Function at 0x4109b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0x61c]
sub esp, 0x61c
push 0xffffffffffffffff
push 0x433a08
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x44dd94]
xor eax, ebp
mov dword [ebp + 0x618], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0
push 0
push 3
push 0
push 3
push 0
push str..SageDisks
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x44bf9c], eax
cmp eax, 0xffffffff
jne 0x410b0a
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [ebx]
push 0
call fcn.00410810
mov eax, dword [0x476780]
add esp, 4
test eax, eax
jne 0x410c52
push str.GlobalTrueCrypt_Driver_Setup
push 1
push eax
call esi
mov dword [0x476780], eax
mov ecx, dword [0x476780]
test ecx, ecx
je 0x410a90
call edi
cmp eax, 0xb7
jne 0x410c52
mov edx, dword [0x476780]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x476780]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x476780], 0
mov ecx, dword [0x476780]
test ecx, ecx
jne 0x410ae5
push str.GlobalTrueCrypt_Driver_Setup
push 1
push ecx
call esi
mov dword [0x476780], eax
mov edx, dword [0x476780]
test edx, edx
je 0x410adf
call edi
cmp eax, 0xb7
jne 0x410ae5
mov eax, dword [0x476780]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [0x476780]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x476780], 0
push 0x64
call ebx
jmp 0x410a90
push 0
push 0
push 3
push 0
push 3
push 0
push str..SageDisks
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x44bf9c], eax
cmp eax, 0xffffffff
je 0x410a30
mov ecx, dword [0x476780]
test ecx, ecx
je 0x410b3f
mov edx, dword [0x476780]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
je 0x410b3f
mov eax, dword [0x476780]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x410b3f
mov dword [0x476780], 0
mov eax, dword [0x44bf9c]
cmp eax, 0xffffffff
je 0x410d0c
mov esi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
lea ecx, [ebp - 0x18]
push ecx
push 4
push 0x4531bc
push 0
push 0
push 0x222004
push eax
call esi
test eax, eax
jne 0x410b93
push eax
lea edx, [ebp - 0x18]
push edx
push 4
push 0x4531bc
push eax
push eax
mov eax, dword [0x44bf9c]
push 0x72018
push eax
call esi
test eax, eax
je 0x410c48
cmp dword [0x4531bc], 0x71a
je 0x410d0c
call fcn.00410230
test eax, eax
je 0x410cea
call fcn.0040f910
test eax, eax
je 0x410cea
call fcn.0040fcd0
test eax, eax
je 0x410cea
mov eax, dword [ebp - 0x14]
mov ecx, eax
inc eax
cmp ecx, 3
mov dword [ebp - 0x14], eax
jge 0x410cea
call fcn.0040fa90
mov esi, eax
call fcn.0040f970
test esi, esi
jne 0x410ce6
push esi
push esi
push 3
push esi
push 3
push esi
push str..SageDisks
mov dword [0x476754], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x44bf9c], eax
cmp dword [0x476754], 0
je 0x410c3f
cmp eax, 0xffffffff
je 0x410c48
push 0
lea edx, [ebp - 0x20]
push edx
push 0
push 0
push 0
push 0
push 0x222068
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [0x44bf9c]
cmp eax, 0xffffffff
jne 0x410b0a
mov eax, 1
jmp 0x410d0e
cmp dword [0x476790], 0
je 0x410bdc
push 0
call fcn.0040f9b0
add esp, 4
test eax, eax
je 0x410cc6
push 0x3e8
call ebx
push 0
push 0
push 3
push 0
push 3
push 0
push str..SageDisks
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea ecx, [ebp]
mov dword [0x44bf9c], eax
mov dword [ebp - 4], 0
call fcn.0040b540
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.0040db60
test eax, eax
setne dl
movzx eax, dl
push eax
lea ecx, [ebp]
call fcn.0040c890
lea ecx, [ebp]
mov byte [ebp - 4], 0
call fcn.0040b1b0
call fcn.0040f970
mov eax, dword [0x44bf9c]
jmp 0x410c12
mov eax, esi
jmp 0x410d0e
call fcn.0040f970
mov eax, dword [0x44bf9c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x44bf9c], 0xffffffff
mov eax, 0xf
jmp 0x410d0e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x618]
xor ecx, ebp
call fcn.0041851b
add ebp, 0x61c
mov esp, ebp
pop ebp
ret