Function at 0x10417a9b
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push 0x398
mov eax, 0x1044c98e
call fcn.1041e43a
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov dword [ebp - 4], 1
push eax
call fcn.104120bd
pop ecx
xor ebx, ebx
lea esi, [eax + 0x10]
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10c27940], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x10417af3
push esi
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x10c27940], eax
jmp 0x10417b08
cmp eax, 0xb7
jne 0x10417b08
push 0xffffffffffffffff
push dword [0x10c27940]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x10c27940], ebx
lea ecx, [esi - 0x10]
sete bl
call fcn.10416360
mov byte [edi + 0x2c], bl
test bl, bl
jne 0x1041825a
xor ebx, ebx
mov dword [ebp - 0x38c], 0x784d7942
push ebx
sub esp, 0xc
mov byte [ebp - 0x21c], bl
mov ecx, esp
mov dword [ebp - 0x388], 0x414d434a
lea eax, [ebp - 0x34a]
mov dword [ebp - 0x384], 0x6e34444b
mov dword [ebp - 0x380], 0x65307942
push dword [ebp - 0x21c]
mov dword [ebp - 0x37c], 0x6f34484d
push eax
mov dword [ebp - 0x378], 0x494d6a4a
lea eax, [ebp - 0x38c]
mov dword [ebp - 0x374], 0x5259774b
mov dword [ebp - 0x370], 0x4e385242
mov dword [ebp - 0x36c], 0x396b5347
mov dword [ebp - 0x368], 0x6251584f
mov dword [ebp - 0x364], 0x78594743
mov dword [ebp - 0x360], 0x4a6f674f
mov dword [ebp - 0x35c], 0x7867444c
mov dword [ebp - 0x358], 0x6955484f
mov dword [ebp - 0x354], 0x67555349
mov dword [ebp - 0x350], 0x41414141
mov word [ebp - 0x34c], 0x414a
mov dword [ebp - 0x2d0], 0x71517a47
mov dword [ebp - 0x2cc], 0x714d6950
mov dword [ebp - 0x2c8], 0x73426d63
mov dword [ebp - 0x2c4], 0x696f434b
mov dword [ebp - 0x2c0], 0x4434794a
mov dword [ebp - 0x2bc], 0x79343347
mov dword [ebp - 0x2b8], 0x4d556d44
mov dword [ebp - 0x2b4], 0x4f455148
mov dword [ebp - 0x2b0], 0x71306748
mov dword [ebp - 0x2ac], 0x70737950
mov dword [ebp - 0x2a8], 0x76644447
mov dword [ebp - 0x2a4], 0x4338484e
mov dword [ebp - 0x2a0], 0x72556949
mov dword [ebp - 0x29c], 0x5a63684f
mov dword [ebp - 0x298], 0x534d7963
mov dword [ebp - 0x294], 0x6735424e
mov dword [ebp - 0x290], 0x34397848
mov dword [ebp - 0x28c], 0x37495843
mov dword [ebp - 0x288], 0x5477334e
mov dword [ebp - 0x284], 0x6e454866
mov dword [ebp - 0x280], 0x76526a47
mov dword [ebp - 0x27c], 0x2f51444e
mov dword [ebp - 0x278], 0x346f414f
mov dword [ebp - 0x274], 0x4c513349
mov dword [ebp - 0x270], 0x2f596745
mov dword [ebp - 0x26c], 0x4938424a
mov dword [ebp - 0x268], 0x544d6745
mov dword [ebp - 0x264], 0x6455484f
mov dword [ebp - 0x260], 0x75636848
mov dword [ebp - 0x25c], 0x494d6e66
mov dword [ebp - 0x258], 0x71566859
mov dword [ebp - 0x254], 0x78427849
mov dword [ebp - 0x250], 0x626b6842
mov dword [ebp - 0x24c], 0x6b346e43
mov dword [ebp - 0x248], 0x554d5144
mov dword [ebp - 0x244], 0x6e64434e
mov dword [ebp - 0x240], 0x634d7849
mov dword [ebp - 0x23c], 0x6c424147
mov dword [ebp - 0x238], 0x794d3342
mov dword [ebp - 0x234], 0x31524448
mov dword [ebp - 0x230], 0x72464141
mov dword [ebp - 0x22c], 0x7778684b
mov dword [ebp - 0x228], 0x41416746
mov word [ebp - 0x224], 0x4841
mov byte [ebp - 0x222], 0x4d
push eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.1040f456
lea eax, [ebp - 0x398]
push eax
call fcn.104122f6
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1041baac
push eax
push ebx
sub esp, 0xc
mov byte [ebp - 0x21c], bl
mov ecx, esp
lea eax, [ebp - 0x221]
push dword [ebp - 0x21c]
mov dword [ecx], ebx
push eax
lea eax, [ebp - 0x2d0]
mov dword [ecx + 4], ebx
push eax
mov dword [ecx + 8], ebx
call fcn.1040f456
lea eax, [ebp - 0x3a4]
push eax
call fcn.1041242f
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.1041baf5
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x3a4]
mov dword [0x10c276dc], eax
call fcn.1041b975
lea ecx, [ebp - 0x398]
mov byte [ebp - 4], 1
call fcn.1041b8f2
cmp dword [0x10c276dc], ebx
je 0x1041825a
push 0x10413afe
push 0x10c276dc
call fcn.1041d62a
pop ecx
pop ecx
test eax, eax
je 0x1041825a
push dword [ebp + 8]
mov byte [edi + 0x2d], 1
mov dword [0x10c27938], 1
call fcn.104183f0
pop ecx
push eax
push dword [ebp + 8]
mov ecx, 0x10c27700
call fcn.104182ca
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [0x10c2793c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x10c27948], eax
test eax, eax
je 0x10417ec5
mov byte [edi + 0x2e], 1
push dword [ebp + 0xc]
mov dword [ebp - 0x348], 0x33307a46
push ebx
sub esp, 0xc
mov dword [ebp - 0x344], 0x7163694d
mov ecx, esp
mov dword [ebp - 0x340], 0x78635848
mov dword [ebp - 0x33c], 0x6e4d7945
mov dword [ebp - 0x338], 0x4f67514b
mov dword [ebp - 0x334], 0x42634343
mov dword [ebp - 0x330], 0x57305449
mov dword [ebp - 0x32c], 0x75597741
mov dword [ebp - 0x328], 0x3035434c
mov dword [ebp - 0x324], 0x42305349
mov dword [ebp - 0x320], 0x4f516a46
mov dword [ebp - 0x31c], 0x32775446
mov dword [ebp - 0x318], 0x324a7949
mov dword [ebp - 0x314], 0x52774165
mov dword [ebp - 0x310], 0x794e6947
mov dword [ebp - 0x30c], 0x4f594843
mov dword [ebp - 0x308], 0x65735245
mov dword [ebp - 0x304], 0x4330524e
mov dword [ebp - 0x300], 0x4b4d544f
mov dword [ebp - 0x2fc], 0x57557742
mov dword [ebp - 0x2f8], 0x3249534f
mov dword [ebp - 0x2f4], 0x31385442
mov dword [ebp - 0x2f0], 0x6849324f
mov dword [ebp - 0x2ec], 0x67517766
mov dword [ebp - 0x2e8], 0x32345844
mov dword [ebp - 0x2e4], 0x44455250
mov dword [ebp - 0x2e0], 0x4163774e
mov dword [ebp - 0x2dc], 0x6b4d5245
mov dword [ebp - 0x2d8], 0x7559434c
mov dword [ebp - 0x2d4], 0x79414841
mov dword [ebp - 0x2d0], 0x734e7744
mov dword [ebp - 0x2cc], 0x6a415142
mov dword [ebp - 0x2c8], 0x56556a48
mov dword [ebp - 0x2c4], 0x35745759
mov dword [ebp - 0x2c0], 0x44555446
mov dword [ebp - 0x2bc], 0x61516e59
mov dword [ebp - 0x2b8], 0x65595463
mov dword [ebp - 0x2b4], 0x36316850
mov dword [ebp - 0x2b0], 0x714d7862
mov dword [ebp - 0x2ac], 0x4a55534f
mov dword [ebp - 0x2a8], 0x3573794e
mov dword [ebp - 0x2a4], 0x45514347
mov dword [ebp - 0x2a0], 0x7868774d
mov dword [ebp - 0x29c], 0x65676966
mov dword [ebp - 0x298], 0x61733345
mov dword [ebp - 0x294], 0x794d514a
mov dword [ebp - 0x290], 0x38595163
mov dword [ebp - 0x28c], 0x79456950
mov dword [ebp - 0x288], 0x3264424c
mov dword [ebp - 0x284], 0x49513341
mov dword [ebp - 0x280], 0x5863534f
mov dword [ebp - 0x27c], 0x2b63794e
mov dword [ebp - 0x278], 0x4a73774c
mov dword [ebp - 0x274], 0x3978514b
mov dword [ebp - 0x270], 0x69497945
mov dword [ebp - 0x26c], 0x704e6a47
mov dword [ebp - 0x268], 0x6e4d524e
mov dword [ebp - 0x264], 0x39565850
mov dword [ebp - 0x260], 0x4d77514b
mov dword [ebp - 0x25c], 0x31514364
mov dword [ebp - 0x258], 0x4a515242
mov dword [ebp - 0x254], 0x58596847
mov dword [ebp - 0x250], 0x77526a63
mov dword [ebp - 0x24c], 0x43497747
mov dword [ebp - 0x248], 0x53345244
mov dword [ebp - 0x244], 0x6b455246
mov dword [ebp - 0x240], 0x4d34544c
mov dword [ebp - 0x23c], 0x384e4250
mov dword [ebp - 0x238], 0x4d345449
mov dword [ebp - 0x234], 0x42456866
mov dword [ebp - 0x230], 0x78496943
mov dword [ebp - 0x22c], 0x2f6f4359
mov dword [ebp - 0x228], 0x4141514c
mov word [ebp - 0x224], 0x4d41
mov byte [ebp - 0x222], 0x34
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov byte [ebp - 0x21c], bl
lea eax, [ebp - 0x221]
push dword [ebp - 0x21c]
mov dword [ecx + 8], ebx
push eax
lea eax, [ebp - 0x348]
push eax
call fcn.1040f456
lea eax, [ebp - 0x398]
push eax
call fcn.1041242f
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.1041baf5
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.104127b3
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x398]
call fcn.1041b975
push dword [ebp + 0xc]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x10c27944], eax
test eax, eax
je 0x10418231
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x1041ab7b
lea ecx, [ebp - 0x220]
call fcn.1040f101
push eax
mov ecx, 0x10c276f0
call fcn.1041b453
cmp dword [ebp - 0x21c], 0
je 0x1041825a
call fcn.10428f5a
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.10416360
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.10416360
call fcn.1041e3e4
ret