Function at 0x870390
Capabilities:
Check mutex on windows
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
push ebx
push edi
xor ebx, ebx
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x193]
mov byte [ebp - 0x194], bl
mov byte [ebp - 0x294], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x293]
mov byte [ebp - 0x50], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xd
xor eax, eax
lea edi, [ebp - 0x4f]
mov dword [ebp - 0x94], ebx
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x90]
mov dword [ebp - 0x18], ebx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov eax, dword [0x879a2c]
cmp eax, ebx
jne 0x870699
mov ecx, dword [0x7fa262]
mov edx, dword [0x7fa25e]
push esi
push ecx
push 0x879a2c
push 0x7fa306
push ebx
push edx
push 0x7fa266
push 0x7fa286
call fcn.008784b0
cmp eax, ebx
mov dword [ebp - 4], eax
mov esi, eax
je 0x87062f
push 0x87992c
call fcn.0086e9d0
add esp, 4
test eax, eax
je 0x8704d8
push 0x7fae98
push 0x87992c
mov dword [ebp - 0x94], 0x44
call fcn.0086ea00
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x194]
push eax
push ecx
call fcn.0086ea40
lea edx, [ebp - 0x194]
push edx
push 0x87992c
call fcn.0086ea00
add esp, 0x18
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x94]
push eax
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x87992c
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 1
jne 0x8704cf
mov edx, dword [ebp - 0x18]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 4], 1
jmp 0x8704ee
mov edx, dword [ebp - 4]
push edx
push 0x879a38
call fcn.008786f0
cmp eax, 1
mov dword [ebp - 4], eax
jne 0x87053a
cmp esi, 0x123
je 0x8704fe
cmp esi, 0x701
jne 0x87050e
push 0x7fa306
push 0x879a38
push ebx
call fcn.00878710
mov eax, dword [0x7fa262]
mov ecx, dword [0x7fa25e]
push eax
push 0x879a2c
push 0x7fa306
push ebx
push ecx
push 0x879a38
push 0x7fa286
call fcn.008784b0
mov dword [ebp - 4], eax
jmp 0x870545
push ebx
call dword [0x8797f8]
ret
cmp eax, ebx
je 0x87062f
test byte [0x7fa245], 8
jne 0x870617
lea edx, [ebp - 0x294]
lea ecx, [ebp - 0x194]
push edx
push ecx
push eax
call fcn.008701e0
add esp, 0xc
dec eax
je 0x8705c5
dec eax
je 0x8706b0
dec eax
je 0x87069f
mov edi, 0x7fae84
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x194]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x194]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x394]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 4]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x294]
mov edi, 0x7fae7c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x214
xor eax, eax
mov edi, 0x7fa120
push 0x200000
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x294]
lea edx, [ebp - 0x394]
push ecx
push edx
push ebx
stosw word es:[edi], ax
call dword [0x879800]
mov ecx, 0x214
xor eax, eax
mov edi, 0x7fa120
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [0x8797f8]
ret
push 0x87991c
call fcn.0086e9d0
add esp, 4
test eax, eax
pop esi
je 0x870671
cmp dword [0x879a34], ebx
je 0x870671
push 0x87991c
lea eax, [ebp - 0x50]
push 0x7fae78
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x50]
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x879a34], eax
cmp dword [0x7fa246], ebx
je 0x870699
cmp dword [0x879a30], ebx
jne 0x870699
lea edx, [ebp - 8]
push edx
push ebx
push ebx
push 0x8702a0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x879a30], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x194]
lea edx, [ebp - 0x394]
jmp 0x8705d0
mov edi, 0x7fae84
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x194]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x194]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x394]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 4]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x8705ed