Function at 0x10065c0
Capabilities:
Check mutex on windows
Create process on windows
Create process suspended

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
xor edi, edi
mov word [ebp - 0x10], 0xff
mov word [ebp - 0xe], 0x3a
mov word [ebp - 0xc], di
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10065e3
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 0x1e]
call fcn.01009af0
mov ebx, esp
cmp ebx, edi
jne 0x1006610
push edi
push edi
push 1
push 0xc0000017
call dword [sym.imp.KERNEL32.dll_RaiseException]
push 0x40
lea eax, [ebp - 0x60]
push edi
push eax
mov dword [ebp - 0x64], 0x44
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x100114c
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
cmp esi, edi
mov dword [ebp - 8], esi
jne 0x100665a
push 0x1004a84
call fcn.010063b0
mov eax, 8
lea esp, [ebp - 0x70]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
je 0x1006690
cmp eax, 0x80
je 0x1006690
push 0x1004a4c
call fcn.010063b0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 8
lea esp, [ebp - 0x70]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ax, word [ebp + 0xc]
cmp ax, di
jne 0x10066a6
call dword [sym.imp.imdisk.cpl__ImDiskFindFreeDriveLetter_0]
mov dword [ebp - 4], 1
cmp ax, di
mov word [ebp - 0x10], ax
jne 0x10066e6
mov ecx, dword [sym.imp.msvcrt.dll__iob]
add ecx, 0x40
push 0x1004a18
push ecx
call dword [sym.imp.msvcrt.dll_fprintf]
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 8
lea esp, [ebp - 0x70]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 8]
push edi
lea edx, [ebp - 0x10]
push edx
call fcn.01006500
test eax, eax
jne 0x100673f
push edi
lea eax, [ebp - 0x10]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
jne 0x1006714
push 0x10049dc
call fcn.010063b0
jmp 0x10066c7
push edi
lea ecx, [ebp - 0x10]
push ecx
call fcn.01006500
test eax, eax
jne 0x100673f
push edi
lea edx, [ebp - 0x10]
push edx
push 7
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
jne 0x10066c7
push 0x1004988
call fcn.010063b0
jmp 0x10066c7
lea eax, [ebp - 0x10]
push eax
push 0x100496c
call dword [sym.imp.msvcrt.dll_printf]
mov eax, 0x1001168
mov edx, ebx
add esp, 8
sub edx, eax
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1006760
lea eax, [ebp - 0x10]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1006774
mov edi, ebx
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1006786
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
add edi, 0xfffffffe
jmp 0x10067b0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10067b0
mov ecx, dword [0x1004968]
mov eax, dword [ebp + 0x10]
mov dword [edi], ecx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10067d0
mov edi, ebx
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10067e2
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push ebx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x1006841
mov ecx, dword [ebp - 0x1c]
push ecx
call esi
mov edx, dword [ebp - 0x20]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x20]
push eax
call esi
xor ebx, ebx
jmp 0x1006850
push 0x100493c
call fcn.010063b0
mov ebx, 8
cmp dword [ebp - 4], 0
je 0x1006874
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 7
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
jne 0x1006874
push 0x1004988
call fcn.010063b0
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x100688c
push 0x100490c
call fcn.010063b0
push edi
call esi
test eax, eax
jne 0x100689d
push 0x100490c
call fcn.010063b0
mov eax, ebx
lea esp, [ebp - 0x70]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc