Function at 0x1006cd2
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Get system information on windows
Query environment variable
Set environment variable
Terminate process

Disassembly:
sub esp, 0x130
push ebx
push esi
push edi
push 0xa
pop ecx
xor ebx, ebx
xor eax, eax
mov dword [esp + 0xc], ebx
lea edi, [esp + 0x10]
push 0x10204a0
rep stosd dword es:[edi], eax
mov dword [0x10204a0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x1020800
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [esp + 0x148]
call fcn.0100324e
cmp dword [0x100f2d8], ebx
je 0x1006d6d
push 0x104
mov edi, 0x1020840
push edi
push 0xf001
push ebx
mov byte [0x1020840], bl
mov byte [0x10339e0], bl
call fcn.01003762
push 0xfffa
mov esi, 0x10339e0
push esi
push 0xf003
push ebx
call fcn.01003762
push 0x10040
push edi
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x100708d
push 0x10019b0
push 0x1001998
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
push 0x1001988
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor esi, esi
inc esi
test eax, eax
je 0x1006d97
mov dword [0x10102a4], esi
push ebp
push 0x1001964
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [0x10102a4], ebx
mov dword [0x100f2ec], eax
jne 0x1006dc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1006dc9
mov ebp, 0xf205
jmp 0x1006efd
call fcn.01008add
call fcn.0100760f
test eax, eax
jne 0x1006de1
mov ebp, 0xf107
jmp 0x1006efd
call fcn.01003f0f
mov ebp, eax
cmp ebp, ebx
jne 0x1006efd
cmp dword [0x100f2d0], ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], ebx
push eax
je 0x1006e3a
call fcn.0100511e
mov ebp, eax
cmp ebp, ebx
jne 0x1006efd
lea eax, [esp + 0x10]
push eax
call fcn.010063b1
cmp eax, esi
mov dword [esp + 0x1c], eax
jne 0x100708a
lea eax, [esp + 0x10]
push eax
call fcn.010054c4
jmp 0x1006e3f
call fcn.01006b31
cmp dword [esp + 0x1c], esi
mov ebp, eax
jne 0x1006ef5
mov eax, dword [0x100f2ec]
cmp eax, ebx
je 0x1006e61
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100f2ec], ebx
cmp dword [0x100f2d4], ebx
jne 0x1006edf
push 0x1021140
push esi
push dword [0x1020a64]
push dword [0x100f2c8]
push dword [0x100f2cc]
push esi
call fcn.01009e5b
test eax, eax
jne 0x1006edf
cmp dword [0x100f2c8], ebx
jne 0x1006edf
push 0x104
mov edi, 0x1020840
push edi
push 0xf004
push ebx
mov byte [0x1020840], bl
mov byte [0x10339e0], bl
call fcn.01003762
push 0xfffa
mov esi, 0x10339e0
push esi
push 0xf103
push ebx
call fcn.01003762
push 0x11010
push edi
push esi
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor esi, esi
inc esi
cmp dword [0x100f2e4], esi
jne 0x1006eeb
mov dword [esp + 0x30], ebx
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp ebp, ebx
je 0x100708a
mov eax, dword [0x100f2ec]
cmp eax, ebx
je 0x1006f13
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100f2ec], ebx
cmp ebp, 0x4c7
jne 0x1006f20
mov ebp, 0xf101
mov esi, 0x104
push esi
mov edi, 0x1020840
push edi
push 0xf004
push ebx
mov byte [0x1020840], bl
mov byte [0x10339e0], bl
call fcn.010046ab
push esi
lea eax, [esp + 0x40]
push eax
push 0xf206
push ebx
call fcn.010046ab
push 0xfffa
mov esi, 0x10339e0
push esi
push ebp
push ebx
call fcn.010046ab
test eax, eax
jne 0x1006ff2
push ebx
push 0xfffa
push esi
push ebx
push ebp
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x1006fd9
push esi
push 0x1021020
lea eax, [esp + 0x44]
push eax
push 3
push 0x10211c0
push dword [0x102082c]
push 1
push 0xc00e1117
call fcn.010072c2
add esp, 0x20
cmp dword [0x100f2c8], ebx
jne 0x1006fd9
push 0x100192c
push edi
call dword [sym.imp.ntdll.dll__strcmpi]
test eax, eax
pop ecx
pop ecx
push 0x11010
jne 0x1006fd0
push ebx
jmp 0x1006fd1
push edi
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xfffa
push esi
push 0xf102
push ebx
mov byte [0x10339e0], bl
call fcn.010046ab
jmp 0x1007020
cmp ebp, 0xf104
jne 0x1007020
push esi
call dword [sym.imp.msvcrt.dll__strdup]
mov ebp, eax
cmp ebp, ebx
pop ecx
je 0x1007020
push dword [0x10213e4]
push ebp
push esi
call dword [sym.imp.ntdll.dll_sprintf]
push ebp
call dword [sym.imp.msvcrt.dll_free]
add esp, 0x10
cmp dword [0x1020cb0], ebx
je 0x1007054
push esi
lea eax, [esp + 0x40]
push eax
push 0x1021020
lea eax, [esp + 0x48]
push eax
push 4
push 0x10211c0
push dword [0x102082c]
push 1
push 0xc00e1118
call fcn.010072c2
add esp, 0x24
cmp dword [0x100f2c8], ebx
jne 0x100707f
push 0x100192c
push edi
call dword [sym.imp.ntdll.dll__strcmpi]
test eax, eax
pop ecx
pop ecx
push 0x11010
jne 0x1007076
push ebx
jmp 0x1007077
push edi
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.01008343
mov ebp, 0x643
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x130
ret 0x10