Function at 0x10020407
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push 0x3ec
mov eax, 0x10054ec0
call fcn.100269ae
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov dword [ebp - 4], 1
push eax
call fcn.1001ae8a
pop ecx
xor ebx, ebx
lea esi, [eax + 0x10]
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10097940], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1002045f
push esi
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x10097940], eax
jmp 0x10020474
cmp eax, 0xb7
jne 0x10020474
push 0xffffffffffffffff
push dword [0x10097940]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x10097940], ebx
lea ecx, [esi - 0x10]
sete bl
call fcn.1001ee1f
mov byte [edi + 0x2c], bl
test bl, bl
jne 0x10020b97
mov dword [ebp - 0x3e0], 0x77637945
mov dword [ebp - 0x3dc], 0x4d49544a
mov dword [ebp - 0x3d8], 0x6d6b544f
mov dword [ebp - 0x3d4], 0x69527a47
mov dword [ebp - 0x3d0], 0x30675462
mov dword [ebp - 0x3cc], 0x4951784f
mov dword [ebp - 0x3c8], 0x57515143
mov dword [ebp - 0x3c4], 0x346b584a
mov dword [ebp - 0x3c0], 0x4c557741
mov dword [ebp - 0x3bc], 0x65307948
mov dword [ebp - 0x3b8], 0x67497945
mov dword [ebp - 0x3b4], 0x2f4e4459
mov dword [ebp - 0x3b0], 0x79645446
mov dword [ebp - 0x3ac], 0x6e77684e
mov dword [ebp - 0x3a8], 0x6f454144
mov dword [ebp - 0x3a4], 0x33457950
mov dword [ebp - 0x3a0], 0x4b414450
mov dword [ebp - 0x39c], 0x50675149
mov dword [ebp - 0x398], 0x51514444
mov dword [ebp - 0x394], 0x426f6845
mov dword [ebp - 0x390], 0x7338684b
mov dword [ebp - 0x38c], 0x5a6f5241
mov dword [ebp - 0x388], 0x306c5243
mov dword [ebp - 0x384], 0x6e63434d
mov dword [ebp - 0x380], 0x75645341
mov dword [ebp - 0x37c], 0x75676a4a
mov dword [ebp - 0x378], 0x4763414c
mov dword [ebp - 0x374], 0x776c7948
mov dword [ebp - 0x370], 0x38496842
mov dword [ebp - 0x36c], 0x58597a48
mov dword [ebp - 0x368], 0x66456d4e
mov dword [ebp - 0x364], 0x6c384746
mov dword [ebp - 0x360], 0x334d694f
mov dword [ebp - 0x35c], 0x7a38334d
mov dword [ebp - 0x358], 0x33427a46
mov dword [ebp - 0x354], 0x4e63444d
mov dword [ebp - 0x350], 0x5745684f
mov dword [ebp - 0x34c], 0x4f636a50
mov dword [ebp - 0x348], 0x57417941
mov dword [ebp - 0x344], 0x4b454146
mov dword [ebp - 0x340], 0x765a7863
mov dword [ebp - 0x33c], 0x774d4361
mov dword [ebp - 0x338], 0x45596759
mov dword [ebp - 0x334], 0x74305848
mov dword [ebp - 0x330], 0x4e346944
mov dword [ebp - 0x32c], 0x7946784c
mov dword [ebp - 0x328], 0x6c49524e
mov dword [ebp - 0x324], 0x77565444
mov dword [ebp - 0x320], 0x52735448
mov dword [ebp - 0x31c], 0x4430684e
mov dword [ebp - 0x318], 0x51307a42
mov dword [ebp - 0x314], 0x3445444e
mov dword [ebp - 0x310], 0x79455249
mov dword [ebp - 0x30c], 0x4534584c
mov dword [ebp - 0x308], 0x45635445
mov dword [ebp - 0x304], 0x496b7865
mov dword [ebp - 0x300], 0x2b67794e
mov dword [ebp - 0x2fc], 0x366f5366
mov dword [ebp - 0x2f8], 0x3945434a
mov dword [ebp - 0x2f4], 0x396b584e
mov dword [ebp - 0x2f0], 0x72304749
mov dword [ebp - 0x2ec], 0x2b4e6947
mov dword [ebp - 0x2e8], 0x61675243
mov dword [ebp - 0x2e4], 0x44677759
mov dword [ebp - 0x2e0], 0x4563674d
mov dword [ebp - 0x2dc], 0x77566a45
mov dword [ebp - 0x2d8], 0x6f355243
mov dword [ebp - 0x2d4], 0x4a455864
mov dword [ebp - 0x2d0], 0x73316e47
mov dword [ebp - 0x2cc], 0x756f784d
mov dword [ebp - 0x2c8], 0x304d4743
mov dword [ebp - 0x2c4], 0x63417a4e
mov dword [ebp - 0x2c0], 0x36685861
mov dword [ebp - 0x2bc], 0x52347a4e
mov dword [ebp - 0x2b8], 0x754d6945
mov dword [ebp - 0x2b4], 0x41414141
mov word [ebp - 0x2b0], 0x4132
mov dword [ebp - 0x2ac], 0x72417a44
mov dword [ebp - 0x2a8], 0x6d497a50
mov dword [ebp - 0x2a4], 0x74643259
mov dword [ebp - 0x2a0], 0x3449434d
xor ebx, ebx
mov dword [ebp - 0x29c], 0x49675448
push ebx
sub esp, 0xc
mov byte [ebp - 0x21c], bl
mov ecx, esp
mov dword [ebp - 0x298], 0x39414347
lea eax, [ebp - 0x2ae]
mov dword [ebp - 0x294], 0x6e6c784c
mov dword [ebp - 0x290], 0x52454242
push dword [ebp - 0x21c]
mov dword [ebp - 0x28c], 0x76744861
push eax
mov dword [ebp - 0x288], 0x37386e59
lea eax, [ebp - 0x3e0]
mov dword [ebp - 0x284], 0x41594346
mov dword [ebp - 0x280], 0x4f34545a
mov dword [ebp - 0x27c], 0x365a414b
mov dword [ebp - 0x278], 0x746c6a5a
mov dword [ebp - 0x274], 0x754e3242
mov dword [ebp - 0x270], 0x70414245
mov dword [ebp - 0x26c], 0x7941515a
mov dword [ebp - 0x268], 0x68494465
mov dword [ebp - 0x264], 0x72496747
mov dword [ebp - 0x260], 0x35306841
mov dword [ebp - 0x25c], 0x54414143
mov dword [ebp - 0x258], 0x376b7a48
mov dword [ebp - 0x254], 0x4e497859
mov dword [ebp - 0x250], 0x376b774d
mov dword [ebp - 0x24c], 0x756b6850
mov dword [ebp - 0x248], 0x666b6750
mov dword [ebp - 0x244], 0x61456a47
mov dword [ebp - 0x240], 0x3749524f
mov dword [ebp - 0x23c], 0x4941774e
mov dword [ebp - 0x238], 0x6130525a
mov dword [ebp - 0x234], 0x746b7a47
mov dword [ebp - 0x230], 0x59345361
mov dword [ebp - 0x22c], 0x496b7846
mov dword [ebp - 0x228], 0x41414141
mov word [ebp - 0x224], 0x7756
push eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.10017d43
lea eax, [ebp - 0x3ec]
push eax
call fcn.1001b0c3
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.100242fc
push eax
push ebx
sub esp, 0xc
mov byte [ebp - 0x21c], bl
mov ecx, esp
lea eax, [ebp - 0x222]
push dword [ebp - 0x21c]
mov dword [ecx], ebx
push eax
lea eax, [ebp - 0x2ac]
mov dword [ecx + 4], ebx
push eax
mov dword [ecx + 8], ebx
call fcn.10017d43
lea eax, [ebp - 0x3f8]
push eax
call fcn.1001b1fc
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.10024345
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100976dc], eax
lea ecx, [ebp - 0x3f8]
call fcn.100241c5
lea ecx, [ebp - 0x3ec]
mov byte [ebp - 4], 1
call fcn.10024142
cmp dword [0x100976dc], ebx
je 0x10020b97
push 0x1001cabe
push 0x100976dc
call fcn.10025b9e
pop ecx
pop ecx
test eax, eax
je 0x10020b97
push dword [ebp + 8]
mov byte [edi + 0x2d], 1
mov dword [0x10097938], 1
call fcn.10020d2d
pop ecx
push eax
push dword [ebp + 8]
mov ecx, 0x10097700
call fcn.10020c07
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [0x1009793c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x10097948], eax
test eax, eax
je 0x10020a28
mov byte [edi + 0x2e], 1
push dword [ebp + 0xc]
mov byte [ebp - 0x21c], bl
lea eax, [ebp - 0x225]
push ebx
sub esp, 0xc
mov dword [ebp - 0x270], 0x326b7a41
mov ecx, esp
mov dword [ebp - 0x26c], 0x6d597a4d
mov dword [ebp - 0x268], 0x77414844
mov dword [ebp - 0x264], 0x63737943
push dword [ebp - 0x21c]
mov dword [ebp - 0x260], 0x49736a45
push eax
mov dword [ebp - 0x25c], 0x334d6a44
lea eax, [ebp - 0x270]
mov dword [ebp - 0x258], 0x37557a47
mov dword [ebp - 0x254], 0x4d51794f
mov dword [ebp - 0x250], 0x7649434a
mov dword [ebp - 0x24c], 0x5838585a
mov dword [ebp - 0x248], 0x47304246
mov dword [ebp - 0x244], 0x38686759
mov dword [ebp - 0x240], 0x6c556d47
mov dword [ebp - 0x23c], 0x6e5a6a4c
mov dword [ebp - 0x238], 0x4a493243
mov dword [ebp - 0x234], 0x6d775142
mov dword [ebp - 0x230], 0x6f4a7849
mov dword [ebp - 0x22c], 0x41417749
mov word [ebp - 0x228], 0x4341
mov byte [ebp - 0x226], 0x6b
push eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.10017d43
lea eax, [ebp - 0x3ec]
push eax
call fcn.1001b1fc
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.10024345
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.1001b580
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3ec]
call fcn.100241c5
push dword [ebp + 0xc]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x10097944], eax
test eax, eax
je 0x10020b6e
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x100233cb
lea ecx, [ebp - 0x220]
call fcn.100179ee
push eax
mov ecx, 0x100976f0
call fcn.10023ca3
cmp dword [ebp - 0x21c], 0
je 0x10020b97
call fcn.100314ca
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.1001ee1f
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.1001ee1f
call fcn.10026958
ret