Function at 0x1006450
Capabilities:
Check mutex on windows
Create process on windows
Create process suspended

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
xor edi, edi
mov word [ebp - 0x10], 0xff
mov word [ebp - 0xe], 0x3a
mov word [ebp - 0xc], di
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1006473
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 0x1e]
call fcn.01009980
mov ebx, esp
cmp ebx, edi
jne 0x10064a0
push edi
push edi
push 1
push 0xc0000017
call dword [sym.imp.KERNEL32.dll_RaiseException]
push 0x40
lea eax, [ebp - 0x60]
push edi
push eax
mov dword [ebp - 0x64], 0x44
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x100114c
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
cmp esi, edi
mov dword [ebp - 8], esi
jne 0x10064ea
push 0x1004954
call fcn.01006240
mov eax, 8
lea esp, [ebp - 0x70]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
je 0x1006520
cmp eax, 0x80
je 0x1006520
push 0x100491c
call fcn.01006240
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 8
lea esp, [ebp - 0x70]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ax, word [ebp + 0xc]
cmp ax, di
jne 0x1006536
call dword [sym.imp.imdisk.cpl__ImDiskFindFreeDriveLetter_0]
mov dword [ebp - 4], 1
cmp ax, di
mov word [ebp - 0x10], ax
jne 0x1006576
mov ecx, dword [sym.imp.msvcrt.dll__iob]
add ecx, 0x40
push 0x10048e8
push ecx
call dword [sym.imp.msvcrt.dll_fprintf]
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 8
lea esp, [ebp - 0x70]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 8]
push edi
lea edx, [ebp - 0x10]
push edx
call fcn.01006390
test eax, eax
jne 0x10065cf
push edi
lea eax, [ebp - 0x10]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
jne 0x10065a4
push 0x10048ac
call fcn.01006240
jmp 0x1006557
push edi
lea ecx, [ebp - 0x10]
push ecx
call fcn.01006390
test eax, eax
jne 0x10065cf
push edi
lea edx, [ebp - 0x10]
push edx
push 7
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
jne 0x1006557
push 0x1004858
call fcn.01006240
jmp 0x1006557
lea eax, [ebp - 0x10]
push eax
push 0x100483c
call dword [sym.imp.msvcrt.dll_printf]
mov eax, 0x1001168
mov edx, ebx
add esp, 8
sub edx, eax
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10065f0
lea eax, [ebp - 0x10]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1006604
mov edi, ebx
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1006616
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
add edi, 0xfffffffe
jmp 0x1006640
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1006640
mov ecx, dword [0x1004838]
mov eax, dword [ebp + 0x10]
mov dword [edi], ecx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1006660
mov edi, ebx
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1006672
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push ebx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10066d1
mov ecx, dword [ebp - 0x1c]
push ecx
call esi
mov edx, dword [ebp - 0x20]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x20]
push eax
call esi
xor ebx, ebx
jmp 0x10066e0
push 0x100480c
call fcn.01006240
mov ebx, 8
cmp dword [ebp - 4], 0
je 0x1006704
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 7
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
jne 0x1006704
push 0x1004858
call fcn.01006240
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x100671c
push 0x10047dc
call fcn.01006240
push edi
call esi
test eax, eax
jne 0x100672d
push 0x10047dc
call fcn.01006240
mov eax, ebx
lea esp, [ebp - 0x70]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc