Function at 0x401000
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
mov dword [ebp - 0x3c0], 0x55667788
mov dword [ebp - 0x3bc], 0x11223344
mov eax, dword [ebp - 0x3c0]
mov edx, dword [ebp - 0x3bc]
mov cl, 0x38
call fcn.00422130
mov dword [ebp - 0x3c0], eax
mov dword [ebp - 0x3bc], edx
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x3f8], eax
mov dword [0x47e604], 0x19721972
mov dword [0x47e60c], 0x19721972
mov dword [0x47e610], 0x19721972
mov ecx, dword [0x47e604]
push ecx
call fcn.00416a30
add esp, 4
test eax, eax
jne 0x401081
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00421fe0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [0x4898ac]
test eax, eax
jne 0x4010c0
push 0
call dword [0x4898b0]
call fcn.0041ad00
cmp eax, 1
jne 0x4010d4
mov dword [0x487db4], 1
lea edx, [ebp - 0x41c]
push edx
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
cmp dword [0x4820b8], 1
jne 0x401105
cmp dword [0x4820c0], 1
jne 0x401105
call fcn.00401ee0
cmp eax, 1
jne 0x401105
push 0
call dword [0x4898b0]
mov dword [ebp - 0x3b4], 0xc
mov dword [ebp - 0x3b0], 0
mov dword [ebp - 0x3ac], 1
push str.46506BAB_69C7_469F_90DA_F06A1FCB86D8
push 0
lea eax, [ebp - 0x3b4]
push eax
call dword [0x489880]
mov dword [0x487dbc], eax
cmp dword [0x487dbc], 0
jne 0x40114d
push 0
call dword [0x4898b0]
cmp dword [0x47fbe0], 1
jne 0x40115b
call fcn.0040cb80
call fcn.00405f40
cmp eax, 1
jne 0x4011eb
push str.3AEED6D1_0D6B_4A78_9871_968559ACFAD4
push 0
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0x487db8], eax
cmp dword [0x487db8], 0
jne 0x401191
push 0
call dword [0x4898e0]
mov dword [ebp - 0x420], 0
push str.085267A2_0BA4_405A_B18B_C18FFA674571
push 0
push 0x100002
call dword [0x4898d8]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jne 0x4011c4
push 0
call dword [0x4898e0]
mov ecx, dword [ebp - 0x420]
push ecx
call dword [0x4898dc]
mov edx, dword [ebp - 0x420]
push edx
call dword [0x48988c]
call fcn.0041a5d0
push 0
call dword [0x4898e0]
call fcn.0040a5a0
test eax, eax
jne 0x4011fc
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x3f4], 0
push str.4827BB04_3C0A_4E31_8E94_F352D711053B
push 0
push 0x100000
call dword [0x489874]
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0
je 0x40123c
mov eax, dword [ebp - 0x3f4]
push eax
call dword [0x48988c]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.4827BB04_3C0A_4E31_8E94_F352D711053B
push 1
push 0
call dword [0x489880]
test eax, eax
jne 0x401257
push 0
call dword [0x4898b0]
cmp dword [0x47fbe8], 1
jne 0x4012c0
cmp dword [0x489714], 0
jne 0x4012c0
call fcn.0041aec0
test eax, eax
jne 0x4012c0
call fcn.0041abb0
cmp eax, 0xa
jb 0x4012c0
call fcn.0041ad00
cmp eax, 1
jne 0x4012a4
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040d7b0
add esp, 4
cmp eax, 1
jne 0x4012a2
push 0
call dword [0x4898b0]
jmp 0x4012c0
lea edx, [ebp - 0x210]
push edx
call fcn.0040e0e0
add esp, 4
cmp eax, 1
jne 0x4012c0
push 0
call dword [0x4898b0]
cmp dword [0x47e61c], 1
jne 0x401324
cmp dword [0x489718], 0
jne 0x401324
call fcn.0041abb0
cmp eax, 0xa
jb 0x401324
call fcn.0041aec0
cmp eax, 1
jne 0x401324
push 0x47e624
mov eax, dword [0x47e620]
push eax
call fcn.00411950
add esp, 8
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
je 0x401324
mov ecx, dword [ebp - 0x424]
push ecx
call fcn.00411db0
add esp, 4
mov edx, dword [ebp - 0x424]
push edx
call dword [0x4898a0]
push str.A1B5EE80_5A37_466C_97F7_6CE36630BEB8
push 1
push 0
call dword [0x489880]
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0
jne 0x40134a
push 0
call dword [0x4898b0]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40135f
push 0
call dword [0x4898b0]
push str.C5E11230_4171_488F_8B5F_43BC258F9FA1
push 1
push 0
call dword [0x489880]
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 0
jne 0x401385
push 0
call dword [0x4898b0]
push str.C5E11230_4171_488F_8B5F_43BC258F9FA1
call fcn.0041afd0
add esp, 4
push str.3AEED6D1_0D6B_4A78_9871_968559ACFAD4
push 0
push 1
push 0
call dword [0x4898a4]
mov dword [0x487db8], eax
cmp dword [0x487db8], 0
jne 0x4013b9
push 0
call dword [0x4898b0]
push str.3AEED6D1_0D6B_4A78_9871_968559ACFAD4
call fcn.0041afd0
add esp, 4
cmp dword [0x47e1f0], 1
jne 0x401594
push 0x104
lea eax, [ebp - 0x630]
push eax
push 0
call dword [0x4898ac]
test eax, eax
je 0x40158c
push 0x5c
lea ecx, [ebp - 0x630]
push ecx
call fcn.00401cb0
add esp, 8
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x634]
push eax
push 0x47df28
call fcn.0040a320
add esp, 8
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
je 0x401582
push 0x5c
mov ecx, dword [ebp - 0x638]
push ecx
call fcn.00401cb0
add esp, 8
xor edx, edx
mov word [eax], dx
push 0x208
push 0x40
call dword [0x489894]
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 0
je 0x401573
mov eax, dword [ebp - 0x63c]
push eax
push 0x104
call dword [0x4898ec]
test eax, eax
je 0x40155e
push 0x5c
mov ecx, dword [ebp - 0x63c]
push ecx
call fcn.00401cb0
add esp, 8
xor edx, edx
mov word [eax], dx
mov eax, dword [ebp - 0x638]
push eax
lea ecx, [ebp - 0x630]
push ecx
call dword [0x4899f8]
test eax, eax
je 0x40155c
mov edx, dword [ebp - 0x63c]
push edx
lea eax, [ebp - 0x630]
push eax
call dword [0x4899f8]
test eax, eax
je 0x40155c
call dword [0x489878]
mov dword [ebp - 0x648], eax
lea ecx, [ebp - 0x640]
push ecx
mov edx, dword [ebp - 0x648]
push edx
call dword [0x489c50]
mov dword [ebp - 0x644], eax
push str.A9122C56_235B_4F54_8D3A_D95F2BEAE114
mov eax, dword [ebp - 0x644]
mov ecx, dword [eax + 4]
push ecx
call dword [0x4899f8]
test eax, eax
je 0x40155c
push str.8D63BFF6_9751_41A1_B019_D1026E40AFA9
mov edx, dword [ebp - 0x644]
mov eax, dword [edx + 4]
push eax
call dword [0x4899f8]
test eax, eax
je 0x40155c
push str.0DC89A34_799D_4520_A65F_214B97047142
mov ecx, dword [ebp - 0x644]
mov edx, dword [ecx + 4]
push edx
call dword [0x4899f8]
test eax, eax
je 0x40155c
push 1
push 0x47e1f4
push 0x47e2be
push 0
call dword [0x489a24]
cmp eax, 2
jne 0x40155c
push 0
call dword [0x4898b0]
jmp 0x401566
push 0
call dword [0x4898b0]
mov eax, dword [ebp - 0x63c]
push eax
call dword [0x4898a0]
mov ecx, dword [ebp - 0x638]
push ecx
call dword [0x4898a0]
jmp 0x40158a
push 0
call dword [0x4898b0]
jmp 0x401594
push 0
call dword [0x4898b0]
lea edx, [ebp - 0x3a8]
push edx
push 2
call dword [0x489d04]
test eax, eax
je 0x4015af
push 0
call dword [0x4898b0]
call fcn.00409f30
test eax, eax
jne 0x4015c0
push 0
call dword [0x4898b0]
call fcn.00415f30
test eax, eax
jne 0x4015d1
push 0
call dword [0x4898b0]
call fcn.00405a80
test eax, eax
jne 0x4015e2
push 0
call dword [0x4898b0]
call fcn.00404660
test eax, eax
jne 0x4015f3
push 0
call dword [0x4898b0]
call fcn.00404580
test eax, eax
jne 0x401604
push 0
call dword [0x4898b0]
cmp dword [0x47e52c], 0
jne 0x401626
push 0x47df28
call fcn.00409fd0
add esp, 4
test eax, eax
jne 0x401626
push 0
call dword [0x4898b0]
push 0x47df28
call fcn.0040a410
add esp, 4
test eax, eax
jne 0x40163f
push 0
call dword [0x4898b0]
cmp dword [0x47e52c], 0
jne 0x401663
cmp dword [0x47fbd4], 1
jne 0x401663
call fcn.0040ce20
cmp eax, 1
jne 0x401663
push 0
call dword [0x4898b0]
mov dword [ebp - 0x3b8], 0
mov dword [ebp - 0x418], 0
cmp dword [0x487db4], 1
jne 0x4016ab
lea eax, [ebp - 0x3b8]
push eax
push 0x43a008
call fcn.0041b840
add esp, 8
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
jne 0x4016ab
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xfffe
push 0x40
call dword [0x489894]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x4016cf
push 0
call dword [0x4898b0]
push 0x7fff
mov ecx, dword [ebp - 0x218]
push ecx
call dword [0x4898d4]
test eax, eax
jne 0x4016ed
push 0
call dword [0x4898b0]
push 0xfffe
push 0x40
call dword [0x489894]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x401711
push 0
call dword [0x4898b0]
push 0x7fff
mov edx, dword [ebp - 0x214]
push edx
call dword [0x489910]
test eax, eax
jne 0x40172f
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xfffe
push 0x40
call dword [0x489894]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40174d
push 0
call dword [0x4898b0]
mov eax, dword [ebp - 0x218]
push eax
push 0x4312f8
push 0x7fff
mov ecx, dword [ebp - 8]
push ecx
call fcn.0042205a
add esp, 0x10
push 0xfffe
push 0x40
call dword [0x489894]
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 0
jne 0x40178e
push 0
call dword [0x4898b0]
mov edx, dword [ebp - 0x214]
push edx
push 0x431318
push 0x7fff
mov eax, dword [ebp - 0x3ec]
push eax
call fcn.0042205a
add esp, 0x10
push 0xfffe
push 0x40
call dword [0x489894]
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0
jne 0x4017d2
push 0
call dword [0x4898b0]
mov ecx, dword [ebp - 0x214]
push ecx
push 0x431338
push 0x7fff
mov edx, dword [ebp - 0x3c8]
push edx
call fcn.0042205a
add esp, 0x10
mov dword [ebp - 0x3c4], 0
mov dword [ebp - 0x414], 0
xor eax, eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x3e4], 0
xor ecx, ecx
mov dword [ebp - 0x3e0], ecx
mov dword [ebp - 0x3dc], ecx
mov dword [ebp - 0x408], 0
xor edx, edx
mov dword [ebp - 0x404], edx
mov dword [ebp - 0x400], edx
cmp dword [0x486860], 1
jne 0x40188e
mov eax, dword [ebp - 0x3c4]
mov ecx, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x414], ecx
mov edx, dword [ebp - 0x3c4]
mov dword [ebp + edx*4 - 0x3e4], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp + eax*4 - 0x408], 1
mov ecx, dword [ebp - 0x3c4]
add ecx, 1
mov dword [ebp - 0x3c4], ecx
cmp dword [0x48685c], 1
jne 0x4018db
mov edx, dword [ebp - 0x3c4]
mov eax, dword [ebp - 0x3ec]
mov dword [ebp + edx*4 - 0x414], eax
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp + ecx*4 - 0x3e4], 1
mov edx, dword [ebp - 0x3c4]
mov dword [ebp + edx*4 - 0x408], 1
mov eax, dword [ebp - 0x3c4]
add eax, 1
mov dword [ebp - 0x3c4], eax
cmp dword [0x486864], 1
jne 0x401928
mov ecx, dword [ebp - 0x3c4]
mov edx, dword [ebp - 0x3c8]
mov dword [ebp + ecx*4 - 0x414], edx
mov eax, dword [ebp - 0x3c4]
mov dword [ebp + eax*4 - 0x3e4], 2
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp + ecx*4 - 0x408], 1
mov edx, dword [ebp - 0x3c4]
add edx, 1
mov dword [ebp - 0x3c4], edx
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x401c62
mov dword [ebp - 0x64c], 0
jmp 0x401960
mov ecx, dword [ebp - 0x64c]
add ecx, 1
mov dword [ebp - 0x64c], ecx
mov edx, dword [ebp - 0x64c]
cmp edx, dword [ebp - 0x3fc]
jge 0x401c5d
cmp dword [0x487db4], 0
jne 0x4019ae
lea eax, [ebp - 0x3d8]
push eax
mov ecx, dword [ebp - 0x64c]
mov edx, dword [ebp + ecx*4 - 0x408]
push edx
mov eax, dword [ebp - 0x64c]
mov ecx, dword [ebp + eax*4 - 0x414]
push ecx
call fcn.0040b1a0
add esp, 0xc
mov dword [ebp - 0x650], eax
jmp 0x4019ef
lea edx, [ebp - 0x3d8]
push edx
push str.085267A2_0BA4_405A_B18B_C18FFA674571
mov eax, dword [0x468468]
push eax
push 0x468470
mov ecx, dword [ebp - 0x3b8]
push ecx
mov edx, dword [ebp - 0x418]
push edx
mov eax, dword [ebp - 0x64c]
mov ecx, dword [ebp + eax*4 - 0x414]
push ecx
call fcn.0040eee0
add esp, 0x1c
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 1
jne 0x401c4d
cmp dword [0x47e52c], 1
jne 0x401b8f
mov edx, dword [ebp - 0x64c]
cmp dword [ebp + edx*4 - 0x3e4], 1
jne 0x401a88
push 0
mov eax, dword [ebp - 0x3d8]
push eax
call dword [0x4898b4]
cmp eax, 0x102
jne 0x401a88
push str.C50C8145_113E_4D34_827A_26EC946762F2
push 0
push 0x100000
call dword [0x489874]
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jne 0x401a72
push 0xa
mov ecx, dword [0x487db8]
push ecx
call dword [0x4898b4]
cmp eax, 0x102
je 0x401a70
jmp 0x401c62
jmp 0x401a19
cmp dword [ebp - 0x65c], 0
je 0x401a88
mov edx, dword [ebp - 0x65c]
push edx
call dword [0x48988c]
mov eax, dword [ebp - 0x64c]
cmp dword [ebp + eax*4 - 0x3e4], 0
jne 0x401b07
push 0
mov ecx, dword [ebp - 0x3d8]
push ecx
call dword [0x4898b4]
cmp eax, 0x102
jne 0x401b07
push str.BD2B7D68_8C46_4820_A4A8_7CD43AE8862B
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x660], eax
cmp dword [ebp - 0x660], 0
jne 0x401af1
push 0xa
mov edx, dword [0x487db8]
push edx
call dword [0x4898b4]
cmp eax, 0x102
je 0x401aef
jmp 0x401c62
jmp 0x401a98
cmp dword [ebp - 0x660], 0
je 0x401b07
mov eax, dword [ebp - 0x660]
push eax
call dword [0x48988c]
mov ecx, dword [ebp - 0x64c]
cmp dword [ebp + ecx*4 - 0x3e4], 2
jne 0x401b85
push 0
mov edx, dword [ebp - 0x3d8]
push edx
call dword [0x4898b4]
cmp eax, 0x102
jne 0x401b85
push str.8ABA3E8F_1AD9_4F96_9B22_A5468E669A89
push 0
push 0x100000
call dword [0x489874]
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 0
jne 0x401b6f
push 0xa
mov eax, dword [0x487db8]
push eax
call dword [0x4898b4]
cmp eax, 0x102
je 0x401b6d
jmp 0x401c62
jmp 0x401b17
cmp dword [ebp - 0x664], 0
je 0x401b85
mov ecx, dword [ebp - 0x664]
push ecx
call dword [0x48988c]
jmp 0x401c62
mov dword [ebp - 0x658], 0
xor edx, edx
mov dword [ebp - 0x654], edx
mov eax, dword [0x487db8]
mov dword [ebp - 0x658], eax
mov ecx, dword [ebp - 0x3d8]
mov dword [ebp - 0x654], ecx
push 0xffffffffffffffff
push 0
lea edx, [ebp - 0x658]
push edx
push 2
call dword [0x4898fc]
push 0
mov eax, dword [0x487db8]
push eax
call dword [0x4898b4]
cmp eax, 0x102
je 0x401be9
mov dword [ebp - 4], 0
jmp 0x401c5d
cmp dword [ebp - 0x3d8], 0
je 0x401c01
push 0
mov ecx, dword [ebp - 0x3d8]
push ecx
call dword [0x4898c0]
cmp dword [ebp - 0x3d8], 0
je 0x401c17
mov edx, dword [ebp - 0x3d8]
push edx
call dword [0x48988c]
cmp dword [ebp - 0x3d4], 0
je 0x401c2d
mov eax, dword [ebp - 0x3d4]
push eax
call dword [0x48988c]
push 0x10
push 0
lea ecx, [ebp - 0x3d8]
push ecx
call fcn.00421fe0
add esp, 0xc
push 0x3e8
call dword [0x489914]
jmp 0x401c58
push 0x3e8
call dword [0x489914]
jmp 0x401951
jmp 0x40193b
call fcn.00409fc0
cmp dword [0x486858], 1
jne 0x401c7f
push 0xffffffffffffffff
mov edx, dword [0x4897d0]
push edx
call dword [0x4898b4]
call fcn.0041ad00
cmp eax, 1
jne 0x401c96
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push 0
call dword [0x4898b0]
mov esp, ebp
pop ebp
ret 0x10