Function at 0x427fd7
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x448008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x21c], esi
call fcn.00429d14
lea ecx, [ebp - 0x208]
mov edx, str.NxSTC
mov edi, ecx
mov al, 0x4e
sub edx, edi
mov byte [ecx], al
inc ecx
mov al, byte [edx + ecx]
test al, al
jne 0x42800e
push 0x30
push 0
movzx edx, bl
mov byte [ecx], al
call fcn.00401936
pop ecx
pop ecx
mov edi, str..MTX
mov dword [ebp - 0x20c], eax
mov ecx, eax
mov dl, 0x2e
sub edi, eax
mov byte [ecx], dl
inc ecx
mov dl, byte [edi + ecx]
test dl, dl
jne 0x428039
mov byte [ecx], dl
mov edx, 0x1f0001
push 0
push 2
lea ecx, [ebp - 0x230]
call fcn.00429bf2
pop ecx
pop ecx
neg eax
lea ecx, [ebp - 0x230]
sbb eax, eax
xor bl, bl
and eax, ecx
mov dword [ebp - 0x210], ebx
lea ecx, [ebp - 0x208]
push ecx
xor ecx, ecx
inc ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
je 0x42809b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4280b9
xor eax, eax
lea ebx, [eax + 1]
jmp 0x4280b3
lea ecx, [ebp - 0x208]
call fcn.00427fb3
mov edi, eax
movzx ebx, bl
push 1
test edi, edi
pop eax
cmovne ebx, eax
mov dword [ebp - 0x210], ebx
lea ecx, [ebp - 0x230]
mov dword [esi + 0x14], edi
call fcn.00429bc1
cmp dword [esi + 0x14], 0
jne 0x4280d5
xor eax, eax
inc eax
jmp 0x428468
test bl, bl
je 0x4280e7
push 0x3e8
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x20c]
mov ecx, str..MMF
mov dl, 0x2e
sub ecx, eax
mov byte [eax], dl
inc eax
mov dl, byte [ecx + eax]
test dl, dl
jne 0x4280f6
mov byte [eax], dl
lea ecx, [ebp - 0x230]
push 3
push 2
mov edx, 0xc01f01ff
call fcn.00429bf2
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
neg eax
pop ecx
pop ecx
sbb eax, eax
lea ecx, [ebp - 0x230]
and eax, ecx
lea ecx, [ebp - 0x208]
push ecx
push 0x1003fc
push 0
push 4
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x214], eax
call edi
mov dword [esi + 0x10], eax
cmp dword [esi + 0x10], 0
jne 0x428175
mov ecx, str.SeCreateGlobalPrivilege
call fcn.00423f9c
lea eax, [ebp - 0x208]
push eax
push 0x1003fc
push 0
push 4
push dword [ebp - 0x214]
push 0xffffffffffffffff
call edi
mov dword [esi + 0x10], eax
test bl, bl
jne 0x428192
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
movzx ebx, bl
cmp eax, 0xb7
cmove ebx, edx
mov dword [ebp - 0x210], ebx
xor eax, eax
cmp dword [esi + 0x10], eax
je 0x428450
push eax
push eax
push eax
push 0xf001f
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xf4], eax
test eax, eax
je 0x428450
mov eax, dword [esi + 0xf4]
test bl, bl
jne 0x428224
push 0x1003fc
push 0
push eax
call fcn.0042c7b0
mov eax, dword [esi + 0xf4]
xor edx, edx
add esp, 0xc
mov byte [eax + 0x1fb], 0x10
mov eax, dword [esi + 0xf4]
cmp byte [eax + 0x1fb], dl
jbe 0x4282e2
xor ecx, ecx
mov eax, dword [esi + 0xf4]
lea ecx, [ecx + 0x10018]
or dword [eax + ecx - 0xfe0c], 0xffffffff
inc edx
mov eax, dword [esi + 0xf4]
movzx eax, byte [eax + 0x1fb]
cmp edx, eax
jb 0x4281f9
jmp 0x4282e2
xor ebx, ebx
and dword [eax + 0xd8], ebx
xor edi, edi
mov edx, edi
mov ecx, esi
call fcn.00427eca
test al, al
je 0x42823c
inc ebx
inc edi
cmp edi, 0x1a
jb 0x42822e
test ebx, ebx
je 0x428255
mov eax, dword [esi + 0xf4]
cmp byte [eax + 0x1fb], 0
jne 0x428262
mov eax, dword [esi + 0xf4]
mov byte [eax + 0x1fb], 0x10
mov eax, dword [esi + 0xf4]
and dword [ebp - 0x218], 0
cmp byte [eax + 0x1fb], 0
jbe 0x4282e2
xor edi, edi
mov ebx, dword [esi + 0xf4]
xor eax, eax
lea ecx, [ebx + 0x208]
add ecx, edi
lea edx, [eax + 1]
call fcn.00401f16
test eax, eax
jne 0x4282b1
mov dword [ebx + edi + 0x20c], 0xffffffff
xor edx, edx
mov dword [ebx + edi + 0x1fc], eax
call fcn.00401f16
jmp 0x4282be
lea ecx, [ebx + 0x204]
add ecx, edi
call fcn.0040eb84
mov eax, dword [esi + 0xf4]
add edi, 0x10018
mov ecx, dword [ebp - 0x218]
inc ecx
mov dword [ebp - 0x218], ecx
movzx eax, byte [eax + 0x1fb]
cmp ecx, eax
jb 0x42827a
mov eax, dword [esi + 0xf4]
mov byte [eax + 0x1fa], 2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi + 0xf4]
mov ebx, dword [ebp - 0x20c]
mov dword [ecx], eax
mov byte [ebx], 0
mov eax, dword [esi + 0xf4]
lea ecx, [eax + 0x1dc]
mov ah, byte [ebp - 0x208]
test ah, ah
je 0x428330
lea edx, [ebp - 0x208]
sub edx, ecx
mov byte [ecx], ah
inc ecx
mov al, byte [edx + ecx]
mov ah, al
test al, al
jne 0x428324
mov byte [ecx], 0
mov edi, 0x481e18
mov ecx, dword [esi + 0xf4]
mov edx, edi
add ecx, 0xdc
call fcn.0040e8d5
push 0
push 0x8000080
push 4
push dword [ebp - 0x214]
xor eax, eax
inc eax
push eax
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [ebp - 0x230]
mov dword [esi + 0xc], eax
call fcn.00429bc1
cmp dword [esi + 0xc], 0xffffffff
jne 0x428386
push 5
pop eax
jmp 0x428468
push 0
push 2
mov edx, 0x1f0003
lea ecx, [ebp - 0x230]
call fcn.00429bf2
neg eax
mov edx, str..FTS
pop ecx
sbb edi, edi
lea eax, [ebp - 0x230]
pop ecx
and edi, eax
mov ecx, ebx
push 0x2e
sub edx, ebx
pop ebx
mov byte [ecx], bl
inc ecx
mov al, byte [edx + ecx]
mov bl, al
test al, al
jne 0x4283b4
mov byte [ecx], al
lea eax, [ebp - 0x208]
push eax
xor eax, eax
mov ecx, edi
inc eax
push eax
mov dl, al
call fcn.00427f81
mov ebx, dword [ebp - 0x20c]
mov dword [esi + 0x18], eax
lea eax, [esi + 0x1c]
pop ecx
pop ecx
mov byte [ebx], 0x73
mov esi, eax
mov byte [ebx + 2], 0
xor ebx, ebx
mov ecx, dword [ebp - 0x20c]
mov al, bl
add al, 0x41
xor dl, dl
mov byte [ecx + 1], al
lea eax, [ebp - 0x208]
push eax
push 0
mov ecx, edi
call fcn.00427f81
mov dword [esi], eax
pop ecx
pop ecx
test eax, eax
je 0x42841f
inc ebx
add esi, 4
cmp ebx, 0x1a
jb 0x4283ef
lea ecx, [ebp - 0x230]
call fcn.00429bc1
mov esi, dword [ebp - 0x21c]
cmp ebx, 0x1a
jae 0x42843c
push 7
jmp 0x428380
cmp byte [ebp - 0x210], 0
je 0x42844c
mov ecx, esi
call fcn.0040f087
xor eax, eax
jmp 0x428468
lea ecx, [ebp - 0x230]
call fcn.00429bc1
mov ecx, dword [esi + 0x10]
xor eax, eax
test ecx, ecx
setne al
add eax, 3
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a623
mov esp, ebp
pop ebp
ret 8