Function at 0x10acd38
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create pipe
Query environment variable
Read file on windows
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x10b1058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or dword [ebp - 0x138], 0xffffffff
or dword [ebp - 0x134], 0xffffffff
push ebx
mov ebx, dword [eax + 8]
push esi
mov esi, dword [eax]
push edi
push 0x10a6358
push 0x10a61f4
push 0xffffffffffffffff
lea eax, [ebp - 0x12c]
xor edi, edi
push 0x22
push eax
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x13c], 0x200
mov dword [ebp - 0x148], edi
mov dword [ebp - 0x130], edi
call fcn.010a937f
add esp, 0x14
lea eax, [ebp - 0x12c]
push eax
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
mov dword [ebp - 0x150], edi
je 0x10ad457
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10ad457
cmp dword [0x10b9254], 0
jne 0x10acde9
call fcn.010aba0d
mov eax, dword [ebp - 0x140]
test eax, eax
mov dword [0x10b9250], esi
je 0x10acdfe
cmp byte [eax], 0
jne 0x10ace22
push 0x10a5d8c
call dword [sym.imp.msvcrt.dll_getenv]
test eax, eax
pop ecx
mov dword [ebp - 0x140], eax
jne 0x10ace22
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffffe
jmp 0x10ad459
test esi, esi
je 0x10ad449
test ebx, ebx
je 0x10ad449
mov eax, dword [0x10b9324]
xor ebx, ebx
test eax, eax
je 0x10ace4e
push ebx
call eax
cmp eax, 0x102
jne 0x10ace4e
push 0xfffffffffffffff7
jmp 0x10ad44b
push 0x10a6348
push 0x10a633c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [0x10b925c], eax
je 0x10ace82
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x10b925c]
push ebx
push ebx
mov eax, 0x1000
push eax
push eax
push 1
push 6
push 0x40000003
push 0x10a6320
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, 0xffffffff
mov dword [0x10b8ca0], eax
jne 0x10aceb1
push 0xfffffffffffffff5
pop edi
jmp 0x10ad3cd
xor eax, eax
lea edi, [ebp - 0x1a8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
push ebx
stosd dword es:[edi], eax
push 1
push ebx
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [ebp - 0x138], eax
je 0x10acea9
mov edi, dword [ebp - 0x140]
cmp edi, ebx
mov dword [ebp - 0x198], eax
jne 0x10acee7
xor eax, eax
jmp 0x10acef5
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10aceec
sub eax, edx
inc eax
mov esi, 0x104
cmp eax, esi
jae 0x10acf18
cmp edi, ebx
jne 0x10acf07
xor eax, eax
jmp 0x10acf15
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10acf0c
sub eax, edx
inc eax
jmp 0x10acf1a
mov eax, esi
push eax
lea eax, [ebp - 0x108]
push edi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp edi, ebx
jne 0x10acf33
xor eax, eax
jmp 0x10acf41
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10acf38
sub eax, edx
inc eax
cmp eax, esi
jae 0x10acf5f
cmp edi, ebx
jne 0x10acf4e
xor eax, eax
jmp 0x10acf5c
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10acf53
sub eax, edx
inc eax
jmp 0x10acf61
mov eax, esi
cmp dword [ebp - 0x148], ebx
mov byte [ebp + eax - 0x109], 0
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
je 0x10acfb1
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10acf7a
sub eax, edx
mov esi, 0x103
mov edx, esi
push 0x13
sub edx, eax
pop ecx
cmp edx, ecx
ja 0x10acfa9
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10acf9c
sub eax, edx
mov ecx, esi
sub ecx, eax
push ecx
push 0x10a630c
jmp 0x10acfe6
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10acfb1
sub eax, edx
mov esi, 0x103
mov edx, esi
push 0x13
sub edx, eax
pop ecx
cmp edx, ecx
ja 0x10acfe0
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10acfd3
sub eax, edx
mov ecx, esi
sub ecx, eax
push ecx
push 0x10a62f8
mov ebx, dword [sym.imp.msvcrt.dll_strncat]
lea eax, [ebp - 0x108]
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call fcn.010aacc8
cmp eax, 0xffffffff
jne 0x10ad010
push 0xfffffffffffffffb
jmp 0x10aceab
xor edi, edi
cmp dword [0x10b92fc], edi
mov dword [0x10b9258], edi
jne 0x10ad025
call fcn.010aaf50
mov eax, dword [0x10b9300]
cmp eax, edi
jne 0x10ad04a
push 0x10a6248
push 0x10a6240
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10b9300], eax
cmp dword [0x10b92fc], 5
jl 0x10ad11a
cmp eax, edi
je 0x10ad11a
call eax
test eax, eax
jne 0x10ad11a
cmp dword [ebp - 0x148], edi
mov dword [ebp - 0x18c], 0x3c
mov dword [ebp - 0x188], 0x40
mov dword [ebp - 0x184], edi
mov dword [ebp - 0x180], 0x10a62f0
mov dword [ebp - 0x17c], 0x1010858
jne 0x10ad0a9
mov dword [ebp - 0x17c], 0x101086c
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x174], eax
lea eax, [ebp - 0x18c]
mov dword [ebp - 0x164], edi
mov dword [ebp - 0x170], edi
mov dword [ebp - 0x16c], edi
xor esi, esi
call fcn.010aad56
test eax, eax
jne 0x10ad0ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
sub eax, edi
je 0x10ad10f
dec eax
dec eax
je 0x10ad009
sub eax, 0x4c5
je 0x10ad108
push 0xfffffffffffffff1
jmp 0x10aceab
push 0xfffffffffffffff2
jmp 0x10aceab
mov eax, dword [ebp - 0x154]
jmp 0x10ad22e
push 0x44
pop edi
push edi
lea eax, [ebp - 0x194]
push 0
push eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x194], edi
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x1b8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x108]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10ad14a
sub eax, ecx
mov edx, esi
push 2
sub edx, eax
pop ecx
cmp edx, ecx
ja 0x10ad174
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10ad167
sub eax, edx
mov ecx, esi
sub ecx, eax
push ecx
lea eax, [ebp - 0x108]
push 0x1001914
push eax
call ebx
mov eax, dword [ebp - 0x144]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10ad18f
sub eax, ecx
mov ecx, eax
lea eax, [ebp - 0x108]
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10ad1a3
sub eax, edi
mov edx, esi
sub edx, eax
inc ecx
cmp ecx, edx
jae 0x10ad1cc
mov eax, dword [ebp - 0x144]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10ad1be
sub eax, edx
lea ecx, [eax + 1]
jmp 0x10ad1e2
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10ad1d5
sub eax, edx
mov ecx, esi
sub ecx, eax
push ecx
push dword [ebp - 0x144]
lea eax, [ebp - 0x108]
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x1b8]
push eax
push dword [ebp - 0x140]
xor eax, eax
push eax
push 0x8000000
push eax
push eax
push eax
lea ecx, [ebp - 0x108]
push ecx
push eax
lea eax, [ebp - 0x194]
call fcn.010aae4c
test eax, eax
je 0x10ad101
mov eax, dword [ebp - 0x1b8]
push 0x200
mov dword [ebp - 0x134], eax
xor edi, edi
xor ebx, ebx
call dword [sym.imp.msvcrt.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 0x130], eax
je 0x10acea9
mov esi, dword [ebp - 0x13c]
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x130]
sub esi, ebx
push esi
add eax, ebx
push eax
push dword [0x10b8ca0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10ad29c
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x130]
xor ebx, ebx
call fcn.010acbbb
mov edi, eax
jmp 0x10ad37f
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x6d
je 0x10ad396
sub eax, 0x7d
je 0x10ad352
sub eax, 0x12e
je 0x10ad389
sub eax, 0x1cd
jne 0x10ad252
push dword [0x10b8c9c]
push eax
lea eax, [ebp - 0x138]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
sub eax, 0
je 0x10ad307
dec eax
je 0x10ad3bd
sub eax, 0x101
jne 0x10ad252
push eax
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xfffffffffffffff9
jmp 0x10aceab
push 0
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x1a8]
push eax
push dword [0x10b8ca0]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x10ad33e
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x130]
call fcn.010acbbb
mov edi, eax
xor ebx, ebx
jmp 0x10ad37f
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x6d
je 0x10ad396
sub eax, 0x7d
jne 0x10ad252
mov eax, dword [ebp - 0x13c]
add eax, eax
push eax
push dword [ebp - 0x130]
mov dword [ebp - 0x13c], eax
call dword [sym.imp.msvcrt.dll_realloc]
test eax, eax
pop ecx
pop ecx
je 0x10acea9
add ebx, esi
mov dword [ebp - 0x130], eax
test edi, edi
je 0x10ad252
jmp 0x10ad3cd
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10ad252
push dword [0x10b8c9c]
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10ad3bd
push 0
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [0x10b9258]
neg edi
sbb edi, edi
and edi, 7
add edi, 0xfffffff9
call fcn.010af6bc
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x10b9250], 0
cmp dword [ebp - 0x130], 0
je 0x10ad3f6
push dword [ebp - 0x130]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
or ebx, 0xffffffff
cmp dword [ebp - 0x138], ebx
je 0x10ad415
push dword [ebp - 0x138]
call esi
mov dword [ebp - 0x138], ebx
cmp dword [ebp - 0x134], ebx
je 0x10ad42b
push dword [ebp - 0x134]
call esi
mov dword [ebp - 0x134], ebx
mov eax, dword [0x10b8ca0]
cmp eax, ebx
je 0x10ad43d
push eax
call esi
mov dword [0x10b8ca0], ebx
push dword [ebp - 0x150]
call esi
mov eax, edi
jmp 0x10ad45a
push 0xfffffffffffffffe
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x10ad45a
push 0xfffffffffffffffa
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010a919f
leave
ret 4