Function at 0x41b9e9
Capabilities:
Check for time delay via gettickcount
Check mutex on windows
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5dc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov dword [ebp - 0x5d0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp + 0x18]
cmp byte [ebx + 0x48], 0
mov dword [ebp - 0x5cc], eax
je 0x41ba3a
or eax, 0xffffffff
jmp 0x41bd7f
push esi
push edi
mov esi, 0x5242d0
lea edi, [ebp - 0x134]
push 0x32
lea eax, [ebp - 0x126]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
push esi
push eax
call fcn.004f5a90
xor eax, eax
mov dword [ebp - 0x634], 0x44
lea edi, [ebp - 0x5f0]
stosd dword es:[edi], eax
push 0x40
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x630]
push eax
call fcn.004f5a90
mov eax, dword [ebp - 0x5cc]
mov edi, dword [ebp - 0x5dc]
push edi
push str.ConEmuDefTermProc._u
mov dword [eax], esi
lea eax, [ebp - 0x1b4]
push 0x40
push eax
call fcn.004e1e5a
add esp, 0x28
lea eax, [ebp - 0x1b4]
push eax
push 1
call fcn.004e4204
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x5e0], eax
test eax, eax
je 0x41bad4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x5c8], eax
jmp 0x41bada
mov dword [ebp - 0x5c8], esi
mov esi, dword [ebp - 0x5d4]
mov eax, dword [esi]
test eax, eax
jne 0x41baf7
push edi
push eax
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esi], eax
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x41bb39
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x5cc]
push eax
push str.OpenProcess_fails__code_u
mov dword [ecx], eax
lea eax, [ebp - 0xf4]
push eax
call fcn.00403213
mov eax, dword [ebx]
lea ecx, [ebp - 0xf4]
add esp, 0xc
push ecx
push edi
mov ecx, ebx
call dword [eax + 0x28]
or esi, 0xffffffff
jmp 0x41bd6a
cmp dword [ebp - 0x5c8], 0xb7
jne 0x41bb7a
mov ecx, dword [ebp - 0x5d0]
lea eax, [ebp - 0xf4]
push str.Mutex_already_exists
push eax
xor esi, esi
mov dword [ecx], 0x90
call fcn.00403213
pop ecx
pop ecx
mov eax, dword [ebx]
lea ecx, [ebp - 0xf4]
push ecx
push edi
mov ecx, ebx
call dword [eax + 0x28]
jmp 0x41bd6a
push eax
push edi
call fcn.004e64d5
mov dword [ebp - 0x5c8], eax
pop ecx
pop ecx
cmp eax, 0x20
je 0x41bbc8
cmp eax, 0x40
jne 0x41bb9f
mov dword [ebp - 0x5c8], str.ConEmuC64.exe
jmp 0x41bbd2
mov eax, dword [ebp - 0x5d4]
push dword [eax]
call esi
push 0xfffffffffffffffe
pop esi
push dword [ebp - 0x5c8]
push str.Unsupported_process_bitness___i_
lea eax, [ebp - 0xf4]
push eax
call fcn.00403213
add esp, 0xc
jmp 0x41bb66
mov dword [ebp - 0x5c8], str.ConEmuC.exe
mov eax, dword [ebx]
mov ecx, ebx
push edi
call dword [eax + 0x2c]
test al, al
mov edx, 0x514870
mov ecx, str.__LOG
lea eax, [ebp - 0x5c4]
cmove ecx, edx
push ecx
push dword [ebp - 0x5c8]
push dword [ebp - 0x5d8]
push str.__s_s__s__DEFTRM_u
push 0x208
push eax
call fcn.004e1e5a
add esp, 0x1c
cmp byte [ebx + 0x48], 0
jne 0x41bb31
lea eax, [ebp - 0x134]
mov dword [ebp - 0x608], 1
mov dword [ebp - 0x628], eax
lea ecx, [ebp - 0x5c4]
mov eax, dword [ebx]
push ecx
push edi
mov ecx, ebx
call dword [eax + 0x28]
xor ecx, ecx
lea eax, [ebp - 0x5f0]
push eax
lea eax, [ebp - 0x634]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x5c4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x41bc93
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x5cc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x5d4]
push dword [eax]
call esi
mov eax, dword [ebp - 0x5cc]
push 0xfffffffffffffffd
pop esi
push dword [eax]
push str.Fails_to_start_service_process__code_u
jmp 0x41bbb7
push dword [ebp - 0x5ec]
call esi
push dword [ebp - 0x5e8]
lea eax, [ebp - 0xf4]
push str.Service_process_PID_u_started
push eax
call fcn.00403213
mov eax, dword [ebx]
lea ecx, [ebp - 0xf4]
add esp, 0xc
push ecx
push edi
mov ecx, ebx
call dword [eax + 0x28]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [ebx + 0x48], 0
mov dword [ebp - 0x5d8], eax
jne 0x41bd0b
mov edi, eax
push 0x64
push dword [ebp - 0x5f0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41bd05
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp byte [ebx + 4], 0
jne 0x41bcff
cmp eax, 0x7530
jae 0x41bd05
cmp byte [ebx + 0x48], 0
je 0x41bcd8
mov edi, dword [ebp - 0x5dc]
push dword [ebp - 0x5d0]
push dword [ebp - 0x5f0]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x41bd2e
mov ecx, dword [ebp - 0x5d0]
or eax, 0xffffffff
mov dword [ecx], eax
jmp 0x41bd36
mov eax, dword [ebp - 0x5d0]
mov eax, dword [eax]
push eax
push dword [ebp - 0x5e8]
lea eax, [ebp - 0xf4]
push str.Service_process_PID_u_finished_with_code_u
push eax
call fcn.00403213
mov eax, dword [ebx]
lea ecx, [ebp - 0xf4]
add esp, 0x10
push ecx
push edi
mov ecx, ebx
call dword [eax + 0x28]
push dword [ebp - 0x5f0]
call esi
xor esi, esi
mov eax, dword [ebp - 0x5e0]
test eax, eax
je 0x41bd7b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret 0x14