Function at 0x401eb3
Capabilities:
Acquire debug privileges
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Enumerate processes
Print debug messages
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x34], 0
mov dword [esp + 8], 0x40b01c
mov dword [esp + 4], 0
mov dword [esp], 0x100000
mov eax, dword [sym.imp.KERNEL32.dll_OpenMutexW]
call eax
sub esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x402536
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 2
jne 0x402539
call fcn.00404878
test eax, eax
je 0x401f7a
mov dword [esp], str.WARNING___RUN_ON_VM_
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call eax
sub esp, 4
jmp 0x40253a
call fcn.00402c56
mov dword [section..bss], eax
mov eax, dword [section..bss]
test eax, eax
jne 0x401fcc
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov eax, dword [section..bss]
mov dword [esp + 0x14], str.launcher.c
mov dword [esp + 0x10], 0x40b013
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x190
mov dword [esp + 4], 0xbb9
mov dword [esp], eax
call fcn.00405dca
jmp 0x40253a
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov edx, eax
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.KERNEL32.dll_IsWow64Process]
call eax
sub esp, 8
test eax, eax
jne 0x40202f
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov eax, dword [section..bss]
mov dword [esp + 0x14], str.launcher.c
mov dword [esp + 0x10], 0x40b013
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x196
mov dword [esp + 4], 0xbb9
mov dword [esp], eax
call fcn.00405dca
jmp 0x40253a
mov dword [esp], 0
call fcn.004032c1
mov dword [ebp - 0x34], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call eax
mov dword [ebp - 0x30], eax
mov dword [esp + 4], 0x208
mov dword [esp], 0
call fcn.00402588
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4020a4
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov eax, dword [section..bss]
mov dword [esp + 0x14], str.launcher.c
mov dword [esp + 0x10], 0x40b013
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x1a0
mov dword [esp + 4], 0xbb9
mov dword [esp], eax
call fcn.00405dca
jmp 0x40253a
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.004027b2
sub eax, 2
shr eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call eax
sub esp, 0xc
test eax, eax
jne 0x402113
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov eax, dword [section..bss]
mov dword [esp + 0x14], str.launcher.c
mov dword [esp + 0x10], 0x40b013
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x1a6
mov dword [esp + 4], 0xbb9
mov dword [esp], eax
call fcn.00405dca
jmp 0x40253a
lea eax, [ebp - 0x264]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00403727
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x402170
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov eax, dword [section..bss]
mov dword [esp + 0x14], str.launcher.c
mov dword [esp + 0x10], 0x40b013
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x1ad
mov dword [esp + 4], 0xbb9
mov dword [esp], eax
call fcn.00405dca
jmp 0x40253a
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 0x2c]
add eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
test eax, eax
jne 0x40219e
mov edx, dword [section..bss]
mov eax, dword [ebp - 0x24]
mov dword [eax + 8], edx
jmp 0x4021ec
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 8]
mov eax, dword [section..bss]
cmp edx, eax
je 0x4021ec
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov eax, dword [section..bss]
mov dword [esp + 0x14], str.launcher.c
mov dword [esp + 0x10], 0x40b013
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x1bc
mov dword [esp + 4], 0xbb9
mov dword [esp], eax
call fcn.00405dca
jmp 0x40253a
mov dword [esp + 4], str.SeDebugPrivilege
mov dword [esp], 0
call fcn.004030d3
test eax, eax
jne 0x402243
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov eax, dword [section..bss]
mov dword [esp + 0x14], str.launcher.c
mov dword [esp + 0x10], 0x40b013
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x1c3
mov dword [esp + 4], 0xbb9
mov dword [esp], eax
call fcn.00405dca
jmp 0x40253a
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4022a2
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov eax, dword [section..bss]
mov dword [esp + 0x14], str.launcher.c
mov dword [esp + 0x10], 0x40b013
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x1ca
mov dword [esp + 4], 0xbb9
mov dword [esp], eax
call fcn.00405dca
jmp 0x40253a
mov dword [esp + 4], 0x22c
lea eax, [ebp - 0x260]
mov dword [esp], eax
call fcn.004060d0
sub esp, 8
mov dword [ebp - 0x260], 0x22c
lea eax, [ebp - 0x260]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32FirstW
sub esp, 8
test eax, eax
jne 0x402320
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov eax, dword [section..bss]
mov dword [esp + 0x14], str.launcher.c
mov dword [esp + 0x10], 0x40b013
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x1d3
mov dword [esp + 4], 0xbb9
mov dword [esp], eax
call fcn.00405dca
jmp 0x40253a
cmp dword [ebp - 0x34], 0
je 0x402353
mov dword [esp + 4], str.services.exe
lea eax, [ebp - 0x260]
add eax, 0x24
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
call eax
sub esp, 8
test eax, eax
jne 0x40237e
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x18], eax
jmp 0x40237e
mov dword [esp + 4], str.explorer.exe
lea eax, [ebp - 0x260]
add eax, 0x24
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
call eax
sub esp, 8
test eax, eax
jne 0x40237e
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x260]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32NextW
sub esp, 8
test eax, eax
jne 0x402320
cmp dword [ebp - 0x18], 0
jne 0x4023df
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov eax, dword [section..bss]
mov dword [esp + 0x14], str.launcher.c
mov dword [esp + 0x10], 0x40b013
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x1ec
mov dword [esp + 4], 0xbb9
mov dword [esp], eax
call fcn.00405dca
jmp 0x40253a
mov eax, dword [ebp - 0x268]
test eax, eax
jne 0x4023f0
mov eax, 1
jmp 0x4023f5
mov eax, 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xa
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.004034da
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x40245d
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov eax, dword [section..bss]
mov dword [esp + 0x14], str.launcher.c
mov dword [esp + 0x10], 0x40b013
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x1f3
mov dword [esp + 4], 0xbb9
mov dword [esp], eax
call fcn.00405dca
jmp 0x40253a
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x43a
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4024c2
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edx, eax
mov eax, dword [section..bss]
mov dword [esp + 0x14], str.launcher.c
mov dword [esp + 0x10], 0x40b013
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x1fa
mov dword [esp + 4], 0xbb9
mov dword [esp], eax
call fcn.00405dca
jmp 0x40253a
mov eax, dword [ebp - 0x268]
test eax, eax
jne 0x402501
mov eax, dword [ebp - 0x264]
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call section..text
test eax, eax
jmp 0x40253a
mov eax, dword [ebp - 0x264]
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004016be
test eax, eax
jmp 0x40253a
nop
jmp 0x40253a
nop
cmp dword [ebp - 0x14], 0
je 0x40254b
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.004026f2
cmp dword [ebp - 0xc], 0xffffffff
je 0x402561
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
cmp dword [ebp - 0x10], 0xffffffff
je 0x402577
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
nop
nop
nop