Function at 0x662d7b
Capabilities:
Check mutex on windows
Create process on windows
Read file via mapping

Disassembly:
push 0x430
push 0x6d7ee8
call fcn.0066df3b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x3e4], eax
xor ebx, ebx
mov dword [ebp - 0x3c0], ebx
mov dword [ebp - 0x3e0], ebx
xor eax, eax
lea edi, [ebp - 0x3dc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x440], 0x44
push 0x40
push ebx
lea eax, [ebp - 0x43c]
push eax
call fcn.0066e181
mov dword [ebp - 0x3fc], ebx
xor eax, eax
lea edi, [ebp - 0x3f8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x3b0], ebx
mov dword [ebp - 0x3bc], ebx
mov dword [ebp - 0x3b4], ebx
mov dword [ebp - 0x3cc], ebx
mov byte [ebp - 0x19c], bl
push 0x103
push ebx
lea eax, [ebp - 0x19b]
push eax
call fcn.0066e181
add esp, 0x18
mov dword [ebp - 0x3c4], 1
mov dword [ebp - 0x3ac], ebx
push 0x1f
pop ecx
mov esi, 0x4fbda0
lea edi, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
cmp dword [ebp + 0x1c], ebx
je 0x662e81
mov eax, dword [ebp - 0x3a8]
cmp eax, edi
je 0x662e76
cmp dword [eax + 0xc8], edi
je 0x662e76
cmp dword [eax + 0xe8], edi
jne 0x662e81
push edi
push 0x31746b66
jmp 0x6634bd
mov dword [ebp - 0x3e0], 0xc
mov dword [ebp - 0x3d8], 1
push edi
push edi
push edi
lea eax, [ebp - 0x3e0]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
call esi
mov dword [ebp - 0x3bc], eax
cmp eax, edi
je 0x6634c2
xor edi, edi
push edi
push edi
push edi
lea eax, [ebp - 0x3e0]
push eax
call esi
mov dword [ebp - 0x3b0], eax
cmp eax, edi
je 0x6634c2
push edi
push edi
push edi
lea eax, [ebp - 0x3e0]
push eax
call esi
mov dword [ebp - 0x3c8], eax
cmp eax, edi
je 0x6634c2
push edi
push edi
lea eax, [ebp - 0x3e0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x3b4], eax
test eax, eax
je 0x6634c2
push edi
mov edi, 0x9c9c
push edi
push 0
push 4
lea eax, [ebp - 0x3e0]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x3c0], eax
test eax, eax
je 0x6634c2
xor esi, esi
push esi
push esi
push esi
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp - 0x3e8], ebx
cmp ebx, esi
je 0x6634c2
cmp dword [ebp + 0x1c], esi
jne 0x662f76
push 2
push 1
push esi
lea eax, [ebp - 0x3cc]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
push eax
call esi
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
jmp 0x662f95
mov eax, dword [ebp - 0x3a8]
push dword [eax + 0xc8]
push 1
push 0x120411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x3cc], eax
test eax, eax
je 0x6634c2
push edi
push 0
push ebx
call fcn.0066e181
add esp, 0xc
mov dword [ebx], edi
mov dword [ebx + 4], 0x20000
cmp dword [ebp + 0x1c], 0
jne 0x662fd9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebx + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0xc], eax
mov esi, dword [ebp - 0x3b8]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
jmp 0x662ffd
mov eax, dword [ebp - 0x3a8]
mov ecx, dword [eax + 0xc8]
mov dword [ebx + 8], ecx
mov ecx, dword [eax + 0xcc]
mov dword [ebx + 0xc], ecx
mov eax, dword [eax + 0xd0]
mov esi, dword [ebp - 0x3b8]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x3cc]
mov dword [ebx + 0x28], eax
mov eax, dword [esi]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x3bc]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x3b0]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x3b4]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x4c], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x48], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0xc
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], 0x21
mov dword [ebx + 0x3c], 2
cmp dword [0x732608], eax
je 0x663075
cmp dword [ebp + 0x1c], eax
jne 0x663075
mov dword [ebx + 0x2c], 0x80
cmp dword [esi + 0x20], eax
je 0x663081
mov dword [ebx + 0x38], 0x25
mov edi, 0x400
cmp dword [ebp - 0x3d4], eax
je 0x6630a5
or dword [ebx + 0x2c], 1
push edi
lea eax, [ebx + 0x9ac]
push eax
push dword [ebp - 0x3d4]
call fcn.005962b0
cmp dword [ebp - 0x3d0], 0
je 0x6630e1
or dword [ebx + 0x2c], 1
cmp word [ebx + 0x9ac], 0
je 0x6630ce
push edi
lea eax, [ebx + 0x9ac]
push eax
push 0x4fbd98
call fcn.00596332
push edi
lea eax, [ebx + 0x9ac]
push eax
push dword [ebp - 0x3d0]
call fcn.00596332
cmp dword [esi + 0xc], 0
je 0x663117
or dword [ebx + 0x2c], 1
cmp word [ebx + 0x9ac], 0
je 0x663107
push edi
lea eax, [ebx + 0x9ac]
push eax
push 0x4fbd98
call fcn.00596332
push edi
lea eax, [ebx + 0x9ac]
push eax
push dword [esi + 0xc]
call fcn.00596332
mov esi, dword [esi + 0x10]
test esi, esi
je 0x66312c
push edi
lea eax, [ebx + 0x19ac]
push eax
push esi
call fcn.005962b0
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x40], eax
push 0x104
lea eax, [ebx + 0x50]
push eax
push 0x41c214
call fcn.005962b0
push 0x38
lea eax, [ebx + 0x564]
push eax
push 0x4fbd88
call fcn.005962d2
lea edi, [ebx + 0x7a4]
push 0x1f
pop ecx
lea esi, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3b8]
mov eax, dword [eax + 4]
test eax, eax
je 0x663185
push 0x38
lea ecx, [ebx + 0x21ac]
push ecx
push eax
call fcn.005962b0
mov eax, dword [ebp - 0x3b8]
mov eax, dword [eax + 8]
xor edi, edi
mov esi, 0x104
cmp eax, edi
je 0x6631a7
push esi
lea ecx, [ebx + 0x3d1c]
push ecx
push eax
call fcn.005962b0
push esi
lea eax, [ebx + 0x258]
push eax
cmp dword [ebp + 0x1c], edi
jne 0x6631cd
cmp word [0x7309e8], di
je 0x6631c4
push 0x7309e8
jmp 0x6631d9
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x6631de
mov eax, dword [ebp - 0x3a8]
add eax, 0xec
push eax
call fcn.005962b0
cmp dword [ebp - 0x3a8], edi
je 0x6631f4
push dword [ebp - 0x3a8]
push ebx
call fcn.0066298e
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x19c]
push eax
call fcn.00662769
pop ecx
pop ecx
test eax, eax
je 0x6634c2
push dword [ebp - 0x3c0]
lea eax, [ebp - 0x19c]
push eax
push 0x4fbd78
push 0x208
lea eax, [ebp - 0x3a4]
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
lea eax, [ebp - 0x3fc]
push eax
lea eax, [ebp - 0x440]
push eax
push edi
push edi
push 0x4000020
xor esi, esi
inc esi
push esi
push edi
push edi
lea eax, [ebp - 0x3a4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x6634c2
push dword [ebp - 0x3f8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3ec]
cmp eax, edi
je 0x66328d
mov ecx, dword [ebp - 0x3f4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3a8]
cmp eax, edi
je 0x6632b8
push dword [eax + 0xe8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x6632b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push 0x31746b68
call fcn.00652d6d
cmp dword [ebp + 0x1c], edi
je 0x6632d2
mov eax, dword [ebp - 0x3e4]
cmp eax, edi
je 0x6632d2
mov ecx, dword [eax]
cmp ecx, edi
je 0x6632d2
push dword [eax + 4]
call ecx
mov dword [ebp - 0x3a8], esi
mov dword [0x732608], esi
mov edi, 0x4e20
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push dword [ebp - 0x3bc]
call esi
test eax, eax
jne 0x66330c
push 1
push dword [ebp - 0x3b0]
call esi
test eax, eax
jne 0x66336f
and dword [ebp - 0x3c4], eax
jmp 0x66336f
and dword [ebp - 0x3a8], 0
push edi
push dword [ebp - 0x3b4]
call esi
cmp eax, 0x102
je 0x66337c
cmp eax, 0x80
je 0x66335c
push 1
push dword [ebp - 0x3bc]
call esi
test eax, eax
je 0x663346
push dword [ebp - 0x3b0]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x66335c
xor eax, eax
inc eax
mov dword [ebp - 0x3a8], eax
push eax
push dword [ebp - 0x3b0]
call esi
test eax, eax
jne 0x663363
and dword [ebp - 0x3c4], 0
push dword [ebp - 0x3b4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 0x3c4], 0
jne 0x6632e9
mov eax, dword [ebx + 0x9a84]
xor ecx, ecx
cmp eax, ecx
je 0x6634c2
cmp dword [ebp - 0x3a8], ecx
je 0x663442
mov edx, dword [ebp - 0x3b8]
test dword [edx + 0x18], eax
je 0x663442
mov dword [ebp - 4], ecx
push 0x10
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov dword [ebp - 0x3ac], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x6633f2
mov eax, dword [ebx + 0x9a84]
test esi, esi
jne 0x663426
dec eax
je 0x66341e
dec eax
je 0x66341a
dec eax
dec eax
je 0x663416
push esi
push 0x77617a70
call fcn.00652d6d
jmp 0x6634c8
push 7
jmp 0x663420
push 6
jmp 0x663420
push 9
pop esi
jmp 0x6634c8
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, dword [ebp - 0x3c0]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x3c8]
mov dword [esi + 0xc], eax
jmp 0x663527
mov edx, dword [ebp - 0x3b8]
test dword [edx + 0x1c], eax
je 0x663472
dec eax
je 0x66346e
dec eax
je 0x66346a
dec eax
dec eax
je 0x663466
xor esi, esi
sub eax, 0xc
je 0x66348c
push esi
push 0x69797765
jmp 0x663499
push 3
jmp 0x663420
push 2
jmp 0x663420
push 5
jmp 0x663420
cmp dword [ebp + 0x1c], ecx
jne 0x6634c2
cmp eax, ecx
jbe 0x6634b6
cmp eax, 2
jbe 0x6634a0
cmp eax, 4
je 0x66348f
cmp eax, 0x10
jne 0x6634b6
xor esi, esi
inc esi
jmp 0x6634c8
push 3
pop esi
push 0
push 0x6a626361
call fcn.00652d6d
jmp 0x6634c8
mov eax, edx
mov eax, dword [eax]
mov eax, dword [eax]
push dword [eax]
call fcn.00662752
push 0
push 0x69797761
jmp 0x6634bd
push 0
push 0x697a756c
call fcn.00652d6d
mov esi, dword [ebp - 0x3ac]
test ebx, ebx
je 0x6634d3
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x3c0], 0
je 0x6634e8
push dword [ebp - 0x3c0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3bc], 0
je 0x6634fd
push dword [ebp - 0x3bc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3b0], 0
je 0x663512
push dword [ebp - 0x3b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3b4], 0
je 0x663527
push dword [ebp - 0x3b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.0066df83
ret 0x24