Function at 0x1001bef0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002a411
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x80
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor eax, eax
mov dword [ebp - 0x20], 0
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0x3339337b
lea esi, [ebp - 0x50]
movq qword [ebp - 0x28], xmm0
lea edi, [ebp - 0x2a]
mov dword [ebp - 0x4c], 0x35333738
mov dword [ebp - 0x48], 0x33392d38
mov dword [ebp - 0x44], 0x342d3934
mov dword [ebp - 0x40], 0x2d454136
mov dword [ebp - 0x3c], 0x39443741
mov dword [ebp - 0x38], 0x3134332d
mov dword [ebp - 0x34], 0x33424131
mov dword [ebp - 0x30], 0x35453331
mov word [ebp - 0x2c], 0x7d41
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
sub edi, esi
je 0x1001bfcb
cmp edi, 0x7fffffff
ja 0x1001c2f6
push edi
lea ecx, [ebp - 0x28]
call fcn.10001e00
push edi
push esi
mov esi, dword [ebp - 0x28]
push esi
call sub.VCRUNTIME140.dll_memmove
lea eax, [edi + esi]
add esp, 0xc
mov dword [ebp - 0x24], eax
push ecx
push eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x94]
push dword [ebp - 0x28]
call fcn.10014e10
mov esi, eax
cmp esi, 0x10038bd8
je 0x1001c067
mov ecx, dword [0x10038bec]
cmp ecx, 7
jbe 0x1001c027
mov eax, dword [0x10038bd8]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x1001c01d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001c096
mov eax, edx
push ecx
push eax
call fcn.10026cc1
add esp, 8
mov dword [0x10038be8], 0
xor eax, eax
mov dword [0x10038bec], 7
mov word [0x10038bd8], ax
movups xmm0, xmmword [esi]
movups xmmword [0x10038bd8], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x10038be8], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov ecx, dword [ebp - 0x80]
cmp ecx, 7
jbe 0x1001c0a6
mov edx, dword [ebp - 0x94]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001c09c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001c09c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10026cc1
add esp, 8
cmp dword [0x10038bec], 7
mov eax, 0x10038bd8
cmova eax, dword [0x10038bd8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp eax, 0xffffffff
je 0x1001c280
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1001c280
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], 0x3e8
mov dword [ebp - 0x54], 0
call fcn.1000a590
mov byte [ebp - 4], 1
call fcn.1001f7b0
test al, al
je 0x1001c2fb
mov dword [ebp - 4], 0
nop dword [eax]
mov byte [ebp - 4], 3
mov edi, dword [sym.imp.mfc140u.dll_operator_1]
push 0x264
call edi
mov esi, eax
add esp, 4
mov dword [ebp - 0x54], esi
mov byte [ebp - 4], 4
test esi, esi
je 0x1001c14a
push 0x264
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, esi
call fcn.100223e0
jmp 0x1001c14c
xor eax, eax
push eax
mov byte [ebp - 4], 3
call fcn.1001c470
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], 0x3e8
mov dword [ebp - 0x5c], 0
call fcn.1000a590
nop dword [eax]
mov byte [ebp - 4], 5
mov eax, dword [0x10038c08]
cmp byte [eax + 0x261], 0
jne 0x1001c206
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x64], 0
call fcn.10008e90
mov esi, dword [0x100389a0]
test esi, esi
je 0x1001c1bb
mov ecx, esi
call fcn.10022ac0
push 0x264
push esi
call fcn.10026cc1
add esp, 8
push 0x264
mov dword [0x100389a0], 0
call edi
mov esi, eax
add esp, 4
mov dword [ebp - 0x54], esi
mov byte [ebp - 4], 6
test esi, esi
je 0x1001c1f5
push 0x264
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, esi
call fcn.100223e0
jmp 0x1001c1f7
xor eax, eax
push eax
mov byte [ebp - 4], 5
call fcn.1001c470
mov eax, dword [0x10038c08]
mov cl, byte [eax + 0x262]
cmp cl, 1
je 0x1001c25c
cmp byte [eax + 0x263], 1
je 0x1001c257
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x70], 3
mov dword [ebp - 0x6c], 0
call fcn.10008e90
jmp 0x1001c170
cmp cl, 1
jne 0x1001c280
call fcn.1001dae0
jmp 0x1001c280
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x1001c2d3
mov ecx, dword [ebp - 0x20]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x1001c2c9
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001c2c9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push esi
call fcn.10026cc1
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10026c90
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.10001df0
push 0x1002df80
lea ecx, [ebp - 0x7c]
call fcn.1000bde0
push 0x10033964
lea eax, [ebp - 0x7c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3