Function at 0x102e8b3d
Capabilities:
Check mutex on windows
Create process on windows
Read file via mapping

Disassembly:
push 0x3b4
push 0x1035a660
call fcn.102f8fb8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x344], eax
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x32c], esi
xor ebx, ebx
mov dword [ebp - 0x33c], ebx
mov dword [ebp - 0x358], ebx
xor eax, eax
lea edi, [ebp - 0x354]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x3c4], 0x44
push 0x40
push ebx
lea eax, [ebp - 0x3c0]
push eax
call fcn.102f835e
mov dword [ebp - 0x370], ebx
xor eax, eax
lea edi, [ebp - 0x36c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x334], ebx
mov dword [ebp - 0x340], ebx
mov dword [ebp - 0x330], ebx
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea eax, [ebp - 0x11f]
push eax
call fcn.102f835e
add esp, 0x18
mov dword [ebp - 0x34c], 1
mov dword [ebp - 0x338], ebx
cmp esi, ebx
je 0x102e91be
call fcn.102ea049
test eax, eax
je 0x102e8c04
call fcn.102ea04f
test eax, eax
je 0x102e91be
mov dword [ebp - 0x358], 0xc
mov dword [ebp - 0x350], 1
xor edi, edi
push edi
push edi
push edi
lea eax, [ebp - 0x358]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
call esi
mov dword [ebp - 0x340], eax
cmp eax, edi
je 0x102e91be
push edi
push edi
push edi
lea eax, [ebp - 0x358]
push eax
call esi
mov dword [ebp - 0x334], eax
cmp eax, edi
je 0x102e91be
push edi
push edi
push edi
lea eax, [ebp - 0x358]
push eax
call esi
mov esi, eax
cmp esi, edi
je 0x102e91be
push edi
push edi
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x330], eax
test eax, eax
je 0x102e91be
push edi
mov edi, 0x9c9c
push edi
push 0
push 4
lea eax, [ebp - 0x358]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x33c], eax
test eax, eax
je 0x102e91be
xor eax, eax
push eax
push eax
push eax
push 6
push dword [ebp - 0x33c]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp - 0x35c], ebx
test ebx, ebx
je 0x102e91be
push edi
push 0
push ebx
call fcn.102f835e
add esp, 0xc
mov dword [ebx], edi
mov dword [ebx + 4], 0x20000
mov eax, dword [ebp - 0x32c]
mov ecx, dword [eax]
push eax
call dword [ecx]
mov dword [ebx + 0x28], eax
test eax, eax
je 0x102e91be
mov edi, dword [ebp - 0x32c]
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov dword [ebx + 8], eax
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov dword [ebx + 0xc], eax
mov eax, dword [edi]
push edi
call dword [eax + 0xc]
mov dword [ebx + 0x10], eax
mov eax, dword [edi]
push edi
call dword [eax + 0x10]
mov dword [ebx + 0x14], eax
mov eax, dword [edi]
lea ecx, [ebx + 0x8470]
push ecx
push edi
call dword [eax + 0x14]
mov eax, dword [ebp - 0x340]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x334]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x330]
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x1c], esi
mov esi, dword [ebp - 0x348]
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x4c], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x48], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x44], eax
and dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0xc
and dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0x21
mov dword [ebx + 0x3c], 2
mov eax, dword [edi]
push edi
call dword [eax + 0x24]
test eax, eax
jne 0x102e8d98
or dword [ebx + 0x2c], 0x80
cmp dword [esi + 0x20], 0
je 0x102e8da2
or dword [ebx + 0x38], 4
mov eax, dword [ebp - 0x344]
test eax, eax
je 0x102e8dc8
cmp word [eax], 0
je 0x102e8dc8
or dword [ebx + 0x2c], 1
push eax
push 0x400
lea eax, [ebx + 0x9ac]
push eax
call fcn.102eeda3
cmp dword [esi + 0xc], 0
je 0x102e8de6
or dword [ebx + 0x2c], 1
push dword [esi + 0xc]
push 0x400
lea eax, [ebx + 0x9ac]
push eax
call fcn.102eeda3
mov eax, dword [edi]
push 0x400
lea ecx, [ebx + 0x9ac]
push ecx
push edi
call dword [eax + 0x1c]
test eax, eax
je 0x102e8e00
or dword [ebx + 0x2c], 1
mov esi, dword [esi + 0x10]
test esi, esi
je 0x102e8e1c
push 0x400
lea eax, [ebx + 0x19ac]
push eax
push esi
call fcn.102d3436
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x40], eax
push 0x104
lea eax, [ebx + 0x50]
push eax
push 0x1001cf1c
call fcn.102d3436
add esp, 0xc
lea edi, [ebx + 0x7a4]
push 0x1f
pop ecx
mov esi, 0x101494a8
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x348]
mov eax, dword [eax + 4]
test eax, eax
je 0x102e8e67
push 0x38
lea ecx, [ebx + 0x21ac]
push ecx
push eax
call fcn.102d3436
add esp, 0xc
mov eax, dword [ebp - 0x348]
mov eax, dword [eax + 8]
mov esi, 0x104
test eax, eax
je 0x102e8e8a
push esi
lea ecx, [ebx + 0x3d1c]
push ecx
push eax
call fcn.102d3436
add esp, 0xc
lea edi, [ebx + 0x258]
mov eax, dword [ebp - 0x32c]
mov ecx, dword [eax]
push esi
push edi
push eax
call dword [ecx + 0x20]
test eax, eax
jne 0x102e8ec4
push esi
push edi
cmp word [0x103ab100], ax
je 0x102e8ebc
push 0x103ab100
call fcn.102d3436
add esp, 0xc
jmp 0x102e8ec4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [ebp - 0x32c]
mov eax, dword [edi]
push edi
call dword [eax + 0x18]
push eax
push ebx
call fcn.102e883b
push esi
lea eax, [ebp - 0x120]
push eax
call fcn.102e84fe
add esp, 0x10
test eax, eax
je 0x102e91be
push dword [ebp - 0x33c]
lea eax, [ebp - 0x120]
push eax
push 0x10149498
push 0xffffffffffffffff
lea eax, [ebp - 0x328]
push eax
call fcn.102e85a9
add esp, 0x14
lea eax, [ebp - 0x370]
push eax
lea eax, [ebp - 0x3c4]
push eax
xor eax, eax
push eax
push eax
push 0x4000020
xor esi, esi
inc esi
push esi
push eax
push eax
lea ecx, [ebp - 0x328]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x102e91be
mov eax, dword [edi]
push dword [ebp - 0x368]
push edi
call dword [eax + 0x30]
push dword [ebp - 0x36c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x32c], esi
xor ecx, ecx
test eax, eax
setne cl
inc ecx
inc ecx
mov eax, ecx
mov dword [ebp - 0x360], eax
mov esi, 0x4e20
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x374], eax
push esi
push 0
lea eax, [ebp - 0x37c]
push eax
push dword [ebp - 0x360]
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x102e8fce
mov eax, dword [edi]
push edi
call dword [eax + 0x34]
jmp 0x102e9063
cmp eax, 1
je 0x102e9070
cmp eax, 2
jne 0x102e8ff1
and dword [ebp - 0x34c], 0
push dword [ebp - 0x334]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x102e9063
cmp eax, 0x102
je 0x102e9004
push 0
push 0x38303364
call fcn.102d8670
and dword [ebp - 0x32c], 0
push esi
push dword [ebp - 0x330]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x102e9070
cmp eax, 0x80
je 0x102e9044
push 1
push dword [ebp - 0x340]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x102e904d
push dword [ebp - 0x334]
call dword [sym.imp.KERNEL32.dll_SetEvent]
and dword [ebp - 0x34c], 0
jmp 0x102e9057
mov dword [ebp - 0x32c], 1
push dword [ebp - 0x330]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 0x34c], 0
jne 0x102e8f85
mov eax, dword [edi]
push edi
call dword [eax + 0x38]
mov eax, dword [ebx + 0x9a84]
test eax, eax
je 0x102e91be
mov esi, dword [ebp - 0x348]
cmp dword [ebp - 0x32c], 0
je 0x102e913c
test dword [esi + 0x18], eax
je 0x102e913c
and dword [ebp - 4], 0
push 0x10
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov dword [ebp - 0x338], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x102e90ec
mov eax, dword [ebx + 0x9a84]
test esi, esi
jne 0x102e9120
dec eax
je 0x102e9118
dec eax
je 0x102e9114
dec eax
dec eax
je 0x102e9110
push esi
push 0x77617a70
call fcn.102d8670
jmp 0x102e91c4
push 7
jmp 0x102e911a
push 6
jmp 0x102e911a
push 9
pop esi
jmp 0x102e91c4
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, dword [ebp - 0x33c]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x344]
mov dword [esi + 0xc], eax
jmp 0x102e9218
test dword [esi + 0x1c], eax
je 0x102e9166
dec eax
je 0x102e9162
dec eax
je 0x102e915e
dec eax
dec eax
je 0x102e915a
xor esi, esi
sub eax, 0xc
je 0x102e918d
push esi
push 0x69797765
jmp 0x102e9199
push 3
jmp 0x102e911a
push 2
jmp 0x102e911a
push 5
jmp 0x102e911a
mov eax, dword [edi]
push edi
call dword [eax + 0x2c]
test eax, eax
je 0x102e91be
mov eax, dword [ebx + 0x9a84]
xor edi, edi
cmp eax, edi
jbe 0x102e91b3
cmp eax, 2
jbe 0x102e91a0
cmp eax, 4
je 0x102e9190
cmp eax, 0x10
jne 0x102e91b3
xor esi, esi
inc esi
jmp 0x102e91c4
push 3
pop esi
push edi
push 0x6a626361
call fcn.102d8670
jmp 0x102e91c4
mov eax, dword [esi]
mov eax, dword [eax]
push dword [eax]
call fcn.102e84e7
push edi
push 0x38303365
jmp 0x102e91b9
push edi
push 0x697a756c
call fcn.102d8670
mov esi, dword [ebp - 0x338]
test ebx, ebx
je 0x102e91cf
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x33c], 0
je 0x102e91e6
push dword [ebp - 0x33c]
call edi
xor ebx, ebx
cmp dword [ebp - 0x340], ebx
je 0x102e91f8
push dword [ebp - 0x340]
call edi
cmp dword [ebp - 0x334], ebx
je 0x102e9208
push dword [ebp - 0x334]
call edi
cmp dword [ebp - 0x330], ebx
je 0x102e9218
push dword [ebp - 0x330]
call edi
mov eax, esi
call fcn.102f9000
ret 0x10