Function at 0x40420c
Capabilities:
Check mutex on windows
Check os version

Disassembly:
push 0x34
push 0x417cf0
call fcn.00408340
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, 0x114
push edi
push ebx
mov esi, 0x41b210
push esi
call fcn.00405b00
add esp, 0xc
mov dword [0x41b210], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x20], ebx
cmp dword [0x41b220], 2
jne 0x404281
mov dword [ebp - 0x28], ebx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x2c], eax
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x40449c
push ebx
push ebx
push 1
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x40449c
lea eax, [ebp - 0x30]
mov dword [ebp - 0x20], eax
push str.WBXTRA_TRACE_MUTEX
push ebx
push dword [ebp - 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
call edi
mov dword [0x41b348], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov esi, eax
sub esi, 0xb7
neg esi
sbb esi, esi
inc esi
push str.WBXTRA_TRACE_MUTEX_EX
push 0
push dword [ebp - 0x20]
call edi
mov edi, eax
call ebx
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], 1
mov ecx, dword [0x41b348]
xor ebx, ebx
cmp ecx, ebx
je 0x404478
cmp edi, ebx
je 0x404497
cmp esi, ebx
jne 0x404303
cmp eax, ebx
jne 0x404303
mov byte [ebp - 0x19], 1
call fcn.00404077
mov dword [0x41a040], eax
push dword [0x41b348]
jmp 0x40430b
mov byte [ebp - 0x19], bl
cmp eax, ebx
je 0x40431c
push ecx
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x41b348], edi
jmp 0x404327
cmp esi, ebx
je 0x404327
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x19], bl
je 0x40438a
push dword [ebp - 0x20]
call fcn.00404103
pop ecx
mov dword [0x41b344], eax
cmp eax, ebx
je 0x40446e
cmp dword [0x41b220], 2
jne 0x4043c1
cmp dword [0x41b214], 6
jb 0x4043c1
push str.WBXTRA_TRACE_MUTEX
call fcn.004030d9
mov dword [esp], str.WBXTRA_TRACE_MUTEX_EX
call fcn.004030d9
mov dword [esp], str.WBXTRA_TRACE_FILE
call fcn.004030d9
mov dword [esp], str.WBXTRA_TRACE_FILE_EX
call fcn.004030d9
pop ecx
mov eax, dword [0x41b344]
jmp 0x4043c1
mov esi, dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
cmp dword [ebp - 0x24], ebx
mov edi, str.WBXTRA_TRACE_FILE
jne 0x40439f
mov edi, str.WBXTRA_TRACE_FILE_EX
push edi
push ebx
push 6
call esi
cmp eax, ebx
mov dword [0x41b344], eax
jne 0x4043c9
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push ebx
push 6
call esi
mov dword [0x41b344], eax
cmp eax, ebx
je 0x40446e
push ebx
push ebx
push ebx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x41b34c], eax
cmp eax, ebx
je 0x40446e
push 0x3e8
push dword [0x41b348]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x404412
cmp eax, 0x80
je 0x404412
push dword [0x41b34c]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [0x41b34c], ebx
jmp 0x40446e
cmp byte [ebp - 0x19], bl
je 0x40442c
push dword [0x41a040]
push dword [0x41b34c]
call fcn.0040347f
pop ecx
pop ecx
jmp 0x404462
push 4
push str.WBXT
push dword [0x41b34c]
call fcn.00406cbf
add esp, 0xc
test eax, eax
jne 0x404450
mov eax, dword [0x41b34c]
cmp byte [eax + 6], 3
je 0x404462
push dword [0x41b34c]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [0x41b34c], ebx
push dword [0x41b348]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [0x41b34c], ebx
jne 0x40449c
jmp 0x404497
cmp edi, ebx
je 0x404497
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404497
call fcn.00403426
mov dword [ebp - 4], 0xfffffffe
call fcn.00408385
ret