Function at 0x5467a0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Create process suspended
Get common file path
Hide graphical window
Read file via mapping
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x612570
push 0x5cdc5c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov esi, dword [eax]
mov dword [ebp - 0x68], 0x27f
wait
fninit
fldcw word [ebp - 0x68]
mov eax, dword [0x6bd110]
xor ebx, ebx
cmp eax, ebx
je 0x546801
push 0x6bd114
mov ecx, dword [0x6bd114]
push ecx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x6bd110], ebx
cmp dword [0x6bddd8], ebx
je 0x546818
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x6bddd8], 1
cmp dword [esi], 0xc00000fd
jne 0x546845
mov esi, esp
lea edi, [esi + 0x10000]
mov ecx, 0x4000
rep movsd dword es:[edi], dword [esi]
add ebp, 0x10000
add esp, 0x10000
push str.faultrep.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
je 0x546865
push str.ReportFault
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6bd118], eax
wait
mov dword [ebp - 4], ebx
mov byte [0x6bd095], 1
call fcn.00525b70
call fcn.0051bb30
call fcn.0054e650
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
mov eax, dword [0x6bd0ac]
cmp eax, ebx
je 0x5468ef
mov edx, dword [str.KeystoneEditbox]
push edx
push eax
call dword [0x6bd0c0]
add esp, 8
mov dword [ebp - 0x6c], eax
cmp eax, ebx
je 0x5468b2
push eax
call dword [0x6bd0d0]
add esp, 4
mov eax, dword [str.KeystoneChatLog]
push eax
mov ecx, dword [0x6bd0ac]
push ecx
call dword [0x6bd0c0]
add esp, 8
mov dword [ebp - 0x6c], eax
cmp eax, ebx
je 0x5468d9
push eax
call dword [0x6bd0d0]
add esp, 4
mov edx, dword [0x6bd0ac]
push edx
call dword [0x6bd0b4]
add esp, 4
mov dword [0x6bd0ac], ebx
mov eax, dword [0x6e13c4]
cmp eax, ebx
je 0x546901
push 6
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
wait
jmp 0x54690d
mov dword [ebp - 4], 0xffffffff
wait
mov dword [ebp - 4], 1
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [ebp - 0x58], edi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x7c], eax
mov dword [eax], 0x80c800c0
mov word [eax + 8], 1
xor ecx, ecx
mov word [eax + 0xa], cx
mov word [eax + 0xc], cx
mov word [eax + 0xe], 0xa3
mov word [eax + 0x10], 0x37
lea esi, [eax + 0x12]
mov dword [ebp - 0x1c], esi
mov word [esi], cx
add esi, 2
mov dword [ebp - 0x1c], esi
mov word [esi], cx
add esi, 2
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x60], esi
push 0x32
push esi
push 0xffffffffffffffff
push 0x68b668
push ecx
push ecx
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call ebx
mov dword [ebp - 0x5c], eax
lea esi, [esi + eax*2]
mov dword [ebp - 0x1c], esi
mov word [esi], 8
add esi, 2
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x60], esi
push 0x32
push esi
push 0xffffffffffffffff
push str.MS_Sans_Serif
push 0
push 0
call ebx
mov dword [ebp - 0x5c], eax
lea eax, [esi + eax*2]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x50], eax
add eax, 3
mov dword [ebp - 0x50], eax
shr eax, 2
mov dword [ebp - 0x50], eax
shl eax, 2
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x80], eax
mov dword [eax], 0x50020000
mov word [eax + 0x10], 0xffff
mov word [eax + 8], 0x1c
mov word [eax + 0xa], 0x17
mov word [eax + 0xc], 0x6c
mov word [eax + 0xe], 8
lea esi, [eax + 0x12]
mov dword [ebp - 0x1c], esi
mov word [esi], 0xffff
add esi, 2
mov dword [ebp - 0x1c], esi
mov word [esi], 0x82
add esi, 2
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x60], esi
push 0x32
push esi
push 0xffffffffffffffff
push 0x68b568
push 0
push 0
call ebx
inc eax
mov dword [ebp - 0x5c], eax
lea eax, [esi + eax*2]
mov dword [ebp - 0x1c], eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
push 0x546700
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov esi, eax
mov dword [ebp - 0x2c], esi
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
mov edi, edi
push 1
push 0
push 0
push esi
lea ecx, [ebp - 0x100]
push ecx
call edi
test eax, eax
je 0x546a9f
lea edx, [ebp - 0x100]
push edx
call ebx
jmp 0x546a80
wait
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x48], 0xc
mov dword [ebp - 0x40], 1
push eax
push 0x1c50
push eax
push 4
lea ecx, [ebp - 0x48]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x4c], eax
test eax, eax
jne 0x546af5
mov eax, dword [0x6bd118]
test eax, eax
je 0x546aed
push 0
mov edx, dword [ebp + 8]
push edx
call eax
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 6
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp - 0x54], ebx
test ebx, ebx
jne 0x546b28
mov eax, dword [0x6bd118]
test eax, eax
je 0x546b20
push ebx
mov ecx, dword [ebp + 8]
push ecx
call eax
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x714
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
push eax
push eax
push eax
lea edx, [ebp - 0x48]
push edx
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
call esi
mov edi, eax
mov dword [ebp - 0x64], edi
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
call esi
mov dword [ebp - 0x28], eax
push 0
push 0
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x24], eax
push 0
push 1
push 0x1f0fff
lea edx, [ebx + 0x24]
push edx
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
push eax
call esi
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x546ba6
mov eax, dword [0x6bd118]
test eax, eax
je 0x546b9e
push 0
mov ecx, dword [ebp + 8]
push ecx
call eax
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x5471f0
test edi, edi
je 0x5471f0
mov esi, dword [ebp - 0x24]
test esi, esi
je 0x5471f0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 8], eax
mov edx, dword [ebp - 0x28]
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x20], esi
mov dword [ebx], 0x1c50
mov eax, dword [ebp + 8]
mov dword [ebx + 0x10], eax
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov dword [ebx + 0xc], ecx
mov dword [ebx + 0x34], 1
mov dword [ebx + 0x28], 0x100
push 0x60d4a4
lea edx, [ebx + 0x48]
push edx
call fcn.005cab9a
add esp, 8
push 0x104
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x204]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x546c32
sub eax, esi
push eax
lea ecx, [ebp - 0x204]
push ecx
lea edx, [ebx + 0xb8]
push edx
call fcn.005cbb24
add esp, 0xc
lea edi, [ebx + 0x1148]
mov ecx, 9
mov esi, str.MicrosoftPCHealthErrorReportingDW
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebx + 0x3c], 0x11
lea eax, [ebx + 0xe38]
mov ecx, dword [str.watson.microsoft.com]
mov dword [eax], ecx
mov edx, dword [0x610a3c]
mov dword [eax + 4], edx
mov ecx, dword [0x610a40]
mov dword [eax + 8], ecx
mov edx, dword [0x610a44]
mov dword [eax + 0xc], edx
mov ecx, dword [0x610a48]
mov dword [eax + 0x10], ecx
mov dl, byte [0x610a4c]
mov byte [eax + 0x14], dl
mov byte [ebp - 0x81c], 0
wait
mov dword [ebp - 4], 2
mov ecx, 0x11
xor eax, eax
lea edi, [ebp - 0xc8]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc8], 0x44
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x920]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [ebp - 0x920]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x546cf4
mov edx, dword [str.dxdiag.txt]
mov dword [edi], edx
mov eax, dword [0x610a30]
mov dword [edi + 4], eax
mov cx, word [0x610a34]
mov word [edi + 8], cx
mov dl, byte [0x610a36]
mov byte [edi + 0xa], dl
lea eax, [ebp - 0x920]
push eax
push str.dxdiag.exe__whql:off__t__s
lea ecx, [ebp - 0xb28]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x3c]
push edx
lea eax, [ebp - 0xc8]
push eax
push 0
push 0
push 0x4000020
push 0
push 0
push 0
lea ecx, [ebp - 0xb28]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x546e5e
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [ebp - 0x70], eax
push 0x40
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, dword [ebp - 0x2c]
lea ecx, [ecx]
push 0xff
push 0xea60
push 0
lea edx, [ebp - 0x3c]
push edx
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov esi, eax
mov dword [ebp - 0x74], esi
test esi, esi
jne 0x546df0
mov al, byte [ebp - 0x81c]
test al, al
je 0x546dd6
lea edi, [ebp - 0x81c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x546dc2
mov ax, word [0x610a0c]
mov word [edi], ax
mov edi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x920]
lea edx, [ebp - 0x81c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x546de2
lea esp, [esp]
push 1
push 0
push 0
push edi
lea ecx, [ebp - 0xe4]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x546e2b
cmp dword [ebp - 0xe0], 0x111
jne 0x546e1c
mov esi, 0x102
mov dword [ebp - 0x74], esi
lea edx, [ebp - 0xe4]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x546df0
test esi, esi
je 0x546e3b
cmp esi, 0x102
jne 0x546d90
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov ecx, dword [ebp - 0x3c]
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov edx, dword [ebp - 0x38]
push edx
call esi
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x546e7b
mov al, byte [ebp - 0x81c]
test al, al
je 0x546ea1
lea edi, [ebp - 0x81c]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x546e90
mov ax, word [0x610a0c]
mov word [edi], ax
lea ecx, [ebp - 0x308]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x308]
mov edx, eax
jmp 0x546ec0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x546ec0
sub eax, edx
lea edi, [ebp - 0x81c]
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x546ed0
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x81c]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x546ef0
mov edx, dword [str.debug.txt]
mov dword [edi], edx
mov eax, dword [0x610a04]
mov dword [edi + 4], eax
mov cx, word [0x610a08]
mov word [edi + 8], cx
mov dl, byte [0x610a0a]
mov byte [edi + 0xa], dl
mov al, byte [ebp - 0x81c]
test al, al
je 0x546f41
lea edi, [ebp - 0x81c]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x546f30
mov ax, word [0x610a0c]
mov word [edi], ax
lea eax, [ebp - 0x308]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x546f50
sub eax, edx
lea edi, [ebp - 0x81c]
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x546f60
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x81c]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x546f80
mov ecx, dword [str._network.log]
mov dword [edi], ecx
mov edx, dword [0x6109f4]
mov dword [edi + 4], edx
mov eax, dword [0x6109f8]
mov dword [edi + 8], eax
mov cl, byte [0x6109fc]
mov byte [edi + 0xc], cl
mov al, byte [ebp - 0x81c]
test al, al
je 0x546fe2
lea edx, [ebp - 0x81c]
push edx
call fcn.005cc646
add esp, 4
push 0x400
lea eax, [ebx + 0x1418]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x81c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
wait
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x546ffa
mov edx, eax
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x547008
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x547025
mov dword [ebp - 0x20], 1
mov ecx, 0x11
xor eax, eax
lea edi, [ebp - 0xc8]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc8], 0x44
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x4c]
push edx
push str..Watsondw15.exe__x__s__u
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
wait
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0xc8]
push edx
push 0
push 0
push 0x4000020
push 1
push 0
push 0
lea eax, [ebp - 0x40c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x5471b5
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [ebp - 0x64]
mov edi, edi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x547144
push 0x927c0
mov ecx, dword [ebp - 0x28]
push ecx
call esi
test eax, eax
jne 0x5470d8
push 1
push edi
call esi
test eax, eax
jne 0x5470b0
mov dword [ebp - 0x20], eax
jmp 0x5470b0
push 0x4e20
mov edx, dword [ebp - 0x24]
push edx
call esi
mov dword [ebp - 0x78], eax
cmp eax, 0x102
jne 0x5470f6
mov dword [ebp - 0x20], 0
jmp 0x5470b0
cmp eax, 0x80
jne 0x547110
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x5470b0
push 1
mov ecx, dword [ebp - 0x28]
push ecx
call esi
test eax, eax
je 0x547125
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x54712e
push 1
push edi
call esi
test eax, eax
jne 0x547135
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x5470b0
mov eax, dword [ebp - 0x3c]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov ecx, dword [ebp - 0x38]
push ecx
call esi
mov edx, dword [ebp - 0x28]
push edx
call esi
push edi
call esi
mov eax, dword [ebp - 0x24]
push eax
call esi
test byte [ebx + 0x2c], 1
mov eax, 0
setne al
inc eax
mov dword [ebp - 0x84], eax
wait
mov dword [ebp - 4], 0xffffffff
cmp eax, 1
jne 0x5471ad
mov ecx, dword [ebx + 0x24]
push ecx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 0x4c]
push edx
call esi
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x6bd118]
test eax, eax
je 0x5471c6
push 0
mov ecx, dword [ebp + 8]
push ecx
call eax
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x6bd118]
test eax, eax
je 0x547201
push 0
mov ecx, dword [ebp + 8]
push ecx
call eax
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]