Function at 0x401100
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Create thread
Print debug messages
Read file via mapping

Disassembly:
sub esp, 0x4ec
mov al, 0x6c
mov cl, 0x40
mov byte [esp + 1], al
mov byte [esp + 5], al
mov al, 0x49
push ebx
mov byte [esp + 0xb], al
mov byte [esp + 0xe], al
mov al, 0x5f
push ebp
mov byte [esp + 0x13], al
mov byte [esp + 0x17], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x1f], al
mov al, 0x4f
mov byte [esp + 0x14], cl
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], cl
mov byte [esp + 0x22], al
mov byte [esp + 0x23], al
push esi
mov cl, 0x30
lea eax, [esp + 0xc]
push edi
mov byte [esp + 0x21], cl
mov byte [esp + 0x22], cl
push eax
mov cl, 0x4e
push 1
push 0
mov byte [esp + 0x1c], 0x47
mov byte [esp + 0x1e], 0x6f
mov byte [esp + 0x1f], 0x62
mov byte [esp + 0x20], 0x61
mov byte [esp + 0x22], 0x5c
mov byte [esp + 0x24], 0x43
mov byte [esp + 0x25], 0x44
mov byte [esp + 0x2c], 0x32
mov byte [esp + 0x2f], 0x38
mov byte [esp + 0x31], 0x42
mov byte [esp + 0x32], 0x59
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], 0x4a
mov byte [esp + 0x38], cl
mov byte [esp + 0x39], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x401408
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401408
mov ecx, dword [esp + 0x500]
mov dword [0x40a9e0], ecx
call fcn.00401ec0
mov eax, dword [esp + 0x508]
xor edx, edx
lea ecx, [esp + 0x50]
mov bl, byte [eax]
push ecx
cmp bl, 0x45
push 0
setne dl
dec edx
push 0
push 0x401530
and edx, 0x4000
push 0
push 0
mov dword [0x434980], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x68]
lea edx, [esp + 0x68]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x6c], 0x94
mov dword [esp + 0x50], 1
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], 0xc
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x78], 2
jne 0x401276
lea eax, [esp + 0x54]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x401276
push 0
push 0
lea ecx, [esp + 0x5c]
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x401276
lea edx, [esp + 0x54]
mov dword [esp + 0x48], edx
push str.GlobalEVT_ICDEVICEINFOSET
push 1
lea eax, [esp + 0x4c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push str.GlobalICDINFO
push 0
push 6
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ebx, eax
test ebx, ebx
je 0x401408
push 0x29f8c
push 0
push 0
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov ecx, 0xa7e3
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
push eax
mov ecx, 0x40a9e8
call fcn.00401680
push 0x29f88
push esi
mov ecx, 0x40a9e8
call fcn.00401bd0
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._____GetPolicy_Roof
call edi
push 0xffffffffffffffff
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
test esi, esi
jne 0x4013a1
test ebx, ebx
jne 0x40132a
push str.GlobalICDINFO
push ebx
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ebx, eax
test ebx, ebx
je 0x401408
push 0x29f8c
push 0
push 0
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov ax, word [esi + 0x29f88]
cmp ax, 1
je 0x4013fc
cmp ax, 2
jne 0x401359
push 1
jmp 0x40135b
push 0
mov ecx, 0x40a9e8
call fcn.00401680
push 0x29f88
push esi
mov ecx, 0x40a9e8
call fcn.00401bd0
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push str.GlobalEVT_ICDEVICEINFOGET
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov esi, eax
test esi, esi
je 0x4013e6
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4013e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea ecx, [esp + 0x104]
push str.WaitResult_is__d__GetLastError_is__d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 0xfc]
push edx
call edi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.GlobalEVT_ICDEVICEINFOSET
push 1
lea eax, [esp + 0x4c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebp, eax
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
jmp 0x4012ec
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4ec
ret 0x10