Function at 0x64612057
Capabilities:
Check if file exists
Check mutex on windows
Copy file
Create process on windows
Delete file
Get common file path
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xca0
mov eax, dword [0x646170a0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
xor edi, edi
mov dword [ebp - 0xc54], ecx
push 0x200
push edi
push eax
mov ebx, edx
mov dword [ebp - 0xc44], esi
mov dword [ebp - 0xc4c], edi
mov dword [ebp - 0xc3c], edi
mov dword [ebp - 0xc30], edi
mov dword [ebp - 0xc60], edi
mov dword [ebp - 0xc5c], edi
mov dword [ebp - 0xc38], edi
mov dword [ebp - 0xc34], edi
mov dword [ebp - 0xc48], edi
mov dword [ebp - 0xc58], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x614]
push 0x200
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x6461210d
test byte [eax + 0x1c], 2
je 0x6461210d
cmp byte [eax + 0x19], 5
jb 0x6461210d
push dword [eax + 0x14]
mov edx, 0x64602f00
push dword [eax + 0x10]
push 0x54
pop ecx
call fcn.64604453
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x6461211f
add eax, 2
lea ecx, [ebp - 0xc34]
push ecx
lea edx, [ebp - 0xc38]
mov ecx, eax
call fcn.64611719
mov esi, eax
test esi, esi
je 0x64612173
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612165
test byte [eax + 0x1c], 2
je 0x64612165
cmp byte [eax + 0x19], 2
jb 0x64612165
push esi
push dword [eax + 0x14]
mov edx, 0x64602f00
push dword [eax + 0x10]
push 0x55
pop ecx
call fcn.64604471
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x64612e73
lea eax, [ebp - 0x81c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x646121d8
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646121c0
test byte [eax + 0x1c], 2
je 0x646121c0
cmp byte [eax + 0x19], 2
jb 0x646121c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64602f00
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x56
pop ecx
call fcn.64604471
mov ecx, dword [ebp - 0xc38]
call fcn.6460ce29
mov ecx, dword [ebp - 0xc34]
call fcn.6460ce29
jmp 0x6461216c
push 0x100
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push ebx
call dword [sym.imp.msvcrt.dll__wsplitpath_s]
add esp, 0x24
test eax, eax
je 0x64612230
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612223
test byte [eax + 0x1c], 2
je 0x64612223
cmp byte [eax + 0x19], 2
jb 0x64612223
push dword [eax + 0x14]
mov edx, 0x64602f00
push dword [eax + 0x10]
push 0x57
pop ecx
call fcn.64604453
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x646121c0
push 1
lea eax, [ebp - 0x20c]
push 0x6460266c
push eax
mov dword [ebp - 0xc50], eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x6461225f
lea eax, [ebp - 0x20a]
mov dword [ebp - 0xc50], eax
jmp 0x64612265
lea eax, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x414]
push ecx
push eax
push ecx
lea edx, [ebp - 0x81c]
call fcn.6460f7b4
cmp eax, edi
jne 0x646122ca
cmp edx, edi
jne 0x646122ca
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612e5b
test byte [eax + 0x1c], 2
je 0x64612e5b
cmp byte [eax + 0x19], 2
jb 0x64612e5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64602f00
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x58
pop ecx
call fcn.64604471
jmp 0x64612e5b
push edi
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x64612322
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612bdd
test byte [eax + 0x1c], 2
je 0x64612bdd
cmp byte [eax + 0x19], 2
jb 0x64612bdd
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x59
mov edx, 0x64602f00
pop ecx
call fcn.64604471
jmp 0x64612bdd
push edi
push edi
push 0x100
lea eax, [ebp - 0x614]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x414]
push edi
push eax
call dword [sym.imp.msvcrt.dll__wsplitpath_s]
add esp, 0x24
test eax, eax
je 0x6461237d
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612373
test byte [eax + 0x1c], 2
je 0x64612373
cmp byte [eax + 0x19], 2
jb 0x64612373
push dword [eax + 0x14]
mov edx, 0x64602f00
push dword [eax + 0x10]
push 0x5a
pop ecx
call fcn.64604453
mov esi, 0x65b
jmp 0x64612bdd
push 0x64602dec
push edi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ebx, eax
mov dword [ebp - 0xc30], ebx
test ebx, ebx
jne 0x64612492
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x646123dd
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612bdd
test byte [eax + 0x1c], 2
je 0x64612bdd
cmp byte [eax + 0x19], 2
jb 0x64612bdd
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x5b
jmp 0x64612312
mov eax, 0x1f0001
mov esi, edi
push edi
mov edx, eax
mov ecx, eax
call fcn.646150bd
mov ebx, eax
test ebx, ebx
jne 0x6461242e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612bdd
test byte [eax + 0x1c], 2
je 0x64612bdd
cmp byte [eax + 0x19], 2
jb 0x64612bdd
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x5c
jmp 0x64612312
push 0x64602dec
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0xc30], eax
test eax, eax
jne 0x64612486
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x6461247a
test byte [eax + 0x1c], 2
je 0x6461247a
cmp byte [eax + 0x19], 2
jb 0x6461247a
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x5d
mov edx, 0x64602f00
pop ecx
call fcn.64604471
mov ecx, ebx
call fcn.646154c5
jmp 0x64612bdd
mov ecx, ebx
call fcn.646154c5
jmp 0x64612554
push 0x493e0
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x646124e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646124d7
test byte [eax + 0x1c], 2
je 0x646124d7
cmp byte [eax + 0x19], 2
jb 0x646124d7
push esi
push dword [eax + 0x14]
mov edx, 0x64602f00
push dword [eax + 0x10]
push 0x5e
pop ecx
call fcn.64604471
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc30], edi
jmp 0x64612bdd
cmp eax, 0x102
jne 0x64612522
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x6461251b
test byte [eax + 0x1c], 2
je 0x6461251b
cmp byte [eax + 0x19], 2
jb 0x6461251b
push dword [eax + 0x14]
mov edx, 0x64602f00
push dword [eax + 0x10]
push 0x5f
pop ecx
call fcn.64604453
mov esi, 0x102
jmp 0x646124d7
cmp eax, 0x80
jne 0x64612554
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612554
test byte [eax + 0x1c], 2
je 0x64612554
cmp byte [eax + 0x19], 3
jb 0x64612554
push dword [eax + 0x14]
mov edx, 0x64602f00
push dword [eax + 0x10]
push 0x60
pop ecx
call fcn.64604453
push edi
xor edx, edx
mov ecx, 0x1f0003
call fcn.646150bd
mov dword [ebp - 0xc40], eax
test eax, eax
jne 0x646125a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612bdd
test byte [eax + 0x1c], 2
je 0x64612bdd
cmp byte [eax + 0x19], 2
jb 0x64612bdd
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x61
jmp 0x64612312
mov ebx, edi
cmp dword [ebp + ebx - 0xc60], edi
jne 0x646125d1
push dword [ebp + ebx - 0xc38]
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp + ebx - 0xc60], eax
test eax, eax
je 0x6461262f
mov eax, dword [ebp - 0xc40]
add ebx, 4
cmp ebx, 8
jb 0x646125a7
mov ecx, eax
call fcn.646154c5
push dword [ebp - 0xc44]
push 0x64602e20
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x6461266e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612bdd
test byte [eax + 0x1c], 2
je 0x64612bdd
cmp byte [eax + 0x19], 2
jb 0x64612bdd
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x63
jmp 0x64612312
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612663
test byte [eax + 0x1c], 2
je 0x64612663
cmp byte [eax + 0x19], 2
jb 0x64612663
push esi
push dword [eax + 0x14]
mov edx, 0x64602f00
push dword [eax + 0x10]
push 0x62
pop ecx
call fcn.64604471
mov ecx, dword [ebp - 0xc40]
jmp 0x6461247c
push edi
push 6
xor edx, edx
pop ecx
call fcn.646150bd
mov ebx, eax
test ebx, ebx
jne 0x646126b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612bdd
test byte [eax + 0x1c], 2
je 0x64612bdd
cmp byte [eax + 0x19], 2
jb 0x64612bdd
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x64
jmp 0x64612312
push 0x64602e44
push 0x1000
push edi
push 0x8000004
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0xc4c], eax
test eax, eax
jne 0x64612718
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x6461247a
test byte [ecx + 0x1c], 2
je 0x6461247a
cmp byte [ecx + 0x19], 2
jb 0x6461247a
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x65
jmp 0x6461246f
mov ecx, ebx
call fcn.646154c5
mov eax, dword [ebp - 0xc4c]
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc48], eax
test eax, eax
jne 0x64612777
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x64612bdd
test byte [ecx + 0x1c], 2
je 0x64612bdd
cmp byte [ecx + 0x19], 2
jb 0x64612bdd
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x66
jmp 0x64612312
push ecx
push dword [ebp - 0xc44]
mov edx, 0x800
push ecx
mov ecx, eax
call fcn.646043da
mov ebx, eax
test ebx, ebx
jns 0x646127d9
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x646127bf
test byte [ecx + 0x1c], 2
je 0x646127bf
cmp byte [ecx + 0x19], 2
jb 0x646127bf
push ebx
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x67
mov edx, 0x64602f00
pop ecx
call fcn.64604471
mov eax, ebx
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x64612b49
movzx esi, bx
jmp 0x64612bdd
mov eax, dword [ebp - 0xc48]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov ebx, dword [ebp - 0xc44]
pop ecx
pop ecx
lea edx, [eax + 2]
mov dword [ebp - 0xc40], edx
test ebx, ebx
je 0x64612818
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, di
jne 0x646127ff
sub ebx, ecx
sar ebx, 1
push 0xfffffffffffffffe
pop ecx
lea eax, [ebx + ebx]
sub ecx, eax
jmp 0x6461281a
mov ecx, edi
lea eax, [ecx + 0x1000]
shr eax, 1
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, 0x7ff8ffa9
add ebx, 0x80070057
test eax, eax
je 0x64612850
push ecx
lea ecx, [ebp - 0x614]
mov edx, eax
push ecx
push ecx
mov ecx, dword [ebp - 0xc40]
call fcn.646043da
mov ebx, eax
test ebx, ebx
jns 0x64612886
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646127bf
test byte [eax + 0x1c], 2
je 0x646127bf
cmp byte [eax + 0x19], 2
jb 0x646127bf
push ebx
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x68
jmp 0x646127b4
push dword [ebp - 0xc54]
lea eax, [ebp - 0xc2c]
push 0x64602e7c
push 0x208
push eax
call fcn.64604373
mov ebx, eax
add esp, 0x10
test ebx, ebx
jns 0x646128df
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x646127bf
test byte [ecx + 0x1c], 2
je 0x646127bf
cmp byte [ecx + 0x19], 2
jb 0x646127bf
push ebx
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x69
jmp 0x646127b4
lea eax, [ebp - 0x414]
mov dword [ebp - 0xc9c], 0x3c
mov dword [ebp - 0xc8c], eax
lea eax, [ebp - 0xc2c]
mov dword [ebp - 0xc88], eax
lea eax, [ebp - 0x81c]
mov dword [ebp - 0xc84], eax
mov eax, dword [ebp - 0xc50]
push 0x64602e98
push eax
mov dword [ebp - 0xc98], 0x500
mov dword [ebp - 0xc94], edi
mov dword [ebp - 0xc90], 0x64602e88
mov dword [ebp - 0xc80], 7
mov dword [ebp - 0xc7c], edi
mov dword [ebp - 0xc78], edi
mov dword [ebp - 0xc74], edi
mov dword [ebp - 0xc70], edi
mov dword [ebp - 0xc6c], edi
mov dword [ebp - 0xc68], edi
mov dword [ebp - 0xc64], edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x64612984
or dword [ebp - 0xc98], 1
mov dword [ebp - 0xc74], 0x64602ea0
push edi
xor edx, edx
mov ecx, 0x1f0001
call fcn.646150bd
mov ebx, eax
test ebx, ebx
jne 0x646129d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612bdd
test byte [eax + 0x1c], 2
je 0x64612bdd
cmp byte [eax + 0x19], 2
jb 0x64612bdd
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x6a
jmp 0x64612312
push 0x64602ec0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0xc3c], eax
test eax, eax
jne 0x64612a24
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x6461247a
test byte [ecx + 0x1c], 2
je 0x6461247a
cmp byte [ecx + 0x19], 2
jb 0x6461247a
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x6b
jmp 0x6461246f
mov ecx, ebx
call fcn.646154c5
lea eax, [ebp - 0xc9c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x64612ac1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612a74
test byte [eax + 0x1c], 2
je 0x64612a74
cmp byte [eax + 0x19], 2
jb 0x64612a74
push esi
push dword [eax + 0x14]
mov edx, 0x64602f00
push dword [eax + 0x10]
push 0x6c
pop ecx
call fcn.64604471
cmp esi, 0x483
jne 0x64612a9e
lea ecx, [ebp - 0x414]
call fcn.646118d2
test eax, eax
je 0x64612aa2
mov ecx, dword [ebp - 0xc54]
lea edx, [ebp - 0x414]
call fcn.6461195c
mov esi, eax
test esi, esi
je 0x64612ac1
lea eax, [ebp - 0x20c]
push eax
push 0xc0007d73
push 1
push 1
push 3
call fcn.646155be
add esp, 0x14
jmp 0x64612bdd
push 0x493e0
push edi
lea eax, [ebp - 0xc60]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
jne 0x64612b15
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612bdd
test byte [eax + 0x1c], 2
je 0x64612bdd
cmp byte [eax + 0x19], 2
jb 0x64612bdd
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x6d
jmp 0x64612312
mov ebx, 0x102
cmp eax, ebx
jne 0x64612b50
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612b49
test byte [eax + 0x1c], 2
je 0x64612b49
cmp byte [eax + 0x19], 2
jb 0x64612b49
push dword [eax + 0x14]
mov edx, 0x64602f00
push dword [eax + 0x10]
push 0x6e
pop ecx
call fcn.64604453
mov esi, ebx
jmp 0x64612bdd
xor ebx, ebx
inc ebx
cmp eax, ebx
jne 0x64612b89
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612b82
test byte [eax + 0x1c], 2
je 0x64612b82
cmp byte [eax + 0x19], 2
jb 0x64612b82
push dword [eax + 0x14]
mov edx, 0x64602f00
push dword [eax + 0x10]
push 0x6f
pop ecx
call fcn.64604453
mov esi, 0x4d3
jmp 0x64612bdd
mov eax, dword [ebp - 0xc3c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x64612bd1
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612bd1
test byte [eax + 0x1c], 2
je 0x64612bd1
cmp byte [eax + 0x19], 3
jb 0x64612bd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64602f00
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x70
pop ecx
call fcn.64604471
mov dword [ebp - 0xc3c], edi
mov dword [ebp - 0xc58], ebx
push edi
push 0x64602e20
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x64612c24
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612c24
test byte [eax + 0x1c], 2
je 0x64612c24
cmp byte [eax + 0x19], 3
jb 0x64612c24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64602f00
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x71
pop ecx
call fcn.64604471
mov ebx, edi
mov eax, dword [ebp + ebx*4 - 0xc60]
test eax, eax
je 0x64612c73
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x64612c73
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612c73
test byte [eax + 0x1c], 2
je 0x64612c73
cmp byte [eax + 0x19], 3
jb 0x64612c73
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64602f00
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x72
pop ecx
call fcn.64604471
inc ebx
cmp ebx, 2
jb 0x64612c26
mov eax, dword [ebp - 0xc3c]
test eax, eax
je 0x64612cc5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x64612cc5
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612cc5
test byte [eax + 0x1c], 2
je 0x64612cc5
cmp byte [eax + 0x19], 3
jb 0x64612cc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64602f00
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x73
pop ecx
call fcn.64604471
mov eax, dword [ebp - 0xc48]
test eax, eax
je 0x64612d11
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x64612d11
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612d11
test byte [eax + 0x1c], 2
je 0x64612d11
cmp byte [eax + 0x19], 3
jb 0x64612d11
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64602f00
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x74
pop ecx
call fcn.64604471
mov eax, dword [ebp - 0xc4c]
test eax, eax
je 0x64612d5d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x64612d5d
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612d5d
test byte [eax + 0x1c], 2
je 0x64612d5d
cmp byte [eax + 0x19], 3
jb 0x64612d5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64602f00
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x75
pop ecx
call fcn.64604471
mov ebx, dword [ebp - 0xc30]
test ebx, ebx
je 0x64612def
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x64612dad
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612dad
test byte [eax + 0x1c], 2
je 0x64612dad
cmp byte [eax + 0x19], 3
jb 0x64612dad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64602f00
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x76
pop ecx
call fcn.64604471
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x64612def
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612def
test byte [eax + 0x1c], 2
je 0x64612def
cmp byte [eax + 0x19], 3
jb 0x64612def
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64602f00
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x77
pop ecx
call fcn.64604471
mov ebx, dword [ebp - 0xc58]
test ebx, ebx
jne 0x64612e00
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x64612e59
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612e48
test byte [eax + 0x1c], 2
je 0x64612e48
cmp byte [eax + 0x19], 3
jb 0x64612e48
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64602f00
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x78
pop ecx
call fcn.64604471
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 5
jb 0x64612e00
mov edi, ebx
mov ecx, dword [ebp - 0xc38]
call fcn.6460ce29
mov ecx, dword [ebp - 0xc34]
call fcn.6460ce29
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.64615e30
leave
ret 4