Function at 0x10001335
Capabilities:
Accept command line arguments
Check mutex on windows
Create thread
Extract resource via kernel32 functions
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x10016138]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x104
push esi
push edi
push dword [0x100182f4]
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x118], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x20c
xor ebx, ebx
lea eax, [ebp - 0x330]
push ebx
push eax
call fcn.10007f90
push 4
call fcn.1000309f
xor ecx, ecx
mov dword [ebp - 0x328], eax
mov word [eax + 2], cx
lea eax, [ebp - 0x330]
push ebx
push eax
mov dword [ebp - 0x32c], ebx
call sym.bpzweru.dll_gwaWdFvvocQ
push dword [ebp - 0x328]
call fcn.10002c48
fld dword [0x100181c0]
fsub qword [0x10013570]
add esp, 0x1c
fild dword [0x10017360]
fmul qword [0x10013568]
fsubr qword [0x10013560]
fxch st(1)
fstp qword [ebp - 0x120]
call fcn.1000fac0
fsubr qword [ebp - 0x120]
push edi
push 0x100133cc
push esi
fstp qword [0x10017370]
mov edi, 0x100181f0
push edi
call fcn.100022db
add esp, 0x10
push dword [ebp - 0x114]
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.IndexerVolumeGuid
push dword [ebp - 0x114]
push dword [ebp - 0x114]
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x100133f4
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x10001455
push str.QtJfRyHPLSaQhT
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [0x100181e8], ebx
jne 0x10001488
push 0x79
push 0x356
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, ebx
je 0x10001488
push eax
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10001494
mov ecx, dword [ebp - 0x118]
sub eax, edx
push ebx
mov dword [ecx], eax
call dword [sym.imp.USER32.dll_SetFocus]
fld qword [0x10013558]
fstp qword [0x10017370]
cmp dword [0x10017360], ebx
jle 0x100014cc
mov dword [0x10017360], 0x18e
jmp 0x100014d8
fld dword [0x10017368]
fstp dword [0x100181c0]
push 0x1001737c
push ebx
push ebx
push 0x100012a8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x3e8
push eax
mov dword [0x100181e8], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push dword [ebp - 0x114]
lea eax, [ebp - 0x110]
push str._S__s
push esi
push eax
call fcn.100022db
add esp, 0x14
lea eax, [ebp - 0x110]
push eax
push 0x1001341c
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x10
push ebx
call fcn.10002ea2
pop ecx
pop ecx
cmp eax, ebx
jne 0x10001541
mov dword [0x10017378], ebx
jmp 0x1000154c
mov esi, str.eYiIvTqehrLDACV
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0xe70ef7
push 1
push ebx
call dword [sym.imp.GDI32.dll_CreatePen]
push 0xc
mov dword [0x10017360], 0xd618
call fcn.1000309f
mov esi, eax
push 0x17
mov dword [0x10018344], esi
mov dword [esi + 4], 0x100180b0
call fcn.10002247
push 0x1001339b
push esi
mov dword [esi + 8], eax
mov dword [esi], ebx
call fcn.100011d2
mov ecx, dword [0x10018344]
add esp, 0x10
cmp ecx, eax
jne 0x100015ac
push 0x1001339e
push dword [ecx]
call fcn.100011d2
pop ecx
pop ecx
push 0x26
push dword [ebp - 0x118]
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0x118], eax
fild dword [ebp - 0x118]
fstp dword [0x10017368]
fld dword [0x10017368]
fld dword [0x10013550]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x100015ed
push dword [ebp - 0x118]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.10001ddc
leave
ret