Function at 0x40622a
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f1f0
push 0x40a0c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffff984
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call fcn.00407ed8
and eax, 0xff
test eax, eax
jne 0x406272
mov dword [0x412494], 0xc
xor eax, eax
jmp 0x40715e
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.004083a8
add esp, 8
mov eax, dword [0x411188]
xor eax, dword [0x41117c]
xor eax, dword [0x411164]
and eax, 3
push eax
call fcn.004044b0
add esp, 4
push 0x104
push 0x412150
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
push 0x412150
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0xffffffff
je 0x406307
push 0
push 0
mov ecx, dword [0x411194]
xor ecx, dword [0x411168]
xor ecx, dword [0x411164]
push ecx
mov edx, dword [ebp - 0x384]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x406318
mov dword [0x412494], 4
xor eax, eax
jmp 0x40715e
mov eax, dword [str.StMtx]
mov dword [ebp - 0x140], eax
mov cx, word [0x4113ac]
mov word [ebp - 0x13c], cx
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x13a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x412150
lea edx, [ebp - 0x140]
push edx
call fcn.00409da0
add esp, 8
lea eax, [ebp - 0x140]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
movsx edx, byte [ecx]
test edx, edx
je 0x406386
mov eax, dword [ebp - 0x28]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x40637b
mov edx, dword [ebp - 0x28]
mov byte [edx], 0x5f
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
jmp 0x406360
lea ecx, [ebp - 0x140]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x270], eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
call fcn.00405dc2
add esp, 4
mov byte [ebp - 0x25c], 0
xor eax, eax
mov al, byte [0x4125c0]
test eax, eax
jne 0x40649c
push 0x412150
lea ecx, [ebp - 0x244]
push ecx
call fcn.00409d90
add esp, 8
lea edx, [ebp - 0x244]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40640f
mov edx, dword [ebp - 0x28]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x406404
mov ecx, dword [ebp - 0x28]
mov byte [ecx], 0x2e
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
jmp 0x4063e9
lea eax, [ebp - 0x244]
push eax
push 0x1000
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x412138], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x406442
mov byte [ebp - 0x25c], 1
push 0x1000
push 0
push 0
push 0xf001f
mov ecx, dword [0x412138]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x412258], eax
mov edx, dword [ebp - 0x25c]
and edx, 0xff
test edx, edx
jne 0x406489
mov eax, dword [0x412258]
mov dword [eax], 1
mov ecx, dword [0x412258]
mov byte [ecx + 4], 0
jmp 0x40649c
mov edx, dword [0x412258]
mov eax, dword [edx]
add eax, 1
mov ecx, dword [0x412258]
mov dword [ecx], eax
push 1
lea edx, [ebp - 0x380]
push edx
call fcn.00407f41
add esp, 8
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x380]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0xffffffff
jne 0x4064ec
mov dword [0x412494], 3
xor eax, eax
jmp 0x40715e
push 0
mov ecx, dword [ebp - 0x384]
push ecx
mov edx, dword [ebp - 0x26c]
push edx
call fcn.00407e26
add esp, 0xc
and eax, 0xff
test eax, eax
jne 0x406530
mov dword [0x412494], 8
push 0x4113b0
push str.ExtractFile_error_
call fcn.00409d90
add esp, 8
xor eax, eax
jmp 0x40715e
mov eax, dword [ebp - 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x27c], 0x4675446d
mov dword [ebp - 0x258], 0x4360c26
mov dword [ebp - 0x278], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x278], ebp
mov eax, dword [ebp - 0x258]
xor eax, dword [ebp - 0x27c]
mov ebp, eax
mov eax, 4
int3
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret