Function at 0x40686a
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x411934], eax
call fcn.0040907d
call fcn.0040a51a
call fcn.0040a5bc
lea ecx, [esp + 0x38]
call fcn.00407e75
lea ecx, [esp + 0x38]
call fcn.0040a403
xor ebx, ebx
cmp dword [0x411683], ebx
jne 0x406904
lea ecx, [esp + 0x38]
call fcn.0040812a
test eax, eax
je 0x406904
mov dword [esp + 0xc], 0x6141017
mov eax, ebx
mov dword [esp + 0x10], 0x101d7501
mov dword [esp + 0x14], 0x6a1007
xor byte [esp + eax + 0xc], 0x55
inc eax
cmp eax, 0xb
jb 0x4068d3
push ebx
lea eax, [esp + 0x10]
mov byte [esp + 0x1b], bl
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x406904
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00408149
call fcn.0040296f
call fcn.004093f3
mov esi, eax
cmp dword [esi + 0x3643], ebx
je 0x406936
lea ecx, [esp + 0x38]
call fcn.0040812a
test eax, eax
je 0x406936
call fcn.00402cdb
mov ecx, eax
call fcn.004093f9
cmp dword [esi + 0x3647], ebx
je 0x406957
lea ecx, [esp + 0x38]
call fcn.0040812a
test eax, eax
je 0x406957
call fcn.00402cdb
mov ecx, eax
call fcn.00409735
call fcn.00407b9b
call fcn.00409ef8
lea ecx, [esp + 0x38]
call fcn.00408cde
lea ecx, [esp + 0x38]
call fcn.004078e0
mov edx, dword [esi + 0x364b]
lea ecx, [esp + 0x38]
call fcn.0040c468
movaps xmm0, xmmword [0x4020e0]
lea ecx, [esp + 0x1c]
movups xmmword [esp + 0x1c], xmm0
mov dword [esp + 0x2c], 0x55705575
mov dword [esp + 0x30], 0x555526
call fcn.00403cb4
movaps xmm0, xmmword [0x401b90]
lea ecx, [esp + 0xc]
mov edx, eax
movups xmmword [esp + 0xc], xmm0
call fcn.00406bfa
mov ecx, eax
call fcn.00402cdb
mov ebx, eax
push ebx
push edx
push ecx
call fcn.0040d3d8
xor edi, edi
add esp, 0xc
cmp dword [esi + 0x364b], edi
jne 0x406a69
lea ecx, [esp + 0x38]
call fcn.0040812a
test eax, eax
je 0x406a69
cmp dword [esi + 0x3637], edi
je 0x4069fa
call fcn.0040b127
cmp dword [esi + 0x363b], edi
je 0x406a19
call fcn.0040990e
test eax, eax
jne 0x406a19
call fcn.004098b4
test eax, eax
je 0x406a19
call fcn.0040ada5
cmp dword [esi + 0x3633], edi
je 0x406a36
call fcn.0040a7dc
call fcn.004098b4
test eax, eax
je 0x406a36
xor ecx, ecx
call fcn.0040ac06
cmp dword [esi + 0x362f], edi
je 0x406a43
call fcn.0040ac31
cmp dword [esi + 0x3623], edi
je 0x406a54
lea ecx, [esp + 0x38]
call fcn.0040a35d
cmp dword [esi + 0x3627], edi
je 0x406a69
call fcn.00407957
xor ecx, ecx
inc ecx
call fcn.00407ac3
call fcn.00407b08
test eax, eax
je 0x406a83
lea ecx, [esp + 0x38]
call fcn.0040812a
test eax, eax
jne 0x406b6b
cmp dword [esi + 0x363f], edi
jne 0x406ab5
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x55105517
mov dword [esp + 0x10], 0x551c5512
mov dword [esp + 0x14], 0x55551b
call fcn.00406c0d
mov edx, eax
mov ecx, ebx
call fcn.0040a634
call fcn.00408ee1
xor ecx, ecx
inc ecx
call fcn.00408fa9
call fcn.00407b08
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406ae0
call fcn.00409960
push 0x3e8
call edi
call fcn.00407b08
test eax, eax
je 0x406acf
xor eax, eax
mov dword [esp + 0xc], 0x556b5578
push eax
push eax
push 0xf
lea ecx, [esp + 0x18]
mov word [esp + 0x1c], 0x55
call fcn.00403ca1
mov edx, eax
lea ecx, [esp + 0x44]
call fcn.00407eef
add esp, 0xc
jmp 0x406b1e
call fcn.00409960
push 0x3e8
call edi
call fcn.00409005
test eax, eax
je 0x406b12
cmp dword [esi + 0x363f], 0
jne 0x406b52
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x551b5510
mov dword [esp + 0x10], 0x555511
call fcn.00406be7
mov edx, eax
mov ecx, ebx
call fcn.0040a634
xor ebx, ebx
cmp dword [esi + 0x3617], ebx
jne 0x406b6d
cmp dword [esi + 0x361f], ebx
jne 0x406b6d
call fcn.0040a297
jmp 0x406b6d
xor ebx, ebx
cmp dword [esi + 0x364b], ebx
jne 0x406b7e
call fcn.0040d311
test eax, eax
je 0x406bb5
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea edi, [esp + 0x1c]
push 7
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
jmp 0x406ba7
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
jne 0x406b91
lea ecx, [esp + 0x38]
call fcn.00407ede
call fcn.004083aa
call fcn.00402ce1
call fcn.00407d55
call fcn.0040a27f
call fcn.00408e84
call fcn.0040791d
call fcn.0040d25c
push ebx
jmp 0x4068fe