Function at 0x403000
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Hide graphical window
Terminate process

Disassembly:
cld
call fcn.0040774c
mov byte [0x41d911], 0
mov byte [0x41d910], 0xff
push 0x16
call fcn.00408c5c
js 0x40304b
mov dl, 2
test al, al
jne 0x403043
push 0xa
call fcn.00408c5c
js 0x40304b
mov dl, 1
test al, al
jne 0x403043
push 0xb
call fcn.00408c5c
js 0x40304b
xor dl, dl
test al, al
jne 0x403043
jmp 0x40304b
mov byte [0x41d910], dl
jmp 0x403052
mov byte [0x41d911], 1
mov esi, 0x41f068
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov dword [0x41f060], eax
mov edi, esi
inc eax
mov ecx, eax
shl eax, 1
add edi, eax
mov ax, 0x5c
std
repne scasw ax, word es:[edi]
cld
mov ecx, edi
sub ecx, esi
shr ecx, 1
add ecx, 2
mov edx, ecx
mov ebp, esi
mov dword [0x41f064], ecx
mov esi, ebp
mov ecx, edx
mov edi, 0x42556c
rep movsw word es:[edi], word [esi]
mov esi, str.UPS_LM.ini
mov ecx, 0xb
rep movsw word es:[edi], word [esi]
mov esi, ebp
mov ecx, edx
mov edi, 0x429654
rep movsw word es:[edi], word [esi]
mov esi, str.UPS_LM.db
mov ecx, 0xa
rep movsw word es:[edi], word [esi]
mov esi, ebp
mov ecx, edx
mov edi, 0x41fb54
lodsw ax, word [esi]
cmp ax, 0x3a
je 0x4030d8
cmp ax, 0x5c
jne 0x4030da
mov al, 0x5f
stosw word es:[edi], ax
dec ecx
jne 0x4030ca
xor ax, ax
stosw word es:[edi], ax
call fcn.0041a61b
cld
mov esi, 0x41fb54
mov edi, 0x41f92c
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
push str.GlobalUPS_LM_
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov dword [0x41fb34], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
je 0x403121
cmp eax, 5
jne 0x403182
mov al, byte [0x4203e3]
or al, byte [0x4203e4]
or al, byte [0x4203e5]
or al, byte [0x4203e6]
or al, byte [0x4203e7]
or al, byte [0x4203e8]
or al, byte [0x4203e9]
or al, byte [0x4203ea]
or al, byte [0x4203eb]
or al, byte [0x4203ec]
je 0x403168
call fcn.0041a9a7
jmp 0x416773
push 0
push str.UPS_Lite_Manager
push dword [0x4313b8]
push 0
call dword [sym.imp.USER32.DLL_MessageBoxW]
jmp 0x416773
cmp byte [0x4203e3], 0
jne 0x416773
cmp byte [0x4203e4], 0
jne 0x416773
push 0x42088c
call dword [sym.imp.HID.DLL_HidD_GetHidGuid]
push str.user32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test eax, eax
je 0x4031ff
mov esi, eax
push str.ChangeWindowMessageFilter
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x41f904], eax
push str.ChangeWindowMessageFilterEx
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x41f908], eax
test eax, eax
je 0x4031ff
push 1
push 0x233
call dword [0x41f904]
push 1
push 0x4a
call dword [0x41f904]
push 1
push 0x49
call dword [0x41f904]
call fcn.0040b15f
call fcn.004153d3
call fcn.004149f4
mov al, byte [0x4262c7]
test al, al
je 0x403224
push 0x100
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_SetPriorityClass]
cmp byte [0x4262c8], 0
je 0x403232
call fcn.004167d3
call fcn.0041ab4c
push 0
push 0
push 0
push 0x41ac2e
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor ebx, ebx
push str.TaskbarCreated
call dword [sym.imp.USER32.DLL_RegisterWindowMessageA]
mov dword [0x41f4ec], eax
mov edx, dword [0x41f904]
test edx, edx
je 0x403274
push 1
push eax
call edx
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x420af4], eax
push 0x4212b4
push str.32770
push ebx
call dword [sym.imp.USER32.DLL_GetClassInfoExW]
mov dword [0x4212b4], 0x30
mov dword [0x4212b8], 3
mov dword [0x4212c4], 0x1e
mov dword [0x4212d4], 0x10
mov dword [0x4212dc], 0x4201a8
mov dword [0x4212c0], ebx
mov dword [0x4212d8], ebx
mov eax, dword [0x420af4]
mov dword [0x4212c8], eax
push 0x4212b4
call dword [sym.imp.USER32.DLL_RegisterClassExW]
push 0x421284
push str.32770
push ebx
call dword [sym.imp.USER32.DLL_GetClassInfoExW]
mov dword [0x421284], 0x30
mov dword [0x421288], 3
mov dword [0x421294], 0x1e
mov dword [0x4212a4], 0x10
mov dword [0x4212ac], 0x420186
mov dword [0x421290], ebx
mov dword [0x4212a8], ebx
mov eax, dword [0x420af4]
mov dword [0x421298], eax
push 0x64
push eax
call dword [sym.imp.USER32.DLL_LoadIconA]
mov dword [0x42129c], eax
push 0x7f00
push ebx
call dword [sym.imp.USER32.DLL_LoadCursorA]
mov dword [0x4212a0], eax
push 0x421284
call dword [sym.imp.USER32.DLL_RegisterClassExW]
push 0x65
push dword [0x420af4]
call dword [sym.imp.USER32.DLL_LoadIconA]
mov dword [0x420ad8], eax
push 0x69
push dword [0x420af4]
call dword [sym.imp.USER32.DLL_LoadIconA]
mov dword [0x420adc], eax
push 0x67
push dword [0x420af4]
call dword [sym.imp.USER32.DLL_LoadIconA]
mov dword [0x420ae0], eax
push 0x66
push dword [0x420af4]
call dword [sym.imp.USER32.DLL_LoadIconA]
mov dword [0x420ae4], eax
mov dword [0x41f518], eax
push 0x68
push dword [0x420af4]
call dword [sym.imp.USER32.DLL_LoadIconA]
mov dword [0x420ae8], eax
push 0
push 0
push 0
push 1
push 0x64
push dword [0x420af4]
call dword [sym.imp.USER32.DLL_LoadImageA]
mov dword [0x420aec], eax
push 0x7f06
push 0
call dword [sym.imp.USER32.DLL_LoadIconA]
mov dword [0x420af0], eax
mov dword [0x41f504], 0x3b8
mov dword [0x41f50c], 5
mov dword [0x41f510], 7
mov dword [0x41f514], 0x405
mov dword [0x41f824], 3
call dword [sym.imp.USER32.DLL_CreatePopupMenu]
mov dword [0x41f500], eax
push dword [0x4313d8]
push 0xc8
push 0
push eax
call dword [sym.imp.USER32.DLL_AppendMenuW]
push 0x1f4
push 0x4034b2
push ebx
push 0x1f4
push dword [0x421298]
call dword [sym.imp.USER32.DLL_CreateDialogParamW]
test eax, eax
je 0x41674b
mov edi, eax
mov dword [0x420af8], eax
mov cl, byte [0x4262c6]
test cl, cl
je 0x403487
push 0
push edi
call dword [sym.imp.USER32.DLL_ShowWindow]
mov esi, 0x421268
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.USER32.DLL_GetMessageW]
push esi
push edi
call dword [sym.imp.USER32.DLL_IsDialogMessageW]
test eax, eax
jne 0x40348c
push esi
call dword [sym.imp.USER32.DLL_TranslateMessage]
push esi
call dword [sym.imp.USER32.DLL_DispatchMessageW]
jmp 0x40348c
mov esi, str._Exit__Error___
jmp 0x41675e
push 0x41f504
push 2
call dword [sym.imp.SHELL32.DLL_Shell_NotifyIconW]
push 0
push esi
call fcn.00414acf
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]