Function at 0x40cb63
Capabilities:
Check mutex on windows
Delete file
Enumerate gui resources
Get file size
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x41b70c
call fcn.0040f840
sub esp, 0x158
push ebx
push esi
push edi
push 1
pop edi
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 0xc], edi
jne 0x40cc38
mov eax, dword [ebp + 0x10]
dec eax
je 0x40cc20
dec eax
je 0x40cc08
dec eax
je 0x40cbf0
dec eax
je 0x40cbd8
dec eax
je 0x40cbbd
dec eax
jne 0x40cc95
push 0x421b88
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0x420980
push dword [0x421b88]
jmp 0x40cc60
push 0x421b84
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0x420984
push dword [0x421b84]
jmp 0x40cc60
push 0x421b9c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0x420988
push dword [0x421b9c]
jmp 0x40cc60
push 0x421b94
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0x420990
push dword [0x421b94]
jmp 0x40cc60
push 0x421b90
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0x420994
push dword [0x421b90]
jmp 0x40cc60
push 0x421b8c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0x420998
push dword [0x421b8c]
jmp 0x40cc60
cmp dword [ebp + 0xc], 2
jne 0x40cc69
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x421b98]
add ecx, eax
push ecx
push 0x421b98
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0x42098c
push dword [0x421b98]
call fcn.0040be61
pop ecx
pop ecx
jmp 0x40cc95
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
xor ebx, ebx
cmp dword [ebp + 0xc], 3
jne 0x40cca9
push 2
push 0x40ca74
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x420910]
xor ecx, ecx
cmp dword [ebp + 0x10], ebx
sete cl
cmp ecx, eax
jne 0x40cc9c
mov eax, edi
jmp 0x40d47c
push ecx
push 0x420910
mov edi, eax
call esi
mov dword [ebp + 0x10], edi
mov eax, dword [0x421b98]
mov ecx, dword [0x421b80]
add ecx, eax
add ecx, dword [0x421b9c]
add ecx, dword [0x421b94]
add ecx, dword [0x421b90]
add ecx, dword [0x421b8c]
je 0x40d479
mov dword [ebp - 0x18], ebx
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], ebx
call fcn.0040d9bc
cmp dword [0x420914], ebx
jne 0x40cd02
push 0x421ba0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 1
push 0x420914
call esi
mov dword [ebp + 0xc], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x34], ebx
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 1
call fcn.0040dc1d
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x40cd2c
mov eax, dword [eax]
jmp 0x40cd2e
xor eax, eax
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x40cd39
xor edi, edi
jmp 0x40cd6a
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x2c], eax
add eax, 3
and al, 0xfc
call fcn.0040fc80
mov edi, esp
push ebx
push ebx
push dword [ebp - 0x2c]
mov byte [edi], bl
push edi
push 0xffffffffffffffff
push dword [ebp - 0x14]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
lea eax, [ebp - 0x164]
push str._sbackup.tmp
push eax
call fcn.0040f85f
add esp, 0xc
lea eax, [ebp - 0x164]
push ebx
push 0x80
push 3
push ebx
push ebx
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x3c], ebx
cmp edi, 0xffffffff
je 0x40cde1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebx
mov dword [ebp - 0x20], eax
je 0x40cdda
add eax, 2
push eax
call fcn.0040f8b1
pop ecx
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x3c]
push ebx
push ecx
push dword [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x28]
mov byte [eax + ecx], bl
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.EzulaMutexObject
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x40cfac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40ce19
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
jne 0x40cfa3
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x40ce27
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
jmp 0x40ce2a
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jne 0x40ce33
xor edi, edi
jmp 0x40ce64
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x2c], eax
add eax, 3
and al, 0xfc
call fcn.0040fc80
mov edi, esp
push ebx
push ebx
push dword [ebp - 0x2c]
mov byte [edi], bl
push edi
push 0xffffffffffffffff
push dword [ebp - 0x10]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
lea eax, [ebp - 0x164]
push str._sids.tmp
push eax
call fcn.0040f85f
add esp, 0xc
lea eax, [ebp - 0x164]
push ebx
push 0x80
push 4
push ebx
push ebx
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x3c], ebx
je 0x40cfa3
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov eax, dword [ebp - 0x20]
lea eax, [edi + eax + 0xc8]
push eax
call fcn.0040f8b1
mov dword [ebp + 0xc], eax
lea eax, [edi + 2]
push eax
call fcn.0040f8b1
pop ecx
mov dword [ebp - 0x30], eax
pop ecx
lea ecx, [ebp - 0x3c]
push ebx
push ecx
push edi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30]
mov byte [eax + ecx], bl
mov edi, dword [0x421b80]
mov eax, dword [ebp - 0x34]
sub edi, dword [0x421ba0]
cmp eax, ebx
je 0x40cf02
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
jmp 0x40cf05
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jne 0x40cf0e
xor eax, eax
jmp 0x40cf45
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x2c], eax
add eax, 3
and al, 0xfc
call fcn.0040fc80
mov eax, esp
push ebx
push ebx
mov dword [ebp - 0x38], eax
push dword [ebp - 0x2c]
mov byte [eax], bl
push eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x38]
push dword [ebp - 0x30]
push dword [0x421b88]
push dword [0x421b84]
push dword [0x421ba0]
push dword [0x421b9c]
push dword [0x421b98]
push dword [0x421b94]
push dword [0x421b90]
push dword [0x421b8c]
push edi
push dword [ebp + 0x10]
push eax
push str._s_t_d_t_d_t_d_t_d_t_d_t_d_t_d_t_d_t_d_t_d_t0_t_s_r_n
push dword [ebp + 0xc]
call fcn.0040f85f
add esp, 0x38
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x421ba0]
push ebx
mov dword [ebp - 0x4c], eax
mov eax, dword [0x421b80]
mov dword [ebp - 0x14], eax
mov eax, dword [0x421b90]
mov dword [ebp - 0x40], eax
mov eax, dword [0x421b94]
mov dword [ebp - 0x48], eax
mov eax, dword [0x421b8c]
mov dword [ebp - 0x54], eax
mov eax, dword [0x421b98]
mov dword [ebp - 0x50], eax
mov eax, dword [0x421b9c]
mov dword [ebp - 0x58], eax
mov eax, dword [0x421b84]
mov dword [ebp - 0x44], eax
mov eax, dword [0x421b88]
push 0x421b84
mov dword [ebp - 0x38], eax
call esi
push ebx
push 0x421b88
call esi
push ebx
push 0x421b7c
call esi
mov edi, 0x421b80
push ebx
push edi
call esi
push ebx
push 0x421ba0
call esi
push ebx
push 0x421b90
call esi
push ebx
push 0x421b94
call esi
push ebx
push 0x421b8c
call esi
push ebx
push 0x421b98
call esi
push ebx
push 0x421b9c
call esi
push 0x420698
lea eax, [ebp - 0x164]
push str._s_Redirect_track.asp
push eax
call fcn.0040f85f
add esp, 0xc
cmp dword [ebp - 0x28], ebx
je 0x40d079
cmp dword [ebp + 0xc], ebx
push dword [ebp - 0x28]
je 0x40d124
push dword [ebp + 0xc]
call fcn.0040ff60
pop ecx
pop ecx
push dword [ebp + 0xc]
lea eax, [ebp - 0x5c]
push 0x6c
push 1
push eax
lea eax, [ebp - 0x164]
push eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x8c]
call fcn.0040158c
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x8c]
call fcn.00401715
push dword [ebp - 0x30]
call fcn.0040f8c0
cmp dword [ebp - 0x24], ebx
pop ecx
mov dword [ebp - 0x1c], eax
jne 0x40d3c1
mov ecx, dword [ebp - 0x20]
add eax, ecx
cmp eax, 0x1388
jae 0x40d323
mov eax, dword [ebp + 0x10]
cmp eax, dword [0x420910]
jne 0x40d277
push str.EzulaMutexObject
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x40d42b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40d116
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
jne 0x40d269
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x40d12e
mov eax, dword [eax]
mov dword [ebp + 0x10], eax
jmp 0x40d131
call fcn.0040f36c
jmp 0x40d45d
mov dword [ebp + 0x10], ebx
cmp dword [ebp + 0x10], ebx
jne 0x40d13a
xor eax, eax
jmp 0x40d171
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x2c], eax
add eax, 3
and al, 0xfc
call fcn.0040fc80
mov eax, esp
push ebx
push ebx
mov dword [ebp - 0x20], eax
push dword [ebp - 0x2c]
mov byte [eax], bl
push eax
push 0xffffffffffffffff
push dword [ebp + 0x10]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x164]
push str._sids.tmp
push eax
call fcn.0040f85f
add esp, 0xc
lea eax, [ebp - 0x164]
push ebx
push 0x80
push 4
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x40d269
lea eax, [ebp - 0x60]
push ebx
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x30]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x421b80]
mov ecx, dword [ebp - 0x14]
add eax, ecx
push eax
push edi
call esi
mov eax, dword [0x421ba0]
mov ecx, dword [ebp - 0x4c]
add eax, ecx
push eax
push 0x421ba0
call esi
mov eax, dword [0x421b90]
mov ecx, dword [ebp - 0x40]
add eax, ecx
push eax
push 0x421b90
call esi
mov eax, dword [0x421b94]
mov ecx, dword [ebp - 0x48]
add eax, ecx
push eax
push 0x421b94
call esi
mov eax, dword [0x421b8c]
mov ecx, dword [ebp - 0x54]
add ecx, eax
push ecx
push 0x421b8c
call esi
mov eax, dword [0x421b98]
mov ecx, dword [ebp - 0x50]
add ecx, eax
push ecx
push 0x421b98
call esi
mov eax, dword [0x421b9c]
mov ecx, dword [ebp - 0x58]
add ecx, eax
push ecx
push 0x421b9c
call esi
mov eax, dword [0x421b84]
mov ecx, dword [ebp - 0x44]
add ecx, eax
push ecx
push 0x421b84
call esi
mov eax, dword [0x421b88]
mov ecx, dword [ebp - 0x38]
add ecx, eax
push ecx
push 0x421b88
call esi
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40d42b
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x40d285
mov eax, dword [eax]
mov dword [ebp + 0x10], eax
jmp 0x40d288
mov dword [ebp + 0x10], ebx
cmp dword [ebp + 0x10], ebx
jne 0x40d291
xor esi, esi
jmp 0x40d2bf
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.0040fc80
mov esi, esp
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 0x10]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
lea eax, [ebp - 0x164]
push str._sbackup.tmp
push eax
call fcn.0040f85f
add esp, 0xc
lea eax, [ebp - 0x164]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x38], ebx
cmp esi, 0xffffffff
je 0x40d42b
push dword [ebp + 0xc]
call fcn.0040f8c0
pop ecx
lea ecx, [ebp - 0x38]
push ebx
push ecx
push eax
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d42b
mov eax, dword [0x421b80]
mov ecx, dword [ebp - 0x14]
add eax, ecx
push eax
push edi
call esi
mov eax, dword [0x421ba0]
mov ecx, dword [ebp - 0x4c]
add eax, ecx
push eax
push 0x421ba0
call esi
mov eax, dword [0x421b90]
mov ecx, dword [ebp - 0x40]
add eax, ecx
push eax
push 0x421b90
call esi
mov eax, dword [0x421b94]
mov ecx, dword [ebp - 0x48]
add eax, ecx
push eax
push 0x421b94
call esi
mov eax, dword [0x421b8c]
mov ecx, dword [ebp - 0x54]
add ecx, eax
push ecx
push 0x421b8c
call esi
mov eax, dword [0x421b98]
mov ecx, dword [ebp - 0x50]
add ecx, eax
push ecx
push 0x421b98
call esi
mov eax, dword [0x421b9c]
mov ecx, dword [ebp - 0x58]
add ecx, eax
push ecx
push 0x421b9c
call esi
mov eax, dword [0x421b84]
mov ecx, dword [ebp - 0x44]
add ecx, eax
push ecx
push 0x421b84
call esi
mov eax, dword [0x421b88]
mov ecx, dword [ebp - 0x38]
add ecx, eax
push ecx
push 0x421b88
call esi
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x40d3cf
mov eax, dword [eax]
mov dword [ebp + 0x10], eax
jmp 0x40d3d2
mov dword [ebp + 0x10], ebx
cmp dword [ebp + 0x10], ebx
jne 0x40d3db
xor esi, esi
jmp 0x40d409
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.0040fc80
mov esi, esp
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 0x10]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
lea eax, [ebp - 0x164]
push str._sbackup.tmp
push eax
call fcn.0040f85f
add esp, 0xc
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x28], ebx
je 0x40d439
push dword [ebp - 0x28]
call fcn.0040f36c
pop ecx
cmp dword [ebp + 0xc], ebx
je 0x40d447
push dword [ebp + 0xc]
call fcn.0040f36c
pop ecx
cmp dword [ebp - 0x30], ebx
je 0x40d455
push dword [ebp - 0x30]
call fcn.0040f36c
pop ecx
push ebx
push ebx
call fcn.0040be61
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
cmp ecx, ebx
je 0x40d46d
call fcn.0040917b
mov dword [ebp - 0x34], ebx
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x40d479
call fcn.0040917b
push 1
pop eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x170]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10