Function at 0x100061f0
Capabilities:
Check mutex on windows
Get system information on windows
Resume thread
Suspend thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041378
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x768
mov eax, dword [0x100c2004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x760], eax
mov dword [ebp - 0x764], esi
mov dword [ebp - 0x9c], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10006320
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 1
mov eax, dword [edi + 8]
push ecx
push 0
push 0
push 0x10047a
push 0
push dword [ebp - 0x760]
mov dword [ebp - 0xa0], 0
call eax
mov ecx, dword [ebx + 4]
test eax, eax
js 0x100067ad
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 2
mov eax, dword [edi + 8]
push ecx
push 0
push 0
push 0x10047a
push dword [ebp - 0xa0]
mov dword [ebp - 0xb0], 0
push dword [ebp - 0x760]
call eax
cmp eax, 0x8000001a
jne 0x100063e1
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x100067b9
test eax, eax
jne 0x10006389
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0xb0]
test eax, eax
je 0x10006313
push eax
call esi
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x10006320
push eax
call esi
cmp dword [ebp - 0x9c], 0
je 0x100066c2
lea eax, [ebp - 0x9c]
mov byte [ebp - 0x76c], 1
mov dword [ebp - 0x770], eax
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 3
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0xd4], 0
jne 0x1000640a
lea eax, [ebp - 0x3b0]
mov dword [ebp - 0x3b0], 0x10001
push eax
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov ecx, dword [ebx + 4]
test eax, eax
je 0x100067c8
jmp 0x100063f1
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x768], eax
test eax, eax
je 0x100063c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x768]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa0], 0
jmp 0x10006306
mov ecx, dword [ebx + 4]
test eax, eax
js 0x100067d7
jmp 0x10006306
mov eax, dword [ebp - 0x2f8]
xor ecx, ecx
cmp eax, dword [edi + 0x10]
jne 0x100066b6
cmp ecx, dword [edi + 0x14]
jmp 0x100064ef
mov eax, dword [ebp - 0x9c]
push 0
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xa4]
push eax
push 0
push 0x100c4904
mov dword [ebp - 0x720], 0x100001
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
test eax, eax
je 0x100067e3
cmp dword [ebp - 0xa4], 0
je 0x1000647d
call fcn.1000ada0
push edx
push eax
mov ecx, str.NtGetContextThread
call fcn.1000b4f0
add esp, 8
mov dword [0x100c4a40], eax
mov dword [0x100c4a44], edx
push 0
push 0
push 0x100c4904
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
test eax, eax
je 0x100067e8
cmp dword [0x100c4a40], 0
mov ecx, dword [0x100c4a44]
jne 0x10006490
test ecx, ecx
je 0x100064ca
push 0
lea eax, [ebp - 0x750]
push eax
mov eax, dword [ebp - 0xa8]
cdq
push edx
push eax
push 2
push ecx
push dword [0x100c4a40]
call fcn.1000a8f0
add esp, 0x1c
test eax, eax
jne 0x100064c0
test edx, edx
jne 0x100064c0
lea eax, [edx + 1]
jmp 0x100064cc
push edx
push eax
call fcn.1000b3c0
add esp, 8
xor eax, eax
mov ecx, dword [ebx + 4]
test eax, eax
je 0x100067ed
mov eax, dword [ebp - 0x658]
cmp eax, dword [edi + 0x10]
jne 0x100066b6
mov eax, dword [ebp - 0x654]
cmp eax, dword [edi + 0x14]
jne 0x100066b6
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call eax
push eax
push str.WindhawkSession_u
lea eax, [ebp - 0x98]
push 0x1a
push eax
call fcn.10008ff0
push dword [ebp - 0x764]
mov ecx, 0x3d
sub ecx, eax
push str.ProcessInitAPCMutex_pid_u
push ecx
lea ecx, [ebp - 0x98]
lea eax, [ecx + eax*2]
push eax
call fcn.10008ff0
add esp, 0x20
push 0
lea eax, [ebp - 0xac]
mov byte [ebp - 4], 4
push eax
push 1
push str.D:P_A__GA___WD__A__GA___S_1_15_2_1__A__GA___S_1_15_2_2_S:_ML__NW___S_1_16_0_
mov dword [ebp - 0xac], 0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov ecx, dword [ebx + 4]
test eax, eax
je 0x100067fc
mov eax, dword [ebp - 0xac]
xorps xmm0, xmm0
movq qword [ebp - 0x758], xmm0
mov dword [ebp - 0x758], eax
lea eax, [ebp - 0x98]
push eax
push 1
lea eax, [ebp - 0x75c]
mov dword [ebp - 0x75c], 0xc
push eax
mov dword [ebp - 0x754], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0xa4], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebx + 4]
mov esi, dword [ebp - 0xa4]
test esi, esi
je 0x1000680b
mov eax, dword [ebp - 0xac]
test eax, eax
je 0x100065d1
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0xa4], esi
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000666c
mov dword [ebp - 0xa8], esi
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push dword [ebx + 0x10]
mov edx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x760]
push esi
push eax
call fcn.100091e0
add esp, 0xc
call fcn.100151f0
mov edi, eax
mov ecx, dword [edi]
cmp ecx, 2
jl 0x1000665d
call fcn.10015310
cmp byte [eax + 4], 0
je 0x10006635
xor ecx, ecx
cmp dword [eax], 2
jmp 0x1000663d
mov eax, dword [edi + 4]
xor ecx, ecx
cmp eax, 2
setge cl
test cl, cl
je 0x1000665d
push dword [ebp - 0x764]
push str.AllProcessesInjector::InjectIntoNewProcess
push str._WH____S_:_DllInject_succeeded_for_new_process__u_via_APC_n
push edi
call fcn.100011c0
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
je 0x1000681a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
test eax, eax
je 0x10006828
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x9c]
test eax, eax
je 0x10006696
push eax
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1002db4b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call eax
push eax
push str.WindhawkSession_u
lea eax, [ebp - 0x98]
push 0x1a
push eax
call fcn.10008ff0
push dword [ebp - 0x764]
mov ecx, 0x3d
sub ecx, eax
push str.ProcessInitAPCMutex_pid_u
push ecx
lea ecx, [ebp - 0x98]
lea eax, [ecx + eax*2]
push eax
call fcn.10008ff0
add esp, 0x20
lea eax, [ebp - 0x98]
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0xa4], eax
mov byte [ebp - 4], 8
test eax, eax
jne 0x10006794
push dword [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 0x760]
xor edx, edx
push eax
call fcn.100091e0
add esp, 0xc
call fcn.100151f0
mov edi, eax
mov ecx, dword [edi]
cmp ecx, 2
jl 0x10006689
call fcn.10015310
cmp byte [eax + 4], 0
je 0x10006763
xor ecx, ecx
cmp dword [eax], 2
jmp 0x1000676b
mov eax, dword [edi + 4]
xor ecx, ecx
cmp eax, 2
setge cl
test cl, cl
je 0x10006689
push dword [ebp - 0x764]
push str.AllProcessesInjector::InjectIntoNewProcess
push str._WH____S_:_DllInject_succeeded_for_new_process__u_via_a_remote_thread_n
push edi
call fcn.100011c0
add esp, 0x10
jmp 0x10006689
push eax
call esi
test eax, eax
jne 0x10006689
push ecx
mov ecx, dword [ebx + 4]
mov edx, 0x93e
call fcn.10008040
push eax
push ecx
mov edx, 0x118
call fcn.10007a70
push str.engine_all_processes_injector.cpp
mov edx, 0x120
call fcn.10008fa0
push str.engine_all_processes_injector.cpp
mov edx, 0x143
call fcn.10008fa0
push eax
push ecx
mov edx, 0x129
call fcn.10007a70
call fcn.1003449d
call fcn.1002d0e7
push str.engine_all_processes_injector.cpp
mov edx, 0x14b
call fcn.10008fa0
push str.engine_all_processes_injector.cpp
mov edx, 0x1f
call fcn.10008fa0
push str.engine_all_processes_injector.cpp
mov edx, 0x27
call fcn.10008fa0
push ecx
mov ecx, dword [ebx + 4]
mov edx, 0x948
call fcn.10008040
push ecx
mov ecx, dword [ebx + 4]
mov edx, 0x93e
call fcn.10008040
int3