Function at 0x412c7e
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Terminate process

Disassembly:
push 0x1dc
mov eax, 0x44164c
call fcn.0042bb26
and dword [ebp - 0x88], 0
mov eax, dword [ecx + 0x2e8]
sub eax, dword [ecx + 0x2e4]
mov dword [ebp - 0x98], ecx
add ecx, 0x2d8
mov dword [ebp - 0xa0], ecx
cdq
mov ecx, 0x8c
idiv ecx
test eax, eax
jne 0x412cc9
mov eax, 0x80004005
call fcn.0042bba9
ret
cmp dword [0x4558e0], 2
jne 0x412d41
push 2
lea eax, [ebp - 0x48]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x90], esp
push 2
push 0x4491c8
call fcn.004081ed
lea edi, [ebp - 0x18c]
call fcn.00427366
and dword [ebp - 4], 0
xor ebx, ebx
inc ebx
mov dword [ebp - 0x88], ebx
call fcn.00427546
cmp dword [eax + 0x18], 0x10
mov dword [ebp - 0x88], 3
jb 0x412d21
mov eax, dword [eax + 4]
jmp 0x412d24
add eax, 4
push eax
mov eax, dword [0x4558e4]
push dword [eax + 4]
call fcn.0042abf5
add esp, 0xc
test eax, eax
jne 0x412d44
mov byte [ebp - 0x81], bl
jmp 0x412d4b
xor ebx, ebx
inc ebx
mov byte [ebp - 0x81], 0
test byte [ebp - 0x88], 2
je 0x412d66
and dword [ebp - 0x88], 0xfffffffd
push 0
push ebx
lea ecx, [ebp - 0x48]
call fcn.004035bd
or dword [ebp - 4], 0xffffffff
test byte [ebp - 0x88], bl
je 0x412d7d
lea esi, [ebp - 0x18c]
call fcn.00404654
cmp byte [ebp - 0x81], 0
je 0x412d8d
xor eax, eax
jmp 0x412cc3
push 0
push 0x100
lea eax, [ebp - 0x48]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x90], esp
push 0x14
push str._PbdnF_
call fcn.004081ed
lea edi, [ebp - 0x18c]
call fcn.00427366
mov dword [ebp - 4], ebx
call fcn.00427546
mov byte [ebp - 4], 2
cmp dword [eax + 0x18], 0x10
jb 0x412dd1
mov eax, dword [eax + 4]
jmp 0x412dd4
add eax, 4
lea ecx, [ebp - 0x94]
push ecx
mov ebx, eax
call fcn.004184b7
mov ecx, dword [ebp - 0x98]
add ecx, 0x244
push eax
push ecx
mov byte [ebp - 4], 3
mov dword [ebp - 0xa4], ecx
call fcn.0041a077
movzx edi, al
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x9c], edi
mov byte [ebp - 4], 2
call fcn.00418545
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.004035bd
lea esi, [ebp - 0x18c]
call fcn.00404654
push ebx
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x4c], 0xf
call fcn.00403957
call fcn.004012cd
mov dword [ebp - 4], 4
cmp edi, ebx
je 0x412f81
push ebx
lea eax, [ebp - 0xdc]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x90], esp
push 0xa
push 0x4491e4
call fcn.004081ed
lea edi, [ebp - 0x1e8]
call fcn.00427366
mov byte [ebp - 4], 7
call fcn.004273d9
mov byte [ebp - 4], 8
cmp dword [eax + 0x18], 0x10
jb 0x412e99
mov eax, dword [eax + 4]
jmp 0x412e9c
add eax, 4
push eax
lea ecx, [ebp - 0x2c]
call fcn.00403193
push eax
push 0x100
lea eax, [ebp - 0x48]
push eax
sub esp, 0x1c
mov byte [ebp - 4], 9
mov esi, esp
mov dword [ebp - 0x90], esp
push 0xc
push str.GO
call fcn.004081ed
lea edi, [ebp - 0x18c]
call fcn.00427366
push eax
mov byte [ebp - 4], 0xa
call fcn.00427738
mov byte [ebp - 4], 0xb
cmp dword [eax + 0x18], 0x10
jb 0x412eee
mov eax, dword [eax + 4]
jmp 0x412ef1
add eax, 4
lea ecx, [ebp - 0x8c]
push ecx
mov ebx, eax
call fcn.004184b7
mov ebx, dword [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0xc
call fcn.0041a0f2
add esp, 0xc
push 0xffffffffffffffff
xor edi, edi
push edi
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xd
call fcn.004034e3
xor ebx, ebx
push edi
inc ebx
push ebx
lea ecx, [ebp - 0x80]
call fcn.004035bd
lea eax, [ebp - 0x8c]
push eax
mov byte [ebp - 4], 0xb
call fcn.00418545
push edi
push ebx
lea ecx, [ebp - 0x48]
call fcn.004035bd
lea esi, [ebp - 0x18c]
call fcn.00404654
push edi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004035bd
push edi
push ebx
lea ecx, [ebp - 0xdc]
call fcn.004035bd
lea esi, [ebp - 0x1e8]
mov byte [ebp - 4], 4
call fcn.00404654
xor ebx, ebx
mov edi, dword [ebp - 0xa0]
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
mov ecx, 0x8c
cdq
idiv ecx
mov dword [ebp - 0x88], ebx
test eax, eax
jbe 0x413242
push dword [ebp - 0x88]
mov eax, edi
call fcn.0041809f
cmp dword [eax + 0x74], 0xffffffff
je 0x413222
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
shr esi, 0x18
call fcn.0042a8e7
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x412fde
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call fcn.0040b4a9
lea eax, [ebp - 0x81]
mov byte [ebp - 0x81], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x412fed
sub eax, edx
je 0x412ffd
call fcn.0040c095
mov esi, dword [ebp - 0x98]
push dword [ebp - 0x88]
add esi, 0x2c0
mov eax, edi
mov dword [ebp - 0x90], esi
call fcn.0041809f
push dword [eax + 0x74]
mov eax, esi
call fcn.0041800c
add eax, 0x1c
cmp dword [eax + 0x14], ebx
je 0x413127
push dword [ebp - 0x88]
mov eax, edi
call fcn.0041809f
push dword [eax + 0x74]
mov eax, esi
call fcn.0041800c
add eax, 0x1c
push eax
lea ecx, [ebp - 0x2c]
call fcn.004031b5
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x41307f
lea edi, [eax - 1]
lea eax, [ebp - 0x2c]
call fcn.004082f1
cmp byte [eax], 0x5c
je 0x41307f
xor ebx, ebx
push 0x5c
inc ebx
lea edi, [ebp - 0x2c]
call fcn.004085fd
xor ebx, ebx
mov edi, dword [ebp - 0xa0]
push dword [ebp - 0x88]
mov eax, edi
call fcn.0041809f
push 0xffffffffffffffff
add eax, 0x3c
push ebx
lea esi, [ebp - 0x2c]
call fcn.00408559
call fcn.004295cd
call fcn.004295cd
mov eax, dword [ebp - 0xa4]
push 0x10
pop esi
mov dword [ebp - 4], 0xe
cmp dword [eax + 0x18], esi
jb 0x4130c4
mov eax, dword [eax + 4]
jmp 0x4130c7
add eax, 4
mov ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x4130d2
lea ecx, [ebp - 0x28]
push eax
push ecx
call fcn.00428ed2
pop ecx
pop ecx
test eax, eax
je 0x4132ee
cmp dword [ebp - 0x9c], ebx
je 0x413112
mov ecx, dword [ebp - 0x60]
cmp dword [ebp - 0x4c], esi
jae 0x4130f6
lea ecx, [ebp - 0x60]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x413101
lea eax, [ebp - 0x28]
push ecx
push eax
call fcn.00428ed2
pop ecx
pop ecx
test eax, eax
je 0x4132ee
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.004035bd
mov esi, dword [ebp - 0x90]
push dword [ebp - 0x88]
mov eax, edi
call fcn.0041809f
push dword [eax + 0x74]
mov eax, esi
call fcn.0041800c
cmp dword [eax + 0x14], ebx
je 0x413222
push dword [ebp - 0x88]
mov eax, edi
call fcn.0041809f
push dword [eax + 0x74]
mov eax, esi
call fcn.0041800c
push eax
lea ecx, [ebp - 0x48]
call fcn.004031b5
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x413191
lea edi, [eax - 1]
lea eax, [ebp - 0x48]
call fcn.004082f1
cmp byte [eax], 0x5c
je 0x413191
xor ebx, ebx
push 0x5c
inc ebx
lea edi, [ebp - 0x48]
call fcn.004085fd
xor ebx, ebx
mov edi, dword [ebp - 0xa0]
push dword [ebp - 0x88]
mov eax, edi
call fcn.0041809f
push 0xffffffffffffffff
add eax, 0x3c
push ebx
lea esi, [ebp - 0x48]
call fcn.00408559
mov eax, dword [ebp - 0xa4]
push 0x10
pop esi
cmp dword [eax + 0x18], esi
jb 0x4131c5
mov eax, dword [eax + 4]
jmp 0x4131c8
add eax, 4
mov ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x30], esi
jae 0x4131d3
lea ecx, [ebp - 0x44]
push eax
push ecx
call fcn.00428ed2
pop ecx
pop ecx
test eax, eax
je 0x413309
cmp dword [ebp - 0x9c], ebx
je 0x413213
mov ecx, dword [ebp - 0x60]
cmp dword [ebp - 0x4c], esi
jae 0x4131f7
lea ecx, [ebp - 0x60]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x30], esi
jae 0x413202
lea eax, [ebp - 0x44]
push ecx
push eax
call fcn.00428ed2
pop ecx
pop ecx
test eax, eax
je 0x41330e
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 4
call fcn.004035bd
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
mov ecx, 0x8c
cdq
idiv ecx
inc dword [ebp - 0x88]
cmp dword [ebp - 0x88], eax
jb 0x412fa3
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
mov ecx, 0x8c
cdq
idiv ecx
mov dword [ebp - 0x88], ebx
test eax, eax
jbe 0x413643
push dword [ebp - 0x88]
mov eax, edi
call fcn.0041809f
add eax, 0x58
cmp dword [eax + 0x14], ebx
je 0x413623
push dword [ebp - 0x88]
mov eax, edi
call fcn.0041809f
sub esp, 0x1c
add eax, 0x58
mov ecx, esp
mov dword [ebp - 0x90], esp
push eax
call fcn.004031b5
push dword [ebp - 0x98]
call fcn.0040e40f
cmp eax, ebx
jl 0x413623
call fcn.004295cd
cdq
push 0xa
pop ecx
idiv ecx
mov esi, edx
call fcn.004295cd
cdq
push 0xa
pop ecx
idiv ecx
cmp esi, edx
setl al
cmp al, bl
je 0x41332d
movzx eax, al
mov dword [ebp - 0x90], eax
fild dword [ebp - 0x90]
call fcn.004397d0
fstp dword [ebp - 0x90]
fld dword [ebp - 0x90]
jmp 0x413340
lea ecx, [ebp - 0x2c]
push ebx
push 1
call fcn.004035bd
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.004035bd
jmp 0x412d86
lea ecx, [ebp - 0x48]
jmp 0x4132f1
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.004035bd
xor esi, esi
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.004035bd
mov eax, esi
jmp 0x412cc3
fldz
call fcn.004396a0
fstp dword [ebp - 0x90]
fld dword [ebp - 0x90]
call fcn.004398c0
dec eax
jne 0x413352
call fcn.0040b793
call fcn.0040b80f
mov esi, dword [ebp - 0x98]
mov eax, dword [esi + 0x17c]
cmp eax, ebx
je 0x413382
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x41364d
push 0x7d0
mov dword [esi + 0x17c], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esi + 0x180]
cmp dword [eax + 0x18], 0x10
jb 0x413393
mov eax, dword [eax + 4]
jmp 0x413396
add eax, 4
push eax
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [esi + 0x17c], eax
cmp eax, ebx
jne 0x4136cf
xor eax, eax
mov dword [ebp - 0x20], ebx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x81]
mov byte [ebp - 0x81], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4133cb
sub eax, edx
je 0x4133e8
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
push 0x40
lea eax, [ebp - 0x1d4]
push ebx
push eax
mov dword [ebp - 0x1d8], ebx
call fcn.00431920
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x1ac], 1
mov word [ebp - 0x1a8], ax
call fcn.00401219
test eax, eax
je 0x413426
call fcn.0040b852
call fcn.00426054
lea eax, [ebp - 0xdc]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x90], esp
push 3
push 0x449250
call fcn.004081ed
lea edi, [ebp - 0x18c]
call fcn.00427366
mov byte [ebp - 4], 0x16
call fcn.004273d9
mov byte [ebp - 4], 0x17
cmp dword [eax + 0x18], 0x10
jb 0x413467
mov eax, dword [eax + 4]
jmp 0x41346a
add eax, 4
push eax
mov eax, dword [ebp - 0xa0]
push ecx
push dword [ebp - 0x88]
call fcn.0041809f
add eax, 0x58
add esp, 4
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00419f21
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0xdc]
call fcn.004035bd
lea esi, [ebp - 0x18c]
call fcn.00404654
call fcn.0040965a
mov dword [ebp - 4], 0x1a
cmp dword [ebp - 0x68], 0x10
mov eax, dword [ebp - 0x7c]
jae 0x4134c1
lea eax, [ebp - 0x7c]
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x1d8]
push ecx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x2710
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x9c], eax
call edi
mov esi, eax
push ebx
shr esi, 0x18
call fcn.0042a8e7
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x41351d
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call fcn.0040b8ab
cmp dword [ebp - 0x9c], 0x102
jne 0x413711
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x98]
call fcn.0040eca6
call edi
mov esi, eax
push ebx
shr esi, 0x18
call fcn.0042a8e7
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x41357d
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call fcn.0040b974
call fcn.0041f338
call fcn.00401270
dec eax
jne 0x41358f
call fcn.0040ba6c
call fcn.0040baf2
cmp dword [ebp - 0x68], 0x10
mov eax, dword [ebp - 0x7c]
jae 0x41359b
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0xc0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x90], esp
push 0x22
push 0x449284
call fcn.004081ed
lea edi, [ebp - 0x134]
call fcn.00427366
mov byte [ebp - 4], 0x1f
call fcn.00427666
mov byte [ebp - 4], 0x20
cmp dword [eax + 0x18], 0x10
jb 0x4135dd
mov eax, dword [eax + 4]
jmp 0x4135e0
add eax, 4
mov ebx, dword [ebp - 0x98]
push eax
push 1
call fcn.0040eded
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0xc0]
call fcn.004035bd
lea esi, [ebp - 0x134]
call fcn.00404654
push 0
push 1
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 4
call fcn.004035bd
mov edi, dword [ebp - 0xa0]
xor ebx, ebx
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
mov ecx, 0x8c
cdq
idiv ecx
inc dword [ebp - 0x88]
cmp dword [ebp - 0x88], eax
jb 0x41325e
mov esi, 0x80004005
jmp 0x41331b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x90], esp
push 0x26
push 0x449200
call fcn.004081ed
lea edi, [ebp - 0x134]
call fcn.00427366
mov byte [ebp - 4], 0x12
call fcn.00427546
mov byte [ebp - 4], 0x13
cmp dword [eax + 0x18], 0x10
jb 0x413695
mov eax, dword [eax + 4]
jmp 0x413698
add eax, 4
mov ebx, dword [ebp - 0x98]
push eax
push 1
call fcn.0040eded
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0xc0]
call fcn.004035bd
lea esi, [ebp - 0x134]
call fcn.00404654
mov esi, 0x80004005
xor ebx, ebx
jmp 0x41331b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x90], esp
push 0x25
push 0x449228
call fcn.004081ed
lea edi, [ebp - 0x134]
call fcn.00427366
mov byte [ebp - 4], 0x14
call fcn.00427666
mov byte [ebp - 4], 0x15
jmp 0x41368a
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
push dword [ebp - 0x9c]
lea eax, [ebp - 0xc0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x90], esp
push 0x2f
push str.3DRTSN
call fcn.004081ed
lea edi, [ebp - 0x134]
call fcn.00427366
mov byte [ebp - 4], 0x1d
call fcn.00427666
mov byte [ebp - 4], 0x1e
cmp dword [eax + 0x18], 0x10
jb 0x413772
mov eax, dword [eax + 4]
jmp 0x413775
add eax, 4
mov ebx, dword [ebp - 0x98]
push eax
push 1
call fcn.0040eded
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0xc0]
call fcn.004035bd
lea esi, [ebp - 0x134]
call fcn.00404654
push 0
push 1
lea ecx, [ebp - 0x80]
call fcn.004035bd
jmp 0x4136c3