Function at 0x402000
Capabilities:
Check if file exists
Check mutex on windows
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1b58
call fcn.00412a90
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1b54], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [esp + 0x158], ax
lea eax, [esp + 0x15a]
push eax
call fcn.0040eb10
add esp, 0xc
lea eax, [esp + 0x150]
push 0
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.inf.dat
lea eax, [esp + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x150]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4023c4
mov ecx, dword [ebp + 8]
xor esi, esi
mov dword [esp + 0x14], 0x34333231
mov dword [esp + 0x18], 0x373635
test ecx, ecx
je 0x4020d2
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4020a0
sub ecx, edx
sar ecx, 1
cmp ecx, 5
jne 0x4020bd
mov byte [esp + 0x19], al
jmp 0x40215b
cmp ecx, 6
je 0x402220
mov eax, 7
xor esi, esi
cmp ecx, eax
cmove esi, eax
push 0x7ff
lea eax, [esp + 0xb5d]
mov dword [esp + 0xc], 0
push 0
push eax
mov byte [esp + 0xb64], 0
call fcn.0040eb10
add esp, 8
mov dword [esp + 0x10], 0
lea eax, [esp + 0xb5c]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00402e20
cmp dword [esp + 0xc], 0
jne 0x4023c4
push ecx
lea eax, [esp + 0xb5c]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004032e0
cmp dword [esp + 0xc], 0
jne 0x4023c4
call fcn.00402d50
test eax, eax
jne 0x4023c4
test esi, esi
jne 0x402220
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [esp + 0x1c], 0x540041
mov word [esp + 0x44], ax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
mov dword [esp + 0x2c], 0x3a004c
mov dword [esp + 0x30], 0x4c0043
mov dword [esp + 0x34], 0x530041
mov dword [esp + 0x38], 0x4e0053
mov dword [esp + 0x3c], 0x4d0041
mov dword [esp + 0x40], 0x410045
mov dword [esp + 0x44], 0x540053
mov dword [esp + 0x48], 0x490050
mov dword [esp + 0x4c], 0x50004d
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4023c4
push 0x103
lea eax, [esp + 0x4d]
mov byte [esp + 0x4c], 0
push 0
push eax
call fcn.0040eb10
add esp, 0xc
lea eax, [esp + 0x48]
push 0x104
push eax
push dword [0x54ed90]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.00401f70
test eax, eax
je 0x4023c4
xor eax, eax
push 0x3fe
push eax
mov word [esp + 0x360], ax
lea eax, [esp + 0x362]
push eax
call fcn.0040eb10
add esp, 0xc
xor eax, eax
mov word [esp + 0x758], ax
push 0x3fe
push eax
lea eax, [esp + 0x762]
push eax
call fcn.0040eb10
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4023c4
lea eax, [esp + 0x358]
push eax
push dword [esp + 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [esp + 0x358]
push eax
lea eax, [esp + 0x75c]
push 0x200
push eax
call fcn.00407905
add esp, 0xc
lea ecx, [esp + 0x358]
call fcn.00401d40
lea eax, [esp + 8]
mov dword [esp + 8], 0x5c
push eax
lea ecx, [esp + 0x20]
call fcn.004023e0
xor eax, eax
push 0x3fe
push eax
mov word [esp + 0x1760], ax
lea eax, [esp + 0x1762]
push eax
call fcn.0040eb10
add esp, 0xc
xor eax, eax
mov word [esp + 0x1358], ax
push 0x3fe
push eax
lea eax, [esp + 0x1362]
push eax
call fcn.0040eb10
add esp, 0xc
xor eax, eax
mov word [esp + 0xb58], ax
push 0x3fe
push eax
lea eax, [esp + 0xb62]
push eax
call fcn.0040eb10
add esp, 0xc
lea eax, [esp + 0x1c]
cmp dword [esp + 0x30], 8
cmovae eax, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x175c]
push 0x200
push eax
call fcn.00407905
add esp, 0xc
lea eax, [esp + 0x1c]
cmp dword [esp + 0x30], 8
cmovae eax, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x135c]
push 0x200
push eax
call fcn.00407905
add esp, 0xc
lea eax, [esp + 0x1c]
cmp dword [esp + 0x30], 8
cmovae eax, dword [esp + 0x1c]
push eax
lea eax, [esp + 0xb5c]
push 0x200
push eax
call fcn.00407905
add esp, 0xc
cmp dword [esp + 0x30], 8
jb 0x4023a7
push dword [esp + 0x1c]
call fcn.0040772a
add esp, 4
lea eax, [esp + 0x150]
push eax
lea eax, [esp + 0x35c]
push eax
lea eax, [esp + 0x760]
push eax
call fcn.00401490
mov ecx, dword [esp + 0x1b5c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0040767f
mov esp, ebp
pop ebp
ret 4