Function at 0x30112729
Capabilities:
Check mutex on windows
Create process on windows
Read file via mapping

Disassembly:
push 0x430
push 0x301f9870
call fcn.3013765f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x3e4], eax
xor ebx, ebx
mov dword [ebp - 0x3c0], ebx
mov dword [ebp - 0x3e0], ebx
xor eax, eax
lea edi, [ebp - 0x3dc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x440], 0x44
push 0x40
push ebx
lea eax, [ebp - 0x43c]
push eax
call sub.MSVCR80.dll_memset
mov dword [ebp - 0x3fc], ebx
xor eax, eax
lea edi, [ebp - 0x3f8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x3b0], ebx
mov dword [ebp - 0x3bc], ebx
mov dword [ebp - 0x3b4], ebx
mov dword [ebp - 0x3cc], ebx
mov byte [ebp - 0x19c], bl
push 0x103
push ebx
lea eax, [ebp - 0x19b]
push eax
call sub.MSVCR80.dll_memset
add esp, 0x18
mov dword [ebp - 0x3c4], 1
mov dword [ebp - 0x3ac], ebx
push 0x1f
pop ecx
mov esi, 0x3000e660
lea edi, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
cmp dword [ebp + 0x1c], ebx
je 0x3011282f
mov eax, dword [ebp - 0x3a8]
cmp eax, edi
je 0x30112824
cmp dword [eax + 0xc8], edi
je 0x30112824
cmp dword [eax + 0xe8], edi
jne 0x3011282f
push edi
push 0x31746b66
jmp 0x30112e6b
mov dword [ebp - 0x3e0], 0xc
mov dword [ebp - 0x3d8], 1
push edi
push edi
push edi
lea eax, [ebp - 0x3e0]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
call esi
mov dword [ebp - 0x3bc], eax
cmp eax, edi
je 0x30112e70
xor edi, edi
push edi
push edi
push edi
lea eax, [ebp - 0x3e0]
push eax
call esi
mov dword [ebp - 0x3b0], eax
cmp eax, edi
je 0x30112e70
push edi
push edi
push edi
lea eax, [ebp - 0x3e0]
push eax
call esi
mov dword [ebp - 0x3c8], eax
cmp eax, edi
je 0x30112e70
push edi
push edi
lea eax, [ebp - 0x3e0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x3b4], eax
test eax, eax
je 0x30112e70
push edi
mov edi, 0x9c9c
push edi
push 0
push 4
lea eax, [ebp - 0x3e0]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x3c0], eax
test eax, eax
je 0x30112e70
xor esi, esi
push esi
push esi
push esi
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp - 0x3e8], ebx
cmp ebx, esi
je 0x30112e70
cmp dword [ebp + 0x1c], esi
jne 0x30112924
push 2
push 1
push esi
lea eax, [ebp - 0x3cc]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
push eax
call esi
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
jmp 0x30112943
mov eax, dword [ebp - 0x3a8]
push dword [eax + 0xc8]
push 1
push 0x120411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x3cc], eax
test eax, eax
je 0x30112e70
push edi
push 0
push ebx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebx], edi
mov dword [ebx + 4], 0x20000
cmp dword [ebp + 0x1c], 0
jne 0x30112987
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebx + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0xc], eax
mov esi, dword [ebp - 0x3b8]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
jmp 0x301129ab
mov eax, dword [ebp - 0x3a8]
mov ecx, dword [eax + 0xc8]
mov dword [ebx + 8], ecx
mov ecx, dword [eax + 0xcc]
mov dword [ebx + 0xc], ecx
mov eax, dword [eax + 0xd0]
mov esi, dword [ebp - 0x3b8]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x3cc]
mov dword [ebx + 0x28], eax
mov eax, dword [esi]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x3bc]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x3b0]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x3b4]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x4c], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x48], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0xc
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], 0x21
mov dword [ebx + 0x3c], 2
cmp dword [0x3027caf8], eax
je 0x30112a23
cmp dword [ebp + 0x1c], eax
jne 0x30112a23
mov dword [ebx + 0x2c], 0x80
cmp dword [esi + 0x20], eax
je 0x30112a2f
mov dword [ebx + 0x38], 0x25
mov edi, 0x400
cmp dword [ebp - 0x3d4], eax
je 0x30112a53
or dword [ebx + 0x2c], 1
push edi
lea eax, [ebx + 0x9ac]
push eax
push dword [ebp - 0x3d4]
call fcn.301255f4
cmp dword [ebp - 0x3d0], 0
je 0x30112a8f
or dword [ebx + 0x2c], 1
cmp word [ebx + 0x9ac], 0
je 0x30112a7c
push edi
lea eax, [ebx + 0x9ac]
push eax
push 0x3000e658
call fcn.30125676
push edi
lea eax, [ebx + 0x9ac]
push eax
push dword [ebp - 0x3d0]
call fcn.30125676
cmp dword [esi + 0xc], 0
je 0x30112ac5
or dword [ebx + 0x2c], 1
cmp word [ebx + 0x9ac], 0
je 0x30112ab5
push edi
lea eax, [ebx + 0x9ac]
push eax
push 0x3000e658
call fcn.30125676
push edi
lea eax, [ebx + 0x9ac]
push eax
push dword [esi + 0xc]
call fcn.30125676
mov esi, dword [esi + 0x10]
test esi, esi
je 0x30112ada
push edi
lea eax, [ebx + 0x19ac]
push eax
push esi
call fcn.301255f4
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x40], eax
push 0x104
lea eax, [ebx + 0x50]
push eax
push 0x30003f40
call fcn.301255f4
push 0x38
lea eax, [ebx + 0x564]
push eax
push 0x3000e648
call fcn.30125616
lea edi, [ebx + 0x7a4]
push 0x1f
pop ecx
lea esi, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3b8]
mov eax, dword [eax + 4]
test eax, eax
je 0x30112b33
push 0x38
lea ecx, [ebx + 0x21ac]
push ecx
push eax
call fcn.301255f4
mov eax, dword [ebp - 0x3b8]
mov eax, dword [eax + 8]
xor edi, edi
mov esi, 0x104
cmp eax, edi
je 0x30112b55
push esi
lea ecx, [ebx + 0x3d1c]
push ecx
push eax
call fcn.301255f4
push esi
lea eax, [ebx + 0x258]
push eax
cmp dword [ebp + 0x1c], edi
jne 0x30112b7b
cmp word [0x30278498], di
je 0x30112b72
push 0x30278498
jmp 0x30112b87
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x30112b8c
mov eax, dword [ebp - 0x3a8]
add eax, 0xec
push eax
call fcn.301255f4
cmp dword [ebp - 0x3a8], edi
je 0x30112ba2
push dword [ebp - 0x3a8]
push ebx
call fcn.3011233c
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x19c]
push eax
call fcn.30112117
pop ecx
pop ecx
test eax, eax
je 0x30112e70
push dword [ebp - 0x3c0]
lea eax, [ebp - 0x19c]
push eax
push 0x3000e638
push 0x208
lea eax, [ebp - 0x3a4]
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
lea eax, [ebp - 0x3fc]
push eax
lea eax, [ebp - 0x440]
push eax
push edi
push edi
push 0x4000020
xor esi, esi
inc esi
push esi
push edi
push edi
lea eax, [ebp - 0x3a4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x30112e70
push dword [ebp - 0x3f8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3ec]
cmp eax, edi
je 0x30112c3b
mov ecx, dword [ebp - 0x3f4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3a8]
cmp eax, edi
je 0x30112c66
push dword [eax + 0xe8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x30112c66
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push 0x31746b68
call fcn.3010aa60
cmp dword [ebp + 0x1c], edi
je 0x30112c80
mov eax, dword [ebp - 0x3e4]
cmp eax, edi
je 0x30112c80
mov ecx, dword [eax]
cmp ecx, edi
je 0x30112c80
push dword [eax + 4]
call ecx
mov dword [ebp - 0x3a8], esi
mov dword [0x3027caf8], esi
mov edi, 0x4e20
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push dword [ebp - 0x3bc]
call esi
test eax, eax
jne 0x30112cba
push 1
push dword [ebp - 0x3b0]
call esi
test eax, eax
jne 0x30112d1d
and dword [ebp - 0x3c4], eax
jmp 0x30112d1d
and dword [ebp - 0x3a8], 0
push edi
push dword [ebp - 0x3b4]
call esi
cmp eax, 0x102
je 0x30112d2a
cmp eax, 0x80
je 0x30112d0a
push 1
push dword [ebp - 0x3bc]
call esi
test eax, eax
je 0x30112cf4
push dword [ebp - 0x3b0]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x30112d0a
xor eax, eax
inc eax
mov dword [ebp - 0x3a8], eax
push eax
push dword [ebp - 0x3b0]
call esi
test eax, eax
jne 0x30112d11
and dword [ebp - 0x3c4], 0
push dword [ebp - 0x3b4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 0x3c4], 0
jne 0x30112c97
mov eax, dword [ebx + 0x9a84]
xor ecx, ecx
cmp eax, ecx
je 0x30112e70
cmp dword [ebp - 0x3a8], ecx
je 0x30112df0
mov edx, dword [ebp - 0x3b8]
test dword [edx + 0x18], eax
je 0x30112df0
mov dword [ebp - 4], ecx
push 0x10
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov dword [ebp - 0x3ac], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x30112da0
mov eax, dword [ebx + 0x9a84]
test esi, esi
jne 0x30112dd4
dec eax
je 0x30112dcc
dec eax
je 0x30112dc8
dec eax
dec eax
je 0x30112dc4
push esi
push 0x77617a70
call fcn.3010aa60
jmp 0x30112e76
push 7
jmp 0x30112dce
push 6
jmp 0x30112dce
push 9
pop esi
jmp 0x30112e76
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, dword [ebp - 0x3c0]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x3c8]
mov dword [esi + 0xc], eax
jmp 0x30112ed5
mov edx, dword [ebp - 0x3b8]
test dword [edx + 0x1c], eax
je 0x30112e20
dec eax
je 0x30112e1c
dec eax
je 0x30112e18
dec eax
dec eax
je 0x30112e14
xor esi, esi
sub eax, 0xc
je 0x30112e3a
push esi
push 0x69797765
jmp 0x30112e47
push 3
jmp 0x30112dce
push 2
jmp 0x30112dce
push 5
jmp 0x30112dce
cmp dword [ebp + 0x1c], ecx
jne 0x30112e70
cmp eax, ecx
jbe 0x30112e64
cmp eax, 2
jbe 0x30112e4e
cmp eax, 4
je 0x30112e3d
cmp eax, 0x10
jne 0x30112e64
xor esi, esi
inc esi
jmp 0x30112e76
push 3
pop esi
push 0
push 0x6a626361
call fcn.3010aa60
jmp 0x30112e76
mov eax, edx
mov eax, dword [eax]
mov eax, dword [eax]
push dword [eax]
call fcn.30112100
push 0
push 0x69797761
jmp 0x30112e6b
push 0
push 0x697a756c
call fcn.3010aa60
mov esi, dword [ebp - 0x3ac]
test ebx, ebx
je 0x30112e81
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x3c0], 0
je 0x30112e96
push dword [ebp - 0x3c0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3bc], 0
je 0x30112eab
push dword [ebp - 0x3bc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3b0], 0
je 0x30112ec0
push dword [ebp - 0x3b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3b4], 0
je 0x30112ed5
push dword [ebp - 0x3b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.301376a7
ret 0x24