Function at 0x40e310
Capabilities:
Accept command line arguments
Check mutex on windows
Check os version
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47b4b1
mov eax, dword fs:[0]
push eax
sub esp, 0x2a0
mov eax, dword [0x496684]
xor eax, esp
mov dword [esp + 0x298], eax
push ebx
push esi
push edi
mov eax, dword [0x496684]
xor eax, esp
push eax
lea eax, [esp + 0x2b0]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2b8], ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push ebx
push 0x40df00
push ebx
push ebx
mov dword [0x499a84], eax
call fcn.0043000f
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, 1
mov dword [esp + 0x20], eax
cmp dword [esp + 0x24], edi
jle 0x40e444
mov edx, dword [esp + 0x20]
mov eax, dword [edx + edi*4]
xor ecx, ecx
mov word [esp + 0x48], cx
mov ecx, eax
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], ebx
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x40e3d5
sub ecx, esi
sar ecx, 1
push ecx
lea ecx, [esp + 0x4c]
call fcn.00405630
mov byte [esp + 0x2b8], 1
lea ecx, [esp + 0x48]
lea ebx, [esp + 0x10]
call fcn.0040ec70
xor ebx, ebx
mov byte [esp + 0x2b8], bl
cmp dword [esp + 0x5c], 8
jb 0x40e420
mov edx, dword [esp + 0x48]
push edx
call fcn.0042ca67
add esp, 4
mov dword [esp + 0x58], ebx
xor eax, eax
inc edi
xor ebx, ebx
mov dword [esp + 0x5c], 7
mov word [esp + 0x48], ax
cmp edi, dword [esp + 0x24]
jl 0x40e3b6
mov esi, dword [esp + 0x28]
push 0x114
lea ecx, [esp + 0xa0]
push ebx
push ecx
call fcn.004316d0
add esp, 0xc
lea edx, [esp + 0x9c]
push edx
mov dword [esp + 0xa0], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xa0], 6
sbb eax, eax
neg eax
jne 0x40e726
push 0x206
lea edx, [esp + 0xa2]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0xa8], cx
call fcn.004316d0
add esp, 0xc
push 0x104
lea eax, [esp + 0xa0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, 7
xor ecx, ecx
lea eax, [esp + 0x9c]
mov dword [esp + 0x78], edi
mov dword [esp + 0x74], ebx
mov word [esp + 0x64], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40e4d7
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0xa0]
lea ecx, [esp + 0x68]
call fcn.00405630
mov byte [esp + 0x2b8], 2
cmp dword [esp + 0x24], 1
jne 0x40e6fc
xor edx, edx
push ebx
mov eax, 0x48b2a8
lea ecx, [esp + 0x4c]
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], ebx
mov word [esp + 0x4c], dx
call fcn.00405630
mov byte [esp + 0x2b8], 3
xor eax, eax
mov word [esp + 0x80], ax
push 0xf
mov eax, 0x48c024
lea ecx, [esp + 0x84]
mov dword [esp + 0x98], edi
mov dword [esp + 0x94], ebx
call fcn.00405630
mov byte [esp + 0x2b8], 4
lea ecx, [esp + 0x80]
lea ebx, [esp + 0x10]
call fcn.0040ec70
mov byte [esp + 0x2b8], 3
mov esi, 8
cmp dword [esp + 0x94], esi
jb 0x40e599
mov ecx, dword [esp + 0x80]
push ecx
call fcn.0042ca67
add esp, 4
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
xor edx, edx
sub ecx, ebx
mov word [esp + 0x80], dx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
xor edi, edi
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x94], 7
mov dword [esp + 0x90], edi
je 0x40e605
mov esi, eax
push edi
push ebx
or eax, 0xffffffff
lea edi, [esp + 0x50]
call fcn.004032a0
push 1
mov eax, 0x488734
mov ecx, edi
call fcn.00403010
add ebx, 0x1c
xor edi, edi
dec esi
jne 0x40e5d8
mov ebx, dword [esp + 0x10]
mov esi, 8
mov ecx, dword [esp + 0x48]
cmp dword [esp + 0x5c], esi
jae 0x40e613
lea ecx, [esp + 0x48]
mov eax, dword [esp + 0x64]
cmp dword [esp + 0x78], esi
jae 0x40e621
lea eax, [esp + 0x64]
push 5
push edi
push ecx
push eax
push str.runas
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [esp + 0x2b8], 2
cmp dword [esp + 0x5c], esi
jb 0x40e64d
mov eax, dword [esp + 0x48]
push eax
call fcn.0042ca67
add esp, 4
xor ecx, ecx
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], edi
mov word [esp + 0x48], cx
mov byte [esp + 0x2b8], cl
cmp dword [esp + 0x78], esi
jb 0x40e67a
mov edx, dword [esp + 0x64]
push edx
call fcn.0042ca67
add esp, 4
xor eax, eax
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], edi
mov word [esp + 0x64], ax
mov dword [esp + 0x2b8], 0xffffffff
cmp ebx, edi
je 0x40e6e6
mov esi, dword [esp + 0x14]
mov edi, ebx
mov ebx, dword [esp + 0x10]
cmp ebx, esi
je 0x40e6db
lea ebx, [ebx]
cmp dword [edi + 0x14], 8
jb 0x40e6c1
mov ecx, dword [edi]
push ecx
call fcn.0042ca67
add esp, 4
xor edx, edx
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], dx
add edi, 0x1c
cmp edi, esi
jne 0x40e6b0
push ebx
call fcn.0042ca67
add esp, 4
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov eax, 1
jmp 0x40e9d1
mov byte [esp + 0x2b8], bl
cmp dword [esp + 0x78], 8
jb 0x40e717
mov eax, dword [esp + 0x64]
push eax
call fcn.0042ca67
add esp, 4
xor ecx, ecx
mov dword [esp + 0x78], edi
mov dword [esp + 0x74], ebx
mov word [esp + 0x64], cx
push str.6C670FFC_A37C_4BDD_9FC2_E328E979591A
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40e7a4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x2b8], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40e79a
mov esi, dword [esp + 0x14]
mov edi, eax
cmp eax, esi
je 0x40e791
cmp dword [edi + 0x14], 8
jb 0x40e77b
mov edx, dword [edi]
push edx
call fcn.0042ca67
mov eax, dword [esp + 0x14]
add esp, 4
xor ecx, ecx
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], ebx
mov word [edi], cx
add edi, 0x1c
cmp edi, esi
jne 0x40e766
push eax
call fcn.0042ca67
add esp, 4
mov eax, 1
jmp 0x40e9c5
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x499860
push 0x67
push esi
call edi
push 0x64
push 0x499798
push 0x6d
push esi
call edi
mov eax, esi
call fcn.0040ea00
push ebx
push esi
push ebx
push ebx
push 0x64
push 0x64
push ebx
push bind
push bind
push 0x499860
push 0x499798
push 0x80000
mov dword [0x499928], esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
cmp edi, ebx
jne 0x40e82b
mov dword [esp + 0x2b8], 0xffffffff
mov esi, dword [esp + 0x10]
cmp esi, ebx
je 0x40e824
mov edi, dword [esp + 0x14]
mov eax, esi
call fcn.0040eef0
push esi
call fcn.0042ca67
add esp, 4
xor eax, eax
jmp 0x40e9c5
test byte [0x499d18], 1
jne 0x40e85c
or dword [0x499d18], 1
mov byte [esp + 0x2b8], 5
call fcn.004140a0
push 0x47b6e0
call fcn.004309d8
add esp, 4
mov byte [esp + 0x2b8], bl
mov ecx, 0x499c60
call fcn.00414370
push 0xd0
call fcn.0042d5e8
add esp, 4
mov dword [esp + 0x20], eax
mov byte [esp + 0x2b8], 6
cmp eax, ebx
je 0x40e88c
push edi
push eax
call fcn.00411ea0
jmp 0x40e88e
xor eax, eax
mov byte [esp + 0x2b8], bl
mov edx, dword [ebp + 0x14]
push edx
push edi
mov dword [0x499794], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [0x499794]
push ebx
call fcn.004130e0
mov eax, dword [0x499794]
push 0x40e2a0
push 0x64
push eax
push edi
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [esp + 0x28]
push 0x6d
push ecx
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push ebx
push ebx
push ebx
lea edx, [esp + 0x38]
push edx
mov esi, eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x40e92e
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x2c]
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x40e91c
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x40e8f1
mov edx, dword [esp + 0x20]
push edx
push edi
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [0x499a84]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x499794]
cmp eax, ebx
je 0x40e95b
mov edx, dword [eax + 0xc]
lea ecx, [eax + 0xc]
mov eax, dword [edx]
push 1
call eax
test byte [0x499d18], 1
jne 0x40e98c
or dword [0x499d18], 1
mov byte [esp + 0x2b8], 7
call fcn.004140a0
push 0x47b6e0
call fcn.004309d8
add esp, 4
mov byte [esp + 0x2b8], bl
mov ecx, 0x499c60
call fcn.00414520
mov esi, dword [esp + 0x34]
mov dword [esp + 0x2b8], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40e9c3
mov edi, dword [esp + 0x14]
call fcn.0040eef0
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0042ca67
add esp, 4
mov eax, esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov ecx, dword [esp + 0x2b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x298]
xor ecx, esp
call fcn.0042ca72
mov esp, ebp
pop ebp
ret 0x10