Function at 0x5d2730
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d47dd
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x5e12a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], 1
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
mov dword [ebp - 0x58], 4
jmp 0x5d277a
mov ecx, dword [ebp - 0x58]
add ecx, 1
mov dword [ebp - 0x58], ecx
cmp dword [ebp - 0x58], 0x3a98
jae 0x5d27ad
mov eax, dword [ebp - 0x58]
xor edx, edx
mov ecx, 4
div ecx
movzx edx, byte [edx + 0x5e3230]
mov eax, dword [ebp - 0x58]
movzx ecx, byte [eax + 0x5e3230]
xor ecx, edx
mov edx, dword [ebp - 0x58]
mov byte [edx + 0x5e3230], cl
jmp 0x5d2771
mov byte [ebp - 0x54], 0x75
mov byte [ebp - 0x53], 0x1c
mov byte [ebp - 0x52], 0x6e
mov byte [ebp - 0x51], 0x1a
mov byte [ebp - 0x50], 0x6f
mov byte [ebp - 0x4f], 0xe
mov byte [ebp - 0x4e], 0x62
mov byte [ebp - 0x4d], 0x32
mov byte [ebp - 0x4c], 0x40
mov byte [ebp - 0x4b], 0x2f
mov byte [ebp - 0x4a], 0x5b
mov byte [ebp - 0x49], 0x3e
mov byte [ebp - 0x48], 0x5d
mov byte [ebp - 0x47], 0x29
mov byte [ebp - 0x46], 0x29
mov dword [ebp - 0x5c], 0xe
jmp 0x5d27fb
mov eax, dword [ebp - 0x5c]
sub eax, 1
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jle 0x5d281c
mov ecx, dword [ebp - 0x5c]
movsx edx, byte [ebp + ecx - 0x54]
mov eax, dword [ebp - 0x5c]
movsx ecx, byte [ebp + eax - 0x55]
xor edx, ecx
mov eax, dword [ebp - 0x5c]
mov byte [ebp + eax - 0x54], dl
jmp 0x5d27f2
movsx ecx, byte [ebp - 0x54]
xor ecx, 0x23
mov byte [ebp - 0x54], cl
mov edx, 0x62
mov word [ebp - 0x2c], dx
mov eax, 7
mov word [ebp - 0x2a], ax
mov ecx, 0x75
mov word [ebp - 0x28], cx
mov edx, 0x1b
mov word [ebp - 0x26], dx
mov eax, 0x7e
mov word [ebp - 0x24], ax
mov ecx, 0x12
mov word [ebp - 0x22], cx
mov edx, 0x21
mov word [ebp - 0x20], dx
mov eax, 0x13
mov word [ebp - 0x1e], ax
mov ecx, 0x3d
mov word [ebp - 0x1c], cx
mov edx, 0x59
mov word [ebp - 0x1a], dx
mov eax, 0x35
mov word [ebp - 0x18], ax
mov ecx, 0x59
mov word [ebp - 0x16], cx
mov edx, 0x59
mov word [ebp - 0x14], dx
mov dword [ebp - 0x60], 0xc
jmp 0x5d28ad
mov eax, dword [ebp - 0x60]
sub eax, 1
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jle 0x5d28cf
mov ecx, dword [ebp - 0x60]
movzx edx, word [ebp + ecx*2 - 0x2c]
mov eax, dword [ebp - 0x60]
movzx ecx, word [ebp + eax*2 - 0x2e]
xor edx, ecx
mov eax, dword [ebp - 0x60]
mov word [ebp + eax*2 - 0x2c], dx
jmp 0x5d28a4
movzx ecx, word [ebp - 0x2c]
xor ecx, 0x29
mov word [ebp - 0x2c], cx
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x30]
push ecx
push 0x40
push 0x3a98
push 0x5e3234
call dword [ebp - 0x34]
mov dword [ebp - 0x64], 4
jmp 0x5d291e
mov edx, dword [ebp - 0x64]
add edx, 1
mov dword [ebp - 0x64], edx
cmp dword [ebp - 0x64], 0x800
jae 0x5d2951
mov eax, dword [ebp - 0x64]
xor edx, edx
mov ecx, 4
div ecx
movzx edx, byte [edx + str.IC_]
mov eax, dword [ebp - 0x64]
movzx ecx, byte [eax + str.IC_]
xor ecx, edx
mov edx, dword [ebp - 0x64]
mov byte [edx + str.IC_], cl
jmp 0x5d2915
mov dword [ebp - 0x44], 0x5e6ccc
push 0x2f1e8
call fcn.0041000e
add esp, 4
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x40], eax
push 0x2f1e8
push 0x59bf40
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.0040f940
add esp, 0xc
mov dword [ebp - 0x68], 4
jmp 0x5d299c
mov edx, dword [ebp - 0x68]
add edx, 1
mov dword [ebp - 0x68], edx
cmp dword [ebp - 0x68], 0x2f1e8
jge 0x5d29cd
mov eax, dword [ebp - 0x68]
xor edx, edx
mov ecx, 4
div ecx
mov eax, dword [ebp - 0x40]
movzx ecx, byte [eax + edx]
mov edx, dword [ebp - 0x40]
add edx, dword [ebp - 0x68]
movzx eax, byte [edx]
xor eax, ecx
mov ecx, dword [ebp - 0x40]
add ecx, dword [ebp - 0x68]
mov byte [ecx], al
jmp 0x5d2993
mov edx, dword [ebp - 0x40]
add edx, 4
mov dword [ebp - 0x40], edx
push 0x155cc0
call fcn.0041000e
add esp, 4
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x3c], eax
push 0x155cc0
push 0x446270
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.0040f940
add esp, 0xc
mov dword [ebp - 0x6c], 4
jmp 0x5d2a1a
mov edx, dword [ebp - 0x6c]
add edx, 1
mov dword [ebp - 0x6c], edx
cmp dword [ebp - 0x6c], 0x155cc0
jge 0x5d2a4b
mov eax, dword [ebp - 0x6c]
xor edx, edx
mov ecx, 4
div ecx
mov eax, dword [ebp - 0x3c]
movzx ecx, byte [eax + edx]
mov edx, dword [ebp - 0x3c]
add edx, dword [ebp - 0x6c]
movzx eax, byte [edx]
xor eax, ecx
mov ecx, dword [ebp - 0x3c]
add ecx, dword [ebp - 0x6c]
mov byte [ecx], al
jmp 0x5d2a11
mov edx, dword [ebp - 0x3c]
add edx, 4
mov dword [ebp - 0x3c], edx
lea eax, [ebp - 0x44]
push eax
mov ecx, 0x5e3234
call ecx
test eax, eax
jne 0x5d2a6b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.CalcHash_Singun_201211101447
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edx, dword [ebp + 8]
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x5d2b7f
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
cmp dword [ebp + 0x10], 0
je 0x5d2b7f
push str._switch
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040feb6
add esp, 8
test eax, eax
jne 0x5d2b7f
lea ecx, [ebp - 0x80]
call fcn.00406ca0
mov dword [ebp - 4], 0
push 0xc9
lea ecx, [ebp - 0x80]
call fcn.00406ce0
lea ecx, [ebp - 0x80]
call fcn.00406bd0
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
je 0x5d2b25
mov edx, dword [ebp - 0x70]
push edx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x5d2b0c
push 9
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0x70]
push ecx
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov dword [ebp - 0x70], eax
push 1
mov edx, dword [ebp - 0x70]
push edx
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
mov dword [ebp - 0x7c], 0
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x7c], 1
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x74], ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.0041018b
add esp, 4
lea eax, [eax + eax + 2]
mov dword [ebp - 0x78], eax
lea ecx, [ebp - 0x7c]
push ecx
push 0x100
push 0x4a
mov edx, dword [ebp - 0x70]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.00406cc0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f6b8
mov esp, ebp
pop ebp
ret