Function at 0x414f6a
Capabilities:
Check mutex on windows
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
push dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 4], esi
call fcn.00421fed
xor edi, edi
inc edi
pop ecx
test eax, eax
jne 0x414f9a
push dword [ebp + 0x10]
call fcn.004220cc
pop ecx
mov dword [0x4c7d08], esi
test eax, eax
je 0x414fa0
mov dword [0x4c7d08], edi
push dword [ebp + 0x10]
call fcn.004220cc
push esi
mov dword [0x4c7d0c], eax
call fcn.00413e00
pop ecx
pop ecx
test eax, eax
je 0x414fc2
call fcn.00413cc9
test eax, eax
jne 0x415004
push str.3595f304_0a7c_460a_a72e_001d928a9773
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x41517a
call fcn.00434cb6
push edi
call fcn.00413e00
pop ecx
test eax, eax
je 0x41510b
call fcn.00413cc9
test eax, eax
je 0x41510b
push ebx
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 0x404
call fcn.0040d284
pop ecx
push esi
push dword [ebp + 8]
mov ecx, 0x4c7d10
push esi
call fcn.0040df81
push edi
push edi
push dword [0x4ca63c]
lea ecx, [ebp - 0x20]
call fcn.00413935
lea ecx, [ebp - 0x20]
call fcn.00414e3d
push str.RICHED20.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x4c7d04], eax
call fcn.0040dd4e
mov ecx, eax
call fcn.00443c6f
mov ebx, str.32770
push ebx
mov edi, 0x49ba10
push edi
push dword [0x4ca63c]
call fcn.0040d865
add esp, 0xc
call fcn.004114a4
cmp eax, esi
je 0x415096
mov ecx, dword [eax]
push edi
push ebx
push eax
call dword [ecx + 0x24]
call fcn.004114a4
mov ecx, dword [eax]
push eax
call dword [ecx + 0x6c]
pop ebx
cmp eax, esi
je 0x4150b1
mov ecx, dword [eax]
push str.feedback.ui
push esi
push eax
call dword [ecx]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004146c7
pop ecx
pop ecx
mov edi, eax
call fcn.004114a4
cmp eax, esi
je 0x4150cf
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov ecx, 0x4c7d10
call fcn.0041193c
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [0x4c7d04]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [ebp - 4], esi
je 0x4150ff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x20]
call fcn.0040e48d
mov eax, edi
jmp 0x41517c
mov eax, dword [0x4bd024]
mov dword [ebp + 8], eax
mov dword [ebp + 0x10], eax
cmp dword [0x4c7d08], esi
je 0x415130
lea eax, [ebp + 0x10]
push str.http:__bbs.360safe.com_forum_69_1.html
push eax
call fcn.00413187
pop ecx
pop ecx
jmp 0x41514d
lea eax, [ebp + 8]
push eax
call fcn.00420d05
push dword [ebp + 8]
lea eax, [ebp + 0x10]
push str.http:__suggest.se.360.cn_sedoctor_ctypesecversion_s
push eax
call fcn.00413187
add esp, 0x10
push 5
push esi
push esi
push dword [ebp + 0x10]
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 4], esi
je 0x41516a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 0x10]
call fcn.0040e14c
lea ecx, [ebp + 8]
call fcn.0040e14c
xor eax, eax
pop edi
pop esi
leave
ret 0x10