Function at 0x401000
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1045c
call fcn.00422250
mov dword [0x47e470], 0x19721972
mov dword [0x47e478], 0x19721972
mov dword [0x47e47c], 0x19721972
mov eax, dword [0x47e470]
push eax
call fcn.00416bd0
add esp, 4
test eax, eax
jne 0x401045
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.00422100
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [0x4894a4]
test eax, eax
jne 0x401084
push 0
call dword [0x4894a8]
call fcn.0041ae20
cmp eax, 1
jne 0x401098
mov dword [0x4879b4], 1
lea ecx, [ebp - 0x41c]
push ecx
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
call dword [0x489474]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x3c4], 0xc
mov dword [ebp - 0x3c0], 0
mov dword [ebp - 0x3bc], 1
push str.31D30930_9B3D_4AD9_844F_A7CFF0E81621
push 0
lea edx, [ebp - 0x3c4]
push edx
call dword [0x489478]
mov dword [0x4879bc], eax
cmp dword [0x4879bc], 0
jne 0x4010f6
push 0
call dword [0x4894a8]
cmp dword [0x47fa4c], 1
jne 0x401104
call fcn.00410090
call fcn.004092a0
cmp eax, 1
jne 0x401194
push str.391EAFAB_3073_4462_884F_506799524CBC
push 0
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0x4879b8], eax
cmp dword [0x4879b8], 0
jne 0x40113a
push 0
call dword [0x4894d8]
mov dword [ebp - 0x420], 0
push str.1793FE49_EE15_41C3_84A5_95040079F16D
push 0
push 0x100002
call dword [0x4894d0]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jne 0x40116d
push 0
call dword [0x4894d8]
mov eax, dword [ebp - 0x420]
push eax
call dword [0x4894d4]
mov ecx, dword [ebp - 0x420]
push ecx
call dword [0x489484]
call fcn.0041a780
push 0
call dword [0x4894d8]
call fcn.0040dab0
test eax, eax
jne 0x4011a5
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x3f8], 0
push str.76505A24_1781_4194_B805_5B2DFAFECAD9
push 0
push 0x100000
call dword [0x48946c]
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0
je 0x4011e5
mov edx, dword [ebp - 0x3f8]
push edx
call dword [0x489484]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.76505A24_1781_4194_B805_5B2DFAFECAD9
push 1
push 0
call dword [0x489478]
test eax, eax
jne 0x401200
push 0
call dword [0x4894a8]
cmp dword [0x47fa54], 1
jne 0x401269
cmp dword [0x489350], 0
jne 0x401269
call fcn.0041afe0
test eax, eax
jne 0x401269
call fcn.0041acd0
cmp eax, 0xa
jb 0x401269
call fcn.0041ae20
cmp eax, 1
jne 0x40124d
lea eax, [ebp - 0x218]
push eax
call fcn.00412370
add esp, 4
cmp eax, 1
jne 0x40124b
push 0
call dword [0x4894a8]
jmp 0x401269
lea ecx, [ebp - 0x218]
push ecx
call fcn.00410cc0
add esp, 4
cmp eax, 1
jne 0x401269
push 0
call dword [0x4894a8]
cmp dword [0x47e488], 1
jne 0x4012ce
cmp dword [0x489354], 0
jne 0x4012ce
call fcn.0041acd0
cmp eax, 0xa
jb 0x4012ce
call fcn.0041afe0
cmp eax, 1
jne 0x4012ce
push 0x47e490
mov edx, dword [0x47e48c]
push edx
call fcn.00414ed0
add esp, 8
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
je 0x4012ce
mov eax, dword [ebp - 0x424]
push eax
call fcn.00415330
add esp, 4
mov ecx, dword [ebp - 0x424]
push ecx
call dword [0x489498]
push str.D12F915B_4E1B_44B8_B237_00F72AE9B6F6
push 1
push 0
call dword [0x489478]
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0
jne 0x4012f4
push 0
call dword [0x4894a8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401309
push 0
call dword [0x4894a8]
push str.5ECF2A6B_4A8F_4B6A_BDB9_785A1A800BAC
push 1
push 0
call dword [0x489478]
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 0
jne 0x40132f
push 0
call dword [0x4894a8]
push str.5ECF2A6B_4A8F_4B6A_BDB9_785A1A800BAC
call fcn.0041b0f0
add esp, 4
push str.391EAFAB_3073_4462_884F_506799524CBC
push 0
push 1
push 0
call dword [0x48949c]
mov dword [0x4879b8], eax
cmp dword [0x4879b8], 0
jne 0x401363
push 0
call dword [0x4894a8]
push str.391EAFAB_3073_4462_884F_506799524CBC
call fcn.0041b0f0
add esp, 4
cmp dword [0x47e060], 1
jne 0x40153e
push 0x7fff
lea edx, [ebp - 0x10428]
push edx
push 0
call dword [0x4894a4]
test eax, eax
je 0x401536
push 0x5c
lea eax, [ebp - 0x10428]
push eax
call fcn.00401c60
add esp, 8
xor ecx, ecx
mov word [eax], cx
lea edx, [ebp - 0x1042c]
push edx
push 0x47dd98
call fcn.0040d830
add esp, 8
mov dword [ebp - 0x10430], eax
cmp dword [ebp - 0x10430], 0
je 0x40152c
push 0x5c
mov eax, dword [ebp - 0x10430]
push eax
call fcn.00401c60
add esp, 8
xor ecx, ecx
mov word [eax], cx
push 0xfffe
push 0x40
call dword [0x48948c]
mov dword [ebp - 0x10434], eax
cmp dword [ebp - 0x10434], 0
je 0x40151d
mov edx, dword [ebp - 0x10434]
push edx
push 0x7fff
call dword [0x4894e4]
test eax, eax
je 0x401508
push 0x5c
mov eax, dword [ebp - 0x10434]
push eax
call fcn.00401c60
add esp, 8
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebp - 0x10430]
push edx
lea eax, [ebp - 0x10428]
push eax
call dword [0x4895f0]
test eax, eax
je 0x401506
mov ecx, dword [ebp - 0x10434]
push ecx
lea edx, [ebp - 0x10428]
push edx
call dword [0x4895f0]
test eax, eax
je 0x401506
call dword [0x489470]
mov dword [ebp - 0x10440], eax
lea eax, [ebp - 0x10438]
push eax
mov ecx, dword [ebp - 0x10440]
push ecx
call dword [0x489848]
mov dword [ebp - 0x1043c], eax
push str.C25D36F1_6820_4F09_9C7B_2A8961215D50
mov edx, dword [ebp - 0x1043c]
mov eax, dword [edx + 4]
push eax
call dword [0x4895f0]
test eax, eax
je 0x401506
push str.1EF80AF7_80F6_4E3C_B031_528457C2B6CF
mov ecx, dword [ebp - 0x1043c]
mov edx, dword [ecx + 4]
push edx
call dword [0x4895f0]
test eax, eax
je 0x401506
push str.7ADD09C7_69D5_46D4_8A6E_21AF4109BC40
mov eax, dword [ebp - 0x1043c]
mov ecx, dword [eax + 4]
push ecx
call dword [0x4895f0]
test eax, eax
je 0x401506
push 1
push 0x47e064
push 0x47e12e
push 0
call dword [0x48961c]
cmp eax, 2
jne 0x401506
push 0
call dword [0x4894a8]
jmp 0x401510
push 0
call dword [0x4894a8]
mov edx, dword [ebp - 0x10434]
push edx
call dword [0x489498]
mov eax, dword [ebp - 0x10430]
push eax
call dword [0x489498]
jmp 0x401534
push 0
call dword [0x4894a8]
jmp 0x40153e
push 0
call dword [0x4894a8]
lea ecx, [ebp - 0x3b8]
push ecx
push 2
call dword [0x4898fc]
test eax, eax
je 0x401559
push 0
call dword [0x4894a8]
call fcn.0040d440
test eax, eax
jne 0x40156a
push 0
call dword [0x4894a8]
call fcn.004160c0
test eax, eax
jne 0x40157b
push 0
call dword [0x4894a8]
call fcn.00412ca0
test eax, eax
jne 0x40158c
push 0
call dword [0x4894a8]
call fcn.00412d60
test eax, eax
jne 0x40159d
push 0
call dword [0x4894a8]
call fcn.00412e90
test eax, eax
jne 0x4015ae
push 0
call dword [0x4894a8]
cmp dword [0x47e398], 0
jne 0x4015d0
push 0x47dd98
call fcn.0040d4e0
add esp, 4
test eax, eax
jne 0x4015d0
push 0
call dword [0x4894a8]
push 0x47dd98
call fcn.0040d920
add esp, 4
test eax, eax
jne 0x4015e9
push 0
call dword [0x4894a8]
cmp dword [0x47e398], 0
jne 0x40160d
cmp dword [0x47fa40], 1
jne 0x40160d
call fcn.00410330
cmp eax, 1
jne 0x40160d
push 0
call dword [0x4894a8]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x3fc], 0
cmp dword [0x4879b4], 1
jne 0x401655
lea edx, [ebp - 0x224]
push edx
push 0x43a008
call fcn.0041b960
add esp, 8
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0
jne 0x401655
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xfffe
push 0x40
call dword [0x48948c]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x401679
push 0
call dword [0x4894a8]
push 0x7fff
mov eax, dword [ebp - 0x220]
push eax
call dword [0x4894cc]
test eax, eax
jne 0x401697
push 0
call dword [0x4894a8]
push 0xfffe
push 0x40
call dword [0x48948c]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x4016bb
push 0
call dword [0x4894a8]
push 0x7fff
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [0x489508]
test eax, eax
jne 0x4016d9
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xfffe
push 0x40
call dword [0x48948c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4016f7
push 0
call dword [0x4894a8]
mov edx, dword [ebp - 0x220]
push edx
push 0x4312f8
push 0x7fff
mov eax, dword [ebp - 8]
push eax
call fcn.0042217a
add esp, 0x10
push 0xfffe
push 0x40
call dword [0x48948c]
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0
jne 0x401738
push 0
call dword [0x4894a8]
mov ecx, dword [ebp - 0x21c]
push ecx
push 0x431318
push 0x7fff
mov edx, dword [ebp - 0x3f0]
push edx
call fcn.0042217a
add esp, 0x10
push 0xfffe
push 0x40
call dword [0x48948c]
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0
jne 0x40177c
push 0
call dword [0x4894a8]
mov eax, dword [ebp - 0x21c]
push eax
push 0x431338
push 0x7fff
mov ecx, dword [ebp - 0x3cc]
push ecx
call fcn.0042217a
add esp, 0x10
mov dword [ebp - 0x3c8], 0
mov dword [ebp - 0x418], 0
xor edx, edx
mov dword [ebp - 0x414], edx
mov dword [ebp - 0x410], edx
mov dword [ebp - 0x3e8], 0
xor eax, eax
mov dword [ebp - 0x3e4], eax
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 0x40c], 0
xor ecx, ecx
mov dword [ebp - 0x408], ecx
mov dword [ebp - 0x404], ecx
cmp dword [0x486458], 1
jne 0x401838
mov edx, dword [ebp - 0x3c8]
mov eax, dword [ebp - 8]
mov dword [ebp + edx*4 - 0x418], eax
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp + ecx*4 - 0x3e8], 0
mov edx, dword [ebp - 0x3c8]
mov dword [ebp + edx*4 - 0x40c], 1
mov eax, dword [ebp - 0x3c8]
add eax, 1
mov dword [ebp - 0x3c8], eax
cmp dword [0x486454], 1
jne 0x401885
mov ecx, dword [ebp - 0x3c8]
mov edx, dword [ebp - 0x3f0]
mov dword [ebp + ecx*4 - 0x418], edx
mov eax, dword [ebp - 0x3c8]
mov dword [ebp + eax*4 - 0x3e8], 1
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp + ecx*4 - 0x40c], 1
mov edx, dword [ebp - 0x3c8]
add edx, 1
mov dword [ebp - 0x3c8], edx
cmp dword [0x48645c], 1
jne 0x4018d2
mov eax, dword [ebp - 0x3c8]
mov ecx, dword [ebp - 0x3cc]
mov dword [ebp + eax*4 - 0x418], ecx
mov edx, dword [ebp - 0x3c8]
mov dword [ebp + edx*4 - 0x3e8], 2
mov eax, dword [ebp - 0x3c8]
mov dword [ebp + eax*4 - 0x40c], 1
mov ecx, dword [ebp - 0x3c8]
add ecx, 1
mov dword [ebp - 0x3c8], ecx
mov edx, dword [ebp - 0x3c8]
mov dword [ebp - 0x400], edx
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x401c0f
mov dword [ebp - 0x10444], 0
jmp 0x40190a
mov eax, dword [ebp - 0x10444]
add eax, 1
mov dword [ebp - 0x10444], eax
mov ecx, dword [ebp - 0x10444]
cmp ecx, dword [ebp - 0x400]
jge 0x401c0a
cmp dword [0x4879b4], 0
jne 0x401958
lea edx, [ebp - 0x3dc]
push edx
mov eax, dword [ebp - 0x10444]
mov ecx, dword [ebp + eax*4 - 0x40c]
push ecx
mov edx, dword [ebp - 0x10444]
mov eax, dword [ebp + edx*4 - 0x418]
push eax
call fcn.0040e6b0
add esp, 0xc
mov dword [ebp - 0x10448], eax
jmp 0x40199a
lea ecx, [ebp - 0x3dc]
push ecx
push str.1793FE49_EE15_41C3_84A5_95040079F16D
mov edx, dword [0x468928]
push edx
push 0x468930
mov eax, dword [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x3fc]
push ecx
mov edx, dword [ebp - 0x10444]
mov eax, dword [ebp + edx*4 - 0x418]
push eax
call fcn.00411ac0
add esp, 0x1c
mov dword [ebp - 0x10448], eax
cmp dword [ebp - 0x10448], 1
jne 0x401bfa
cmp dword [0x47e398], 1
jne 0x401b3a
mov ecx, dword [ebp - 0x10444]
cmp dword [ebp + ecx*4 - 0x3e8], 1
jne 0x401a32
push 0
mov edx, dword [ebp - 0x3dc]
push edx
call dword [0x4894ac]
cmp eax, 0x102
jne 0x401a32
push str.E4E30697_AC48_4D6B_93FA_2C91A842EFF8
push 0
push 0x100000
call dword [0x48946c]
mov dword [ebp - 0x10454], eax
cmp dword [ebp - 0x10454], 0
jne 0x401a1c
push 0xa
mov eax, dword [0x4879b8]
push eax
call dword [0x4894ac]
cmp eax, 0x102
je 0x401a1a
jmp 0x401c0f
jmp 0x4019c4
cmp dword [ebp - 0x10454], 0
je 0x401a32
mov ecx, dword [ebp - 0x10454]
push ecx
call dword [0x489484]
mov edx, dword [ebp - 0x10444]
cmp dword [ebp + edx*4 - 0x3e8], 0
jne 0x401ab1
push 0
mov eax, dword [ebp - 0x3dc]
push eax
call dword [0x4894ac]
cmp eax, 0x102
jne 0x401ab1
push str.04B1D95E_91AB_46F8_9624_3460A802495B
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x10458], eax
cmp dword [ebp - 0x10458], 0
jne 0x401a9b
push 0xa
mov ecx, dword [0x4879b8]
push ecx
call dword [0x4894ac]
cmp eax, 0x102
je 0x401a99
jmp 0x401c0f
jmp 0x401a42
cmp dword [ebp - 0x10458], 0
je 0x401ab1
mov edx, dword [ebp - 0x10458]
push edx
call dword [0x489484]
mov eax, dword [ebp - 0x10444]
cmp dword [ebp + eax*4 - 0x3e8], 2
jne 0x401b30
push 0
mov ecx, dword [ebp - 0x3dc]
push ecx
call dword [0x4894ac]
cmp eax, 0x102
jne 0x401b30
push str.48892A61_9EBE_4B54_BDD6_F7009288A224
push 0
push 0x100000
call dword [0x48946c]
mov dword [ebp - 0x1045c], eax
cmp dword [ebp - 0x1045c], 0
jne 0x401b1a
push 0xa
mov edx, dword [0x4879b8]
push edx
call dword [0x4894ac]
cmp eax, 0x102
je 0x401b18
jmp 0x401c0f
jmp 0x401ac1
cmp dword [ebp - 0x1045c], 0
je 0x401b30
mov eax, dword [ebp - 0x1045c]
push eax
call dword [0x489484]
jmp 0x401c0f
mov dword [ebp - 0x10450], 0
xor ecx, ecx
mov dword [ebp - 0x1044c], ecx
mov edx, dword [0x4879b8]
mov dword [ebp - 0x10450], edx
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x1044c], eax
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x10450]
push ecx
push 2
call dword [0x4894f4]
push 0
mov edx, dword [0x4879b8]
push edx
call dword [0x4894ac]
cmp eax, 0x102
je 0x401b96
mov dword [ebp - 4], 0
jmp 0x401c0a
cmp dword [ebp - 0x3dc], 0
je 0x401bae
push 0
mov eax, dword [ebp - 0x3dc]
push eax
call dword [0x4894b8]
cmp dword [ebp - 0x3dc], 0
je 0x401bc4
mov ecx, dword [ebp - 0x3dc]
push ecx
call dword [0x489484]
cmp dword [ebp - 0x3d8], 0
je 0x401bda
mov edx, dword [ebp - 0x3d8]
push edx
call dword [0x489484]
push 0x10
push 0
lea eax, [ebp - 0x3dc]
push eax
call fcn.00422100
add esp, 0xc
push 0x3e8
call dword [0x48950c]
jmp 0x401c05
push 0x3e8
call dword [0x48950c]
jmp 0x4018fb
jmp 0x4018e5
call fcn.0040d4d0
cmp dword [0x486450], 1
jne 0x401c2c
push 0xffffffffffffffff
mov ecx, dword [0x4893c8]
push ecx
call dword [0x4894ac]
call fcn.0041ae20
cmp eax, 1
jne 0x401c43
lea edx, [ebp - 0x41c]
push edx
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push 0
call dword [0x4894a8]
mov esp, ebp
pop ebp
ret 0x10