Function at 0x405dca
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4101f8
push 0x409a04
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffff998
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call fcn.004077ec
and eax, 0xff
test eax, eax
jne 0x405e12
mov dword [0x415484], 0xc
xor eax, eax
jmp 0x406a73
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00407cb9
add esp, 8
mov eax, dword [0x41217c]
xor eax, dword [0x412178]
xor eax, dword [0x412160]
and eax, 3
push eax
call fcn.00403ff0
add esp, 4
push 0x104
push 0x415140
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
push 0x415140
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0xffffffff
je 0x405ea7
push 0
push 0
mov ecx, dword [0x412188]
xor ecx, dword [0x41216c]
xor ecx, dword [0x412160]
push ecx
mov edx, dword [ebp - 0x384]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x405eb8
mov dword [0x415484], 4
xor eax, eax
jmp 0x406a73
mov eax, dword [str.StMtx]
mov dword [ebp - 0x140], eax
mov cx, word [0x4123ac]
mov word [ebp - 0x13c], cx
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x13a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x415140
lea edx, [ebp - 0x140]
push edx
call fcn.004096e0
add esp, 8
lea eax, [ebp - 0x140]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
movsx edx, byte [ecx]
test edx, edx
je 0x405f26
mov eax, dword [ebp - 0x28]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x405f1b
mov edx, dword [ebp - 0x28]
mov byte [edx], 0x5f
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
jmp 0x405f00
lea ecx, [ebp - 0x140]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x270], eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
call fcn.00405962
add esp, 4
mov byte [ebp - 0x25c], 0
xor eax, eax
mov al, byte [0x4155b0]
test eax, eax
jne 0x40603c
push 0x415140
lea ecx, [ebp - 0x244]
push ecx
call fcn.004096d0
add esp, 8
lea edx, [ebp - 0x244]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
movsx ecx, byte [eax]
test ecx, ecx
je 0x405faf
mov edx, dword [ebp - 0x28]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x405fa4
mov ecx, dword [ebp - 0x28]
mov byte [ecx], 0x2e
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
jmp 0x405f89
lea eax, [ebp - 0x244]
push eax
push 0x1000
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x415128], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x405fe2
mov byte [ebp - 0x25c], 1
push 0x1000
push 0
push 0
push 0xf001f
mov ecx, dword [0x415128]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x415248], eax
mov edx, dword [ebp - 0x25c]
and edx, 0xff
test edx, edx
jne 0x406029
mov eax, dword [0x415248]
mov dword [eax], 1
mov ecx, dword [0x415248]
mov byte [ecx + 4], 0
jmp 0x40603c
mov edx, dword [0x415248]
mov eax, dword [edx]
add eax, 1
mov ecx, dword [0x415248]
mov dword [ecx], eax
push 1
lea edx, [ebp - 0x380]
push edx
call fcn.00407855
add esp, 8
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x380]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0xffffffff
jne 0x40608c
mov dword [0x415484], 3
xor eax, eax
jmp 0x406a73
push 0
mov ecx, dword [ebp - 0x384]
push ecx
mov edx, dword [ebp - 0x26c]
push edx
call fcn.0040773a
add esp, 0xc
and eax, 0xff
test eax, eax
jne 0x4060d0
mov dword [0x415484], 8
push str.ExtractFile_error_
push 0x415488
call fcn.004096d0
add esp, 8
xor eax, eax
jmp 0x406a73
mov eax, dword [ebp - 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x27c], 0x4675446d
mov dword [ebp - 0x258], 0x4360c26
mov dword [ebp - 0x278], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x278], ebp
mov eax, dword [ebp - 0x258]
xor eax, dword [ebp - 0x27c]
mov ebp, eax
mov eax, 4
int3
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret