Function at 0x401490
Capabilities:
Check mutex on windows
Create thread
Enumerate threads
Hide graphical window
Inspect load icon resource
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push str.UniqueAppMutexName
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x405450], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4014e4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00401cba
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xorps xmm0, xmm0
push 0x405654
mov dword [esp + 0x18], 0
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x2c], xmm0
movlpd qword [esp + 0x34], xmm0
call esi
push 0x40566c
call esi
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 0x401170
push eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x3c], str.Ran_Online
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x401570
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x405654
call esi
push 0x40566c
call esi
push dword [0x405450]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00401cba
mov esp, ebp
pop ebp
ret 0x10
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Ran_Online
push str.Ran_Online
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
je 0x401539
push 0x1e8
push 0
push 0x40546c
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [0x405458], 0x1fc
mov dword [0x40545c], esi
mov dword [0x405460], 1
mov dword [0x405464], 7
push 0x65
push 0
mov dword [0x405468], 0x8064
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f
push 0x403250
push 0x80
push 0x405470
mov dword [0x40546c], eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
add esp, 0x10
mov byte [0x4054ef], 0
push 0x405458
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push esi
push 0x401410
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x60]
push 0
push eax
call esi
test eax, eax
je 0x401685
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [esp + 0x58]
push eax
call edi
lea eax, [esp + 0x58]
push eax
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x64]
push eax
call esi
test eax, eax
jne 0x401666
push 0x40566c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x405440], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40171b
push 0
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401713
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x401710
nop dword [eax + eax]
push dword [0x405440]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
cmp dword [esp + 0x48], eax
jne 0x401700
push dword [esp + 0x44]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x401700
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call edi
lea eax, [esp + 0x3c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x4016d0
push ebx
call edi
push dword [0x405440]
call edi
push 0x40566c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [esp + 0x10]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call edi
push dword [0x405450]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x405654
call esi
push 0x40566c
call esi
mov ecx, dword [esp + 0x74]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401cba
mov esp, ebp
pop ebp
ret 0x10