Function at 0x401000
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1045c
call fcn.00423670
mov dword [0x471850], 0x19721972
mov dword [0x471858], 0x19721972
mov dword [0x47185c], 0x19721972
mov eax, dword [0x471850]
push eax
call fcn.00418110
add esp, 4
test eax, eax
jne 0x401045
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.00423520
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [0x47cd54]
test eax, eax
jne 0x401084
push 0
call dword [0x47cd58]
call fcn.00409c90
call fcn.0041c1e0
cmp eax, 1
jne 0x40109d
mov dword [0x47b1f4], 1
lea ecx, [ebp - 0x41c]
push ecx
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
call dword [0x47cd24]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x3c4], 0xc
mov dword [ebp - 0x3c0], 0
mov dword [ebp - 0x3bc], 1
push str.D3B45D38_1B23_4345_A3C5_609A2AC25E0C
push 0
lea edx, [ebp - 0x3c4]
push edx
call dword [0x47cd28]
mov dword [0x47b1fc], eax
cmp dword [0x47b1fc], 0
jne 0x4010fb
push 0
call dword [0x47cd58]
cmp dword [0x472e30], 1
jne 0x401109
call fcn.00412680
call fcn.0040b860
cmp eax, 1
jne 0x401199
push str.AFC26BD8_7F1F_4767_B674_083EFB629307
push 0
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0x47b1f8], eax
cmp dword [0x47b1f8], 0
jne 0x40113f
push 0
call dword [0x47cd88]
mov dword [ebp - 0x420], 0
push str.3A541B9B_5359_4973_80C8_9EAED1B71F55
push 0
push 0x100002
call dword [0x47cd80]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jne 0x401172
push 0
call dword [0x47cd88]
mov eax, dword [ebp - 0x420]
push eax
call dword [0x47cd84]
mov ecx, dword [ebp - 0x420]
push ecx
call dword [0x47cd34]
call fcn.0041bb20
push 0
call dword [0x47cd88]
call fcn.004100a0
test eax, eax
jne 0x4011aa
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x3f8], 0
push str.BC977083_B54B_496F_B111_D1059657BE4E
push 0
push 0x100000
call dword [0x47cd1c]
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0
je 0x4011ea
mov edx, dword [ebp - 0x3f8]
push edx
call dword [0x47cd34]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.BC977083_B54B_496F_B111_D1059657BE4E
push 1
push 0
call dword [0x47cd28]
test eax, eax
jne 0x401205
push 0
call dword [0x47cd58]
cmp dword [0x472e38], 1
jne 0x40126e
cmp dword [0x47cc00], 0
jne 0x40126e
call fcn.0041c3a0
test eax, eax
jne 0x40126e
call fcn.0041c090
cmp eax, 0xa
jb 0x40126e
call fcn.0041c1e0
cmp eax, 1
jne 0x401252
lea eax, [ebp - 0x218]
push eax
call fcn.00401c80
add esp, 4
cmp eax, 1
jne 0x401250
push 0
call dword [0x47cd58]
jmp 0x40126e
lea ecx, [ebp - 0x218]
push ecx
call fcn.00401c80
add esp, 4
cmp eax, 1
jne 0x40126e
push 0
call dword [0x47cd58]
cmp dword [0x47186c], 1
jne 0x4012d3
cmp dword [0x47cc04], 0
jne 0x4012d3
call fcn.0041c090
cmp eax, 0xa
jb 0x4012d3
call fcn.0041c3a0
cmp eax, 1
jne 0x4012d3
push 0x471874
mov edx, dword [0x471870]
push edx
call fcn.00416410
add esp, 8
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
je 0x4012d3
mov eax, dword [ebp - 0x424]
push eax
call fcn.00416870
add esp, 4
mov ecx, dword [ebp - 0x424]
push ecx
call dword [0x47cd48]
push str.FDC39EE8_A427_4E47_876F_01FCF8947FA4
push 1
push 0
call dword [0x47cd28]
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0
jne 0x4012f9
push 0
call dword [0x47cd58]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40130e
push 0
call dword [0x47cd58]
push str.6CE5B42A_8E4A_4BA0_8118_0F5FE557E4CC
push 1
push 0
call dword [0x47cd28]
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 0
jne 0x401334
push 0
call dword [0x47cd58]
push str.6CE5B42A_8E4A_4BA0_8118_0F5FE557E4CC
call fcn.0041c4b0
add esp, 4
push str.AFC26BD8_7F1F_4767_B674_083EFB629307
push 0
push 1
push 0
call dword [0x47cd4c]
mov dword [0x47b1f8], eax
cmp dword [0x47b1f8], 0
jne 0x401368
push 0
call dword [0x47cd58]
push str.AFC26BD8_7F1F_4767_B674_083EFB629307
call fcn.0041c4b0
add esp, 4
cmp dword [0x471440], 1
jne 0x401543
push 0x7fff
lea edx, [ebp - 0x10428]
push edx
push 0
call dword [0x47cd54]
test eax, eax
je 0x40153b
push 0x5c
lea eax, [ebp - 0x10428]
push eax
call fcn.00401c60
add esp, 8
xor ecx, ecx
mov word [eax], cx
lea edx, [ebp - 0x1042c]
push edx
push 0x471178
call fcn.0040fe20
add esp, 8
mov dword [ebp - 0x10430], eax
cmp dword [ebp - 0x10430], 0
je 0x401531
push 0x5c
mov eax, dword [ebp - 0x10430]
push eax
call fcn.00401c60
add esp, 8
xor ecx, ecx
mov word [eax], cx
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 0x10434], eax
cmp dword [ebp - 0x10434], 0
je 0x401522
mov edx, dword [ebp - 0x10434]
push edx
push 0x7fff
call dword [0x47cd94]
test eax, eax
je 0x40150d
push 0x5c
mov eax, dword [ebp - 0x10434]
push eax
call fcn.00401c60
add esp, 8
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebp - 0x10430]
push edx
lea eax, [ebp - 0x10428]
push eax
call dword [0x47cea0]
test eax, eax
je 0x40150b
mov ecx, dword [ebp - 0x10434]
push ecx
lea edx, [ebp - 0x10428]
push edx
call dword [0x47cea0]
test eax, eax
je 0x40150b
call dword [0x47cd20]
mov dword [ebp - 0x10440], eax
lea eax, [ebp - 0x10438]
push eax
mov ecx, dword [ebp - 0x10440]
push ecx
call dword [0x47d104]
mov dword [ebp - 0x1043c], eax
push str.416B5F5F_DD34_41A9_BE8F_ADA1B1DCF1AA
mov edx, dword [ebp - 0x1043c]
mov eax, dword [edx + 4]
push eax
call dword [0x47cea0]
test eax, eax
je 0x40150b
push str.26800E08_F8E1_4F0D_98DD_C4EDE27A81D8
mov ecx, dword [ebp - 0x1043c]
mov edx, dword [ecx + 4]
push edx
call dword [0x47cea0]
test eax, eax
je 0x40150b
push str.A5CAAFEA_0928_496C_94C1_6EFFB85C4F35
mov eax, dword [ebp - 0x1043c]
mov ecx, dword [eax + 4]
push ecx
call dword [0x47cea0]
test eax, eax
je 0x40150b
push 1
push 0x471444
push 0x47150e
push 0
call dword [0x47ced4]
cmp eax, 2
jne 0x40150b
push 0
call dword [0x47cd58]
jmp 0x401515
push 0
call dword [0x47cd58]
mov edx, dword [ebp - 0x10434]
push edx
call dword [0x47cd48]
mov eax, dword [ebp - 0x10430]
push eax
call dword [0x47cd48]
jmp 0x401539
push 0
call dword [0x47cd58]
jmp 0x401543
push 0
call dword [0x47cd58]
lea ecx, [ebp - 0x3b8]
push ecx
push 2
call dword [0x47d1c0]
test eax, eax
je 0x40155e
push 0
call dword [0x47cd58]
call fcn.0040fa30
test eax, eax
jne 0x40156f
push 0
call dword [0x47cd58]
call fcn.00417600
test eax, eax
jne 0x401580
push 0
call dword [0x47cd58]
call fcn.004141e0
test eax, eax
jne 0x401591
push 0
call dword [0x47cd58]
call fcn.004142a0
test eax, eax
jne 0x4015a2
push 0
call dword [0x47cd58]
call fcn.004143d0
test eax, eax
jne 0x4015b3
push 0
call dword [0x47cd58]
cmp dword [0x471778], 0
jne 0x4015d5
push 0x471178
call fcn.0040fad0
add esp, 4
test eax, eax
jne 0x4015d5
push 0
call dword [0x47cd58]
push 0x471178
call fcn.0040ff10
add esp, 4
test eax, eax
jne 0x4015ee
push 0
call dword [0x47cd58]
cmp dword [0x471778], 0
jne 0x401612
cmp dword [0x472e24], 1
jne 0x401612
call fcn.00412920
cmp eax, 1
jne 0x401612
push 0
call dword [0x47cd58]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x3fc], 0
cmp dword [0x47b1f4], 1
jne 0x40165a
lea edx, [ebp - 0x224]
push edx
push 0x43c040
call fcn.0041cd20
add esp, 8
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0
jne 0x40165a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x40167e
push 0
call dword [0x47cd58]
push 0x7fff
mov eax, dword [ebp - 0x220]
push eax
call dword [0x47cd7c]
test eax, eax
jne 0x40169c
push 0
call dword [0x47cd58]
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x4016c0
push 0
call dword [0x47cd58]
push 0x7fff
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [0x47cdb8]
test eax, eax
jne 0x4016de
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4016fc
push 0
call dword [0x47cd58]
mov edx, dword [ebp - 0x220]
push edx
push 0x4322f8
push 0x7fff
mov eax, dword [ebp - 8]
push eax
call fcn.0042359a
add esp, 0x10
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0
jne 0x40173d
push 0
call dword [0x47cd58]
mov ecx, dword [ebp - 0x21c]
push ecx
push 0x432318
push 0x7fff
mov edx, dword [ebp - 0x3f0]
push edx
call fcn.0042359a
add esp, 0x10
push 0xfffe
push 0x40
call dword [0x47cd3c]
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0
jne 0x401781
push 0
call dword [0x47cd58]
mov eax, dword [ebp - 0x21c]
push eax
push 0x432338
push 0x7fff
mov ecx, dword [ebp - 0x3cc]
push ecx
call fcn.0042359a
add esp, 0x10
mov dword [ebp - 0x3c8], 0
mov dword [ebp - 0x418], 0
xor edx, edx
mov dword [ebp - 0x414], edx
mov dword [ebp - 0x410], edx
mov dword [ebp - 0x3e8], 0
xor eax, eax
mov dword [ebp - 0x3e4], eax
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 0x40c], 0
xor ecx, ecx
mov dword [ebp - 0x408], ecx
mov dword [ebp - 0x404], ecx
cmp dword [0x479c68], 1
jne 0x40183d
mov edx, dword [ebp - 0x3c8]
mov eax, dword [ebp - 8]
mov dword [ebp + edx*4 - 0x418], eax
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp + ecx*4 - 0x3e8], 0
mov edx, dword [ebp - 0x3c8]
mov dword [ebp + edx*4 - 0x40c], 1
mov eax, dword [ebp - 0x3c8]
add eax, 1
mov dword [ebp - 0x3c8], eax
cmp dword [0x479c64], 1
jne 0x40188a
mov ecx, dword [ebp - 0x3c8]
mov edx, dword [ebp - 0x3f0]
mov dword [ebp + ecx*4 - 0x418], edx
mov eax, dword [ebp - 0x3c8]
mov dword [ebp + eax*4 - 0x3e8], 1
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp + ecx*4 - 0x40c], 1
mov edx, dword [ebp - 0x3c8]
add edx, 1
mov dword [ebp - 0x3c8], edx
cmp dword [0x479c6c], 1
jne 0x4018d7
mov eax, dword [ebp - 0x3c8]
mov ecx, dword [ebp - 0x3cc]
mov dword [ebp + eax*4 - 0x418], ecx
mov edx, dword [ebp - 0x3c8]
mov dword [ebp + edx*4 - 0x3e8], 2
mov eax, dword [ebp - 0x3c8]
mov dword [ebp + eax*4 - 0x40c], 1
mov ecx, dword [ebp - 0x3c8]
add ecx, 1
mov dword [ebp - 0x3c8], ecx
mov edx, dword [ebp - 0x3c8]
mov dword [ebp - 0x400], edx
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x401c14
mov dword [ebp - 0x10444], 0
jmp 0x40190f
mov eax, dword [ebp - 0x10444]
add eax, 1
mov dword [ebp - 0x10444], eax
mov ecx, dword [ebp - 0x10444]
cmp ecx, dword [ebp - 0x400]
jge 0x401c0f
cmp dword [0x47b1f4], 0
jne 0x40195d
lea edx, [ebp - 0x3dc]
push edx
mov eax, dword [ebp - 0x10444]
mov ecx, dword [ebp + eax*4 - 0x40c]
push ecx
mov edx, dword [ebp - 0x10444]
mov eax, dword [ebp + edx*4 - 0x418]
push eax
call fcn.00410ca0
add esp, 0xc
mov dword [ebp - 0x10448], eax
jmp 0x40199f
lea ecx, [ebp - 0x3dc]
push ecx
push str.3A541B9B_5359_4973_80C8_9EAED1B71F55
mov edx, dword [0x463460]
push edx
push 0x463468
mov eax, dword [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x3fc]
push ecx
mov edx, dword [ebp - 0x10444]
mov eax, dword [ebp + edx*4 - 0x418]
push eax
call fcn.004138d0
add esp, 0x1c
mov dword [ebp - 0x10448], eax
cmp dword [ebp - 0x10448], 1
jne 0x401bff
cmp dword [0x471778], 1
jne 0x401b3f
mov ecx, dword [ebp - 0x10444]
cmp dword [ebp + ecx*4 - 0x3e8], 1
jne 0x401a37
push 0
mov edx, dword [ebp - 0x3dc]
push edx
call dword [0x47cd5c]
cmp eax, 0x102
jne 0x401a37
push str.82344416_2289_4D6D_922D_61ED2C5C510B
push 0
push 0x100000
call dword [0x47cd1c]
mov dword [ebp - 0x10454], eax
cmp dword [ebp - 0x10454], 0
jne 0x401a21
push 0xa
mov eax, dword [0x47b1f8]
push eax
call dword [0x47cd5c]
cmp eax, 0x102
je 0x401a1f
jmp 0x401c14
jmp 0x4019c9
cmp dword [ebp - 0x10454], 0
je 0x401a37
mov ecx, dword [ebp - 0x10454]
push ecx
call dword [0x47cd34]
mov edx, dword [ebp - 0x10444]
cmp dword [ebp + edx*4 - 0x3e8], 0
jne 0x401ab6
push 0
mov eax, dword [ebp - 0x3dc]
push eax
call dword [0x47cd5c]
cmp eax, 0x102
jne 0x401ab6
push str.56FBE35C_A431_4558_BF67_B99D67DBF59A
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x10458], eax
cmp dword [ebp - 0x10458], 0
jne 0x401aa0
push 0xa
mov ecx, dword [0x47b1f8]
push ecx
call dword [0x47cd5c]
cmp eax, 0x102
je 0x401a9e
jmp 0x401c14
jmp 0x401a47
cmp dword [ebp - 0x10458], 0
je 0x401ab6
mov edx, dword [ebp - 0x10458]
push edx
call dword [0x47cd34]
mov eax, dword [ebp - 0x10444]
cmp dword [ebp + eax*4 - 0x3e8], 2
jne 0x401b35
push 0
mov ecx, dword [ebp - 0x3dc]
push ecx
call dword [0x47cd5c]
cmp eax, 0x102
jne 0x401b35
push str.588084B7_C878_4009_B915_D8ED1ABD48CC
push 0
push 0x100000
call dword [0x47cd1c]
mov dword [ebp - 0x1045c], eax
cmp dword [ebp - 0x1045c], 0
jne 0x401b1f
push 0xa
mov edx, dword [0x47b1f8]
push edx
call dword [0x47cd5c]
cmp eax, 0x102
je 0x401b1d
jmp 0x401c14
jmp 0x401ac6
cmp dword [ebp - 0x1045c], 0
je 0x401b35
mov eax, dword [ebp - 0x1045c]
push eax
call dword [0x47cd34]
jmp 0x401c14
mov dword [ebp - 0x10450], 0
xor ecx, ecx
mov dword [ebp - 0x1044c], ecx
mov edx, dword [0x47b1f8]
mov dword [ebp - 0x10450], edx
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x1044c], eax
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x10450]
push ecx
push 2
call dword [0x47cda4]
push 0
mov edx, dword [0x47b1f8]
push edx
call dword [0x47cd5c]
cmp eax, 0x102
je 0x401b9b
mov dword [ebp - 4], 0
jmp 0x401c0f
cmp dword [ebp - 0x3dc], 0
je 0x401bb3
push 0
mov eax, dword [ebp - 0x3dc]
push eax
call dword [0x47cd68]
cmp dword [ebp - 0x3dc], 0
je 0x401bc9
mov ecx, dword [ebp - 0x3dc]
push ecx
call dword [0x47cd34]
cmp dword [ebp - 0x3d8], 0
je 0x401bdf
mov edx, dword [ebp - 0x3d8]
push edx
call dword [0x47cd34]
push 0x10
push 0
lea eax, [ebp - 0x3dc]
push eax
call fcn.00423520
add esp, 0xc
push 0x3e8
call dword [0x47cdbc]
jmp 0x401c0a
push 0x3e8
call dword [0x47cdbc]
jmp 0x401900
jmp 0x4018ea
call fcn.0040fac0
cmp dword [0x479c60], 1
jne 0x401c31
push 0xffffffffffffffff
mov ecx, dword [0x47cc78]
push ecx
call dword [0x47cd5c]
call fcn.0041c1e0
cmp eax, 1
jne 0x401c48
lea edx, [ebp - 0x41c]
push edx
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push 0
call dword [0x47cd58]
mov esp, ebp
pop ebp
ret 0x10