Function at 0x1000e546
Capabilities:
Check mutex on windows
Create thread
Get session user name

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor esi, esi
push 0x1003e4a8
or ebx, 0xffffffff
mov dword [esp + 0x14], esi
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x3c
mov eax, 0x1003e4a0
push esi
push dword [0x1003e140]
mov dword [0x1003e4a4], eax
mov dword [0x1003e4a0], eax
mov dword [0x1003e4c4], esi
mov dword [0x1003e4c0], esi
call ebp
cmp eax, esi
mov dword [0x1003e49c], eax
je 0x1000e7e5
push 0x3c
push esi
push eax
call sub.ntdll.dll_memset
mov eax, dword [0x1003e49c]
add esp, 0xc
add eax, 0x20
push eax
call edi
push dword [0x1003e238]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, esi
mov dword [0x1003e23c], eax
je 0x1000e7e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000e7e3
call fcn.10011d76
mov ebx, eax
cmp ebx, esi
jne 0x1000e7e5
call fcn.1000c9a9
mov ebx, eax
cmp ebx, esi
jne 0x1000e7e5
mov edi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [esp + 0x10]
push eax
push esi
call edi
cmp dword [esp + 0x10], esi
je 0x1000e62f
push dword [esp + 0x10]
push esi
push dword [0x1003e140]
call ebp
cmp eax, esi
mov dword [0x1003e174], eax
je 0x1000e62f
lea ecx, [esp + 0x10]
push ecx
push eax
call edi
mov eax, dword [0x1003e208]
cmp eax, 0x8bdbae2c
je 0x1000e65c
cmp eax, 0x7ee14d23
je 0x1000e65c
cmp eax, 0x25b973e5
je 0x1000e65c
push dword [esp + 0x1c]
call fcn.1001abe4
mov ebx, eax
cmp ebx, esi
jne 0x1000e7e5
call fcn.1000e4b1
call fcn.1000c623
mov ebx, eax
cmp ebx, esi
jne 0x1000e7e5
call fcn.10003f36
push 0x18
push esi
push dword [0x1003e140]
call ebp
cmp eax, esi
mov dword [0x1003e1c0], eax
je 0x1000e7e5
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [eax + 4], esi
mov dword [eax], esi
lea edi, [eax + 4]
lea eax, [esp + 0x14]
push eax
push esi
push esi
push 0x1000e1b3
push esi
push esi
call ebp
mov ecx, dword [0x1003e1c0]
mov edx, dword [edi]
mov dword [ecx + edx*4 + 8], eax
mov eax, dword [edi]
cmp dword [ecx + eax*4 + 8], esi
je 0x1000e7e5
inc eax
cmp dword [0x1003e208], 0x37688758
mov dword [edi], eax
jne 0x1000e760
push 0x1003e214
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
call fcn.1001b84f
mov ebx, eax
cmp ebx, esi
jne 0x1000e7e5
test byte [0x1003dc24], 4
je 0x1000e70a
mov dword [0x1003e34c], edi
mov dword [0x1003e3d8], edi
push section..bss
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000e72a
push edi
push 0x1003dca4
push edi
push 0x1003dc98
call fcn.1000c4ee
mov eax, dword [0x1003e1c0]
mov ecx, dword [eax + 4]
lea eax, [eax + ecx*4 + 8]
push eax
call fcn.1000d099
mov ebx, eax
cmp ebx, esi
jne 0x1000e7e5
mov eax, dword [0x1003e1c0]
inc dword [eax + 4]
cmp dword [0x1003e164], esi
je 0x1000e760
push 0x1003e160
call fcn.10001efa
mov eax, dword [0x1003e208]
cmp eax, esi
je 0x1000e7e3
cmp eax, 0x37688758
jne 0x1000e7b3
push 0x43
push esi
push dword [0x1003e140]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x1003e20c], eax
mov eax, dword [0x1003e20c]
test eax, eax
je 0x1000e7b3
mov eax, dword [0x1003e260]
movzx ecx, ah
push 0x100384d7
push ecx
movzx eax, al
push eax
push 0x1003f0fe
push dword [0x1003e20c]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov edi, dword [0x1003e1c0]
lea eax, [esp + 0x14]
push eax
push esi
push esi
push 0x100055f3
push esi
push esi
add edi, 4
call ebp
mov ecx, dword [0x1003e1c0]
mov edx, dword [edi]
mov dword [ecx + edx*4 + 8], eax
mov eax, dword [edi]
cmp dword [ecx + eax*4 + 8], esi
je 0x1000e7e5
inc eax
mov dword [edi], eax
xor ebx, ebx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
pop ecx
ret 4