Function at 0x4958d0
Capabilities:
Check mutex on windows
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x64786c]
xor eax, ebp
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 0x10], 0
je 0x495919
push 0x5bec3c
mov eax, dword [ebp + 0x10]
push eax
call fcn.00597d3c
add esp, 8
test eax, eax
jne 0x495919
push 0
call fcn.00495810
add esp, 4
call fcn.004b3600
xor eax, eax
jmp 0x495e5b
cmp dword [ebp + 0x10], 0
je 0x495a59
push str.update
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401530
add esp, 8
cmp eax, dword [ebp + 0x10]
jne 0x495a59
cmp dword [0x654928], 3
jl 0x495a4d
mov edx, dword [0x654930]
cmp dword [edx + 8], 0
je 0x495a4d
mov eax, dword [0x654930]
mov ecx, dword [eax + 8]
push ecx
lea ecx, [ebp - 0x10]
call fcn.004970b0
push 0x104
lea edx, [ebp - 0x230]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.clean__
lea eax, [ebp - 0x128]
push eax
call fcn.00597aa0
add esp, 8
push 0xfa
lea ecx, [ebp - 0x128]
push ecx
call fcn.00597ba0
add esp, 4
lea edx, [ebp + eax - 0x128]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5bec64
lea eax, [ebp - 0x128]
push eax
call fcn.00597ab0
add esp, 8
mov dword [ebp - 0x18], 0x1e
mov dword [ebp - 0x14], 0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x14], 0
jne 0x495a06
lea ecx, [ebp - 0x10]
call fcn.004ab500
push eax
lea ecx, [ebp - 0x230]
push ecx
call fcn.00403380
add esp, 8
test eax, eax
je 0x495a35
mov dword [ebp - 0x14], 1
push 0xa
push 0
lea edx, [ebp - 0x128]
push edx
lea ecx, [ebp - 0x10]
call fcn.004ab500
push eax
push 0x5bec68
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jbe 0x495a35
jmp 0x495a45
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
test eax, eax
jg 0x4959d9
lea ecx, [ebp - 0x10]
call fcn.004970f0
xor eax, eax
jmp 0x495e5b
cmp dword [ebp + 0x10], 0
je 0x495b14
push str.clean
mov edx, dword [ebp + 0x10]
push edx
call fcn.00401530
add esp, 8
cmp eax, dword [ebp + 0x10]
jne 0x495b14
cmp dword [0x654928], 3
jne 0x495b0f
mov eax, dword [0x654930]
cmp dword [eax + 8], 0
je 0x495b0f
push 0x81
call fcn.004b31f0
add esp, 4
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x238], 5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x654930]
mov edx, dword [ecx + 8]
push edx
call fcn.00597a6b
add esp, 4
push 0
mov eax, dword [0x654930]
mov ecx, dword [eax + 8]
push ecx
call fcn.00597a53
add esp, 8
test eax, eax
jne 0x495aff
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 0x238]
sub eax, 1
mov dword [ebp - 0x238], eax
test edx, edx
jg 0x495ab2
cmp dword [ebp - 0x234], 0
je 0x495b0f
xor eax, eax
jmp 0x495e5b
jmp 0x495e18
cmp dword [ebp + 0x10], 0
je 0x495b2f
push 0x5bec80
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004ace20
add esp, 8
test eax, eax
jne 0x495b3c
call fcn.004b2ec0
test eax, eax
jne 0x495bd5
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x240], edx
cmp dword [ebp - 0x240], 0
je 0x495b5b
mov eax, dword [ebp - 0x240]
movzx ecx, word [eax]
test ecx, ecx
jne 0x495b6f
mov dword [ebp - 0x240], 0x5bec94
mov dword [0x6443fc], 0
mov edx, dword [ebp - 0x240]
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x495bd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0xb7
jne 0x495bd0
cmp dword [0x653730], 3
jg 0x495bc9
push str.Already_opened_
push 0xf6
push str..GotoHttp.cpp
push 3
call fcn.00401320
add esp, 0x10
xor eax, eax
jmp 0x495e5b
jmp 0x495e18
cmp dword [ebp + 0x10], 0
je 0x495c02
push str.delete
mov eax, dword [ebp + 0x10]
push eax
call fcn.00401530
add esp, 8
cmp eax, dword [ebp + 0x10]
jne 0x495c02
call fcn.004b3140
xor eax, eax
jmp 0x495e5b
push 1
call fcn.00495810
add esp, 4
mov dword [ebp - 0x248], 0
push 4
lea ecx, [ebp - 0x248]
push ecx
push 0x5becd8
call fcn.004973d0
add esp, 0xc
test eax, eax
je 0x495c9b
cmp dword [ebp - 0x248], 0
je 0x495c9b
mov dword [ebp - 0x250], 0x64
cmp dword [ebp + 0x10], 0
je 0x495c68
push str.exit
mov edx, dword [ebp + 0x10]
push edx
call fcn.00597d3c
add esp, 8
test eax, eax
jne 0x495c68
mov dword [ebp - 0x250], 0x65
push 0
mov eax, dword [ebp - 0x250]
and eax, 0xffff
movzx ecx, ax
shl ecx, 0x10
or ecx, 0x800f
push ecx
push 0x111
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
jmp 0x495e5b
lea eax, [ebp - 0x24c]
push eax
call fcn.004b2f00
add esp, 4
test eax, eax
jne 0x495cf7
call fcn.004b3140
push 0x10
push 0x5bed04
mov ecx, dword [ebp - 0x24c]
push ecx
push 0xa1
push 0
lea edx, [ebp - 0x29c]
push edx
call fcn.00497520
add esp, 0x10
mov ecx, eax
call fcn.004976a0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x29c]
call fcn.00497640
jmp 0x495e14
lea ecx, [ebp - 0x25c]
call fcn.004b3700
lea ecx, [ebp - 0x25c]
call fcn.00497120
test eax, eax
jne 0x495e09
mov dword [ebp - 0x260], 0x3c
cmp dword [ebp - 0x260], 0
jle 0x495e09
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x290]
call fcn.004969f0
push 0
push 0x5bed18
push 0x5bed20
lea ecx, [ebp - 0x290]
call fcn.00403f60
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
jne 0x495d75
lea ecx, [ebp - 0x290]
call fcn.00496ae0
jmp 0x495d1f
lea ecx, [ebp - 0x294]
call fcn.00404b50
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x290]
call fcn.004971c0
push 0x40
push str.gotohttp.com
lea ecx, [ebp - 0x294]
call fcn.004032f0
push eax
mov ecx, dword [ebp - 0x264]
push ecx
push 0x93
push 0
lea edx, [ebp - 0x2a4]
push edx
call fcn.00497520
add esp, 0x14
mov ecx, eax
call fcn.004976a0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x2a4]
call fcn.00497640
lea ecx, [ebp - 0x294]
call fcn.00402ea0
lea ecx, [ebp - 0x290]
call fcn.00496ae0
jmp 0x495e09
lea ecx, [ebp - 0x25c]
call fcn.004977b0
xor eax, eax
jmp 0x495e5b
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
mov ecx, 0x6547a4
call fcn.00496bb0
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.004953a0
add esp, 8
mov dword [ebp - 4], eax
mov ecx, 0x6547a4
call fcn.00496d70
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0059709c
mov esp, ebp
pop ebp
ret 0x10