Function at 0x403920
Capabilities:
Check mutex on windows
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 3
and esp, 0xfffffff8
add esp, 4
push esi
sub esp, 0x54
call fcn.0045d5f4
xor eax, eax
push 0x7e5b28
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x7dfa64], eax
test eax, eax
je 0x403dac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x403971
push dword [0x7dfa64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x403973
xor eax, eax
test eax, eax
je 0x403983
xor eax, eax
add esp, 0x54
pop esi
mov esp, ebp
pop ebp
ret 0x10
call fcn.00412c18
xor eax, eax
push 0x65e660
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x7dfa68], eax
test eax, eax
je 0x403d9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x403a82
push dword [0x7dfa68]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x65e660
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x4039fa
movsx edx, byte [0x7df38c]
test edx, edx
jne 0x403a24
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4039f3
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [0x7dfa64]
test edx, edx
je 0x403a1d
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [0x7dfa64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x7dfa64]
mov eax, 0xffffffff
jmp 0x403a8a
xor edx, edx
push edx
push edx
push 0x414
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push 0x65e660
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x7dfa68], eax
test eax, eax
je 0x403b9b
mov edx, dword [0x7dfa64]
test edx, edx
je 0x403a7e
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [0x7dfa64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x7dfa64]
xor eax, eax
jmp 0x403a8a
xor eax, eax
mov edx, dword [0x7dfa64]
test eax, eax
je 0x403ab1
test edx, edx
je 0x403aa5
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [0x7dfa64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x54
pop esi
mov esp, ebp
pop ebp
ret 0x10
test edx, edx
je 0x403ac8
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [0x7dfa64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov dword [0x7df4c8], eax
mov edx, dword [ebp + 0x14]
mov dword [0x7df4cc], edx
push 0x65e780
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor eax, eax
mov dword [0x7df524], eax
mov dword [0x7df528], eax
call fcn.00412da8
mov dword [0x7df528], eax
call fcn.00412e0c
mov dword [0x7df524], eax
mov edx, dword [0x7df528]
test edx, edx
jne 0x403b23
push 0x7e5b30
push 0
call fcn.0040ced4
add esp, 8
mov edx, dword [0x7df528]
cmp edx, 4
je 0x403b51
mov eax, dword [0x7df524]
test eax, eax
jbe 0x403b51
test edx, edx
jbe 0x403b51
cmp eax, edx
je 0x403b51
call fcn.00412eb0
test eax, eax
je 0x403b51
mov eax, 1
mov byte [0x7df4d8], al
mov byte [0x7df4e0], al
movsx eax, byte [0x7df498]
test eax, eax
je 0x403bab
call fcn.00412f10
movsx eax, al
test eax, eax
je 0x403bab
xor esi, esi
mov eax, dword [esi + 0x7dfa64]
add esi, 4
test eax, eax
je 0x403b8a
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 0x7dfa60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 4
jle 0x403b6a
xor eax, eax
add esp, 0x54
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0xffffffff
mov edx, dword [0x7dfa64]
jmp 0x403a8a
push 0x7df870
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.00458ba0
movsx eax, al
test eax, eax
jne 0x403cdc
xor eax, eax
push eax
push eax
push eax
push eax
push 0x7dfa48
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x403c26
xor eax, eax
push eax
push eax
push eax
push 0x7dfa48
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x403d8e
push 0x7dfa48
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0x7dfa48
call dword [sym.imp.USER32.dll_DispatchMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
push 0x7dfa48
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x403be3
movsx eax, byte [0x595744]
test eax, eax
je 0x403cdc
movsx eax, byte [0x7df788]
test eax, eax
je 0x403c4a
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403c75
call fcn.00403db8
movsx eax, byte [0x7df514]
test eax, eax
je 0x403c64
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403c75
call fcn.00403fd0
movsx eax, al
test eax, eax
je 0x403c75
call fcn.00412bf4
xor eax, eax
push eax
push eax
push eax
push eax
push 0x7dfa48
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x403ccd
xor eax, eax
push eax
push eax
push eax
push 0x7dfa48
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x403d80
push 0x7dfa48
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0x7dfa48
call dword [sym.imp.USER32.dll_DispatchMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
push 0x7dfa48
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x403c8a
movsx eax, byte [0x595744]
test eax, eax
jne 0x403c35
call fcn.004131e0
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x7df870
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor esi, esi
mov eax, dword [esi + 0x7dfa64]
add esi, 4
test eax, eax
je 0x403d14
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 0x7dfa60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 4
jle 0x403cf4
movsx eax, byte [0x7df424]
test eax, eax
je 0x403d71
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [esp], 0x44
mov eax, 5
mov word [esp + 0x30], ax
xor esi, esi
lea ecx, [esp]
lea edx, [esp + 0x44]
push edx
push ecx
push esi
push esi
push 0x20
push esi
push esi
push esi
push 0x65e540
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x7dfa50]
add esp, 0x54
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov byte [0x595744], 0
xor eax, eax
jmp 0x403cd4
mov byte [0x595744], 0
xor eax, eax
jmp 0x403c2d
mov eax, 0xffffffff
mov edx, dword [0x7dfa64]
jmp 0x403a8a
mov eax, 0xffffffff
jmp 0x403973