov edx, ecx
mov esi, 0x4135b8
sub edx, eax
and edx, 0xfffffffc
cmp edx, 0x10
jne 0x40149e
push 1
mov ecx, esi
call fcn.00401878
push dword [eax]
call sub.MSVCRT.dll_strlen
cmp eax, 0x26
pop ecx
jne 0x401493
push 1
mov ecx, esi
call fcn.00401878
push dword [eax]
push edi
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 2
mov ecx, esi
call fcn.00401878
push dword [eax]
call dword [sym.imp.MSVCRT.dll_atol]
pop ecx
mov edi, eax
push 1
mov ecx, esi
call fcn.00401878
push dword [eax]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40161f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40161f
cmp edi, ebx
je 0x40161f
push 3
mov ecx, esi
call fcn.00401878
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 2
mov ecx, esi
call fcn.00401878
push dword [eax]
mov ecx, esi
push 1
call fcn.00401878
push dword [eax]
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x524]
push eax
push 0x26
push 0x40f3c0
call fcn.0040582c
add esp, 0xc
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.004059d6
add esp, 0x28
jmp 0x40161f
mov ecx, dword [0x4135c0]
mov eax, dword [0x4135bc]
cmp eax, ebx
je 0x40161f
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x14
jne 0x40161f
push edi
push 1
mov ecx, esi
call fcn.00401878
push dword [eax]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x40161f
push edi
call sub.MSVCRT.dll_strlen
cmp eax, 0x26
pop ecx
jne 0x40161f
push 2
mov ecx, esi
call fcn.00401878
push dword [eax]
mov edi, dword [sym.imp.MSVCRT.dll_atol]
call edi
pop ecx
mov dword [ebp - 8], eax
push 3
mov ecx, esi
call fcn.00401878
push dword [eax]
call edi
pop ecx
mov dword [ebp - 0x10], eax
push 1
mov ecx, esi
call fcn.00401878
push dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push ebx
push ebx
call edi
test eax, eax
je 0x40161f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40161f
cmp dword [ebp - 8], ebx
je 0x40161f
cmp dword [ebp - 0x10], ebx
je 0x40161f
push 4
mov ecx, esi
call fcn.00401878
push dword [eax]
lea ecx, [ebp - 0xc]
call fcn.0040487d
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call fcn.00405bd8
pop ecx
mov dword [ebp - 4], eax
pop ecx
push dword [ebp - 0x10]
mov ecx, dword [0x413664]
call fcn.004075c1
mov ecx, dword [0x413664]
call fcn.004075a0
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], eax
push 0x40102a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 1
mov ecx, esi
call fcn.00401878
push dword [eax]
lea eax, [ebp - 0x524]
push dword [ebp - 0xc]
push eax
push 0x20
push 0x40f3a0
call fcn.0040582c
add esp, 0xc
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
cmp dword [ebp - 4], ebx
je 0x401617
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x414024
push ebx
push ebx
call edi
push dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.00405b2a
add esp, 0x10
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x4015e2
lea ecx, [ebp - 0xc]
call fcn.00404851
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10