Function at 0x1101885a
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push 0x43c
mov eax, 0x1104d1f5
call fcn.1101ecd8
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov dword [ebp - 4], 1
push eax
call fcn.11012848
pop ecx
xor ebx, ebx
lea esi, [eax + 0x10]
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x13027940], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x110188b2
push esi
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x13027940], eax
jmp 0x110188c7
cmp eax, 0xb7
jne 0x110188c7
push 0xffffffffffffffff
push dword [0x13027940]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x13027940], ebx
lea ecx, [esi - 0x10]
sete bl
call fcn.110171a5
mov byte [edi + 0x2c], bl
test bl, bl
jne 0x11018ff6
xor ebx, ebx
mov dword [ebp - 0x260], 0x75737a44
push ebx
sub esp, 0xc
mov byte [ebp - 0x21c], bl
mov ecx, esp
mov dword [ebp - 0x25c], 0x55414449
lea eax, [ebp - 0x221]
mov dword [ebp - 0x258], 0x33517949
mov dword [ebp - 0x254], 0x314a6a41
push dword [ebp - 0x21c]
mov dword [ebp - 0x250], 0x394d6d47
push eax
mov dword [ebp - 0x24c], 0x6267694e
lea eax, [ebp - 0x260]
mov dword [ebp - 0x248], 0x4341445a
mov dword [ebp - 0x244], 0x55304749
mov dword [ebp - 0x240], 0x6b5a4265
mov dword [ebp - 0x23c], 0x33776745
mov dword [ebp - 0x238], 0x6c305343
mov dword [ebp - 0x234], 0x32596846
mov dword [ebp - 0x230], 0x6e55574a
mov dword [ebp - 0x22c], 0x596b515a
mov dword [ebp - 0x228], 0x4141674e
mov word [ebp - 0x224], 0x4341
mov byte [ebp - 0x222], 0x49
mov dword [ebp - 0x2d0], 0x31777945
mov dword [ebp - 0x2cc], 0x2b416a4f
mov dword [ebp - 0x2c8], 0x38705865
mov dword [ebp - 0x2c4], 0x7551794d
mov dword [ebp - 0x2c0], 0x35314161
mov dword [ebp - 0x2bc], 0x36775165
mov dword [ebp - 0x2b8], 0x6a686746
mov dword [ebp - 0x2b4], 0x34775143
mov dword [ebp - 0x2b0], 0x32415143
mov dword [ebp - 0x2ac], 0x44673359
mov dword [ebp - 0x2a8], 0x4667444c
mov dword [ebp - 0x2a4], 0x6377424f
mov dword [ebp - 0x2a0], 0x64384166
mov dword [ebp - 0x29c], 0x4e304159
mov dword [ebp - 0x298], 0x3742444c
mov dword [ebp - 0x294], 0x34525242
mov dword [ebp - 0x290], 0x34516950
mov dword [ebp - 0x28c], 0x5930544d
mov dword [ebp - 0x288], 0x39736a65
mov dword [ebp - 0x284], 0x55737a4e
mov dword [ebp - 0x280], 0x2f70674c
mov dword [ebp - 0x27c], 0x6c634348
mov dword [ebp - 0x278], 0x42384341
mov dword [ebp - 0x274], 0x45776842
mov dword [ebp - 0x270], 0x6b6b6962
mov dword [ebp - 0x26c], 0x4f67414b
mov dword [ebp - 0x268], 0x41304246
mov dword [ebp - 0x264], 0x45424141
push eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.1100f843
lea eax, [ebp - 0x43c]
push eax
call fcn.11012a81
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1101c584
push eax
push ebx
sub esp, 0xc
mov byte [ebp - 0x21c], bl
mov ecx, esp
lea eax, [ebp - 0x260]
push dword [ebp - 0x21c]
mov dword [ecx], ebx
push eax
lea eax, [ebp - 0x2d0]
mov dword [ecx + 4], ebx
push eax
mov dword [ecx + 8], ebx
call fcn.1100f843
lea eax, [ebp - 0x448]
push eax
call fcn.11012bba
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.1101c5cd
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x448]
mov dword [0x130276dc], eax
call fcn.1101c44d
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 1
call fcn.1101c3ca
cmp dword [0x130276dc], ebx
je 0x11018ff6
push 0x11014676
push 0x130276dc
call fcn.1101dec8
pop ecx
pop ecx
test eax, eax
je 0x11018ff6
push dword [ebp + 8]
mov byte [edi + 0x2d], 1
mov dword [0x13027938], 1
call fcn.1101918c
pop ecx
push eax
push dword [ebp + 8]
mov ecx, 0x13027700
call fcn.11019066
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [0x1302793c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x13027948], eax
test eax, eax
je 0x11018bdb
mov byte [edi + 0x2e], 1
mov dword [ebp - 0x430], 0x6f557948
mov dword [ebp - 0x42c], 0x2b516a4e
mov dword [ebp - 0x428], 0x68306d46
mov dword [ebp - 0x424], 0x6b304343
mov dword [ebp - 0x420], 0x2f394164
mov dword [ebp - 0x41c], 0x416b784b
mov dword [ebp - 0x418], 0x44517a49
mov dword [ebp - 0x414], 0x5345424b
mov dword [ebp - 0x410], 0x36596742
mov dword [ebp - 0x40c], 0x34674859
mov dword [ebp - 0x408], 0x6d45334e
mov dword [ebp - 0x404], 0x6f494442
mov dword [ebp - 0x400], 0x47456748
mov dword [ebp - 0x3fc], 0x56737750
mov dword [ebp - 0x3f8], 0x35787946
mov dword [ebp - 0x3f4], 0x6951414f
mov dword [ebp - 0x3f0], 0x66514344
mov dword [ebp - 0x3ec], 0x2f516747
mov dword [ebp - 0x3e8], 0x39596a45
mov dword [ebp - 0x3e4], 0x7a773344
mov dword [ebp - 0x3e0], 0x4430414e
mov dword [ebp - 0x3dc], 0x4963684d
mov dword [ebp - 0x3d8], 0x42597950
mov dword [ebp - 0x3d4], 0x796c5847
mov dword [ebp - 0x3d0], 0x39424264
mov dword [ebp - 0x3cc], 0x34527864
mov dword [ebp - 0x3c8], 0x61414445
mov dword [ebp - 0x3c4], 0x42456d44
mov dword [ebp - 0x3c0], 0x694e5247
mov dword [ebp - 0x3bc], 0x42494350
mov dword [ebp - 0x3b8], 0x6445794d
mov dword [ebp - 0x3b4], 0x34305348
mov dword [ebp - 0x3b0], 0x37344345
mov dword [ebp - 0x3ac], 0x7a426759
mov dword [ebp - 0x3a8], 0x63456a46
mov dword [ebp - 0x3a4], 0x684d6765
mov dword [ebp - 0x3a0], 0x2b45335a
mov dword [ebp - 0x39c], 0x7530794f
mov dword [ebp - 0x398], 0x736c7846
mov dword [ebp - 0x394], 0x6b30544a
mov dword [ebp - 0x390], 0x67304361
mov dword [ebp - 0x38c], 0x62777746
mov dword [ebp - 0x388], 0x6d456a41
mov dword [ebp - 0x384], 0x746f544a
mov dword [ebp - 0x380], 0x44733247
mov dword [ebp - 0x37c], 0x694d5849
mov dword [ebp - 0x378], 0x58634147
mov dword [ebp - 0x374], 0x61677a4c
mov dword [ebp - 0x370], 0x4167434e
mov dword [ebp - 0x36c], 0x6963694e
mov dword [ebp - 0x368], 0x4a73334e
mov dword [ebp - 0x364], 0x5230544d
mov dword [ebp - 0x360], 0x66517942
mov dword [ebp - 0x35c], 0x4449784d
mov dword [ebp - 0x358], 0x69777a46
mov dword [ebp - 0x354], 0x39644166
mov dword [ebp - 0x350], 0x46735159
mov dword [ebp - 0x34c], 0x2f776a4f
mov dword [ebp - 0x348], 0x54596942
mov dword [ebp - 0x344], 0x65387847
mov dword [ebp - 0x340], 0x77463345
mov dword [ebp - 0x33c], 0x41414759
mov dword [ebp - 0x338], 0x654d6965
mov dword [ebp - 0x334], 0x6d416e4d
mov dword [ebp - 0x330], 0x43496945
mov dword [ebp - 0x32c], 0x73635242
mov dword [ebp - 0x328], 0x2f414346
mov dword [ebp - 0x324], 0x49306845
mov dword [ebp - 0x320], 0x6e595442
mov dword [ebp - 0x31c], 0x3467444f
mov dword [ebp - 0x318], 0x78773350
mov dword [ebp - 0x314], 0x5a30524c
mov dword [ebp - 0x310], 0x48494248
mov dword [ebp - 0x30c], 0x31556d4c
mov dword [ebp - 0x308], 0x62347a61
mov dword [ebp - 0x304], 0x74734148
mov dword [ebp - 0x300], 0x7441794f
mov dword [ebp - 0x2fc], 0x35416749
mov dword [ebp - 0x2f8], 0x5a4d5449
mov dword [ebp - 0x2f4], 0x54514362
mov dword [ebp - 0x2f0], 0x53676a49
push dword [ebp + 0xc]
mov byte [ebp - 0x21c], bl
lea eax, [ebp - 0x2d0]
push ebx
sub esp, 0xc
mov dword [ebp - 0x2ec], 0x71517a47
mov ecx, esp
mov dword [ebp - 0x2e8], 0x4e30774b
mov dword [ebp - 0x2e4], 0x4d304241
mov dword [ebp - 0x2e0], 0x756f6d4d
push dword [ebp - 0x21c]
mov dword [ebp - 0x2dc], 0x3830434b
push eax
mov dword [ebp - 0x2d8], 0x41493343
lea eax, [ebp - 0x430]
mov dword [ebp - 0x2d4], 0x35444141
push eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.1100f843
lea eax, [ebp - 0x43c]
push eax
call fcn.11012bba
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.1101c5cd
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.11012f3e
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x43c]
call fcn.1101c44d
push dword [ebp + 0xc]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x13027944], eax
test eax, eax
je 0x11018fcd
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x1101b653
lea ecx, [ebp - 0x220]
call fcn.1100f4ee
push eax
mov ecx, 0x130276f0
call fcn.1101bf2b
cmp dword [ebp - 0x21c], 0
je 0x11018ff6
call fcn.110297ea
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.110171a5
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.110171a5
call fcn.1101ec82
ret