Function at 0x64611fd4
Capabilities:
Check if file exists
Check mutex on windows
Copy file
Create process on windows
Delete file
Get common file path
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xca0
mov eax, dword [0x646170a0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
xor edi, edi
mov dword [ebp - 0xc54], ecx
push 0x200
push edi
push eax
mov ebx, edx
mov dword [ebp - 0xc44], esi
mov dword [ebp - 0xc4c], edi
mov dword [ebp - 0xc3c], edi
mov dword [ebp - 0xc30], edi
mov dword [ebp - 0xc60], edi
mov dword [ebp - 0xc5c], edi
mov dword [ebp - 0xc38], edi
mov dword [ebp - 0xc34], edi
mov dword [ebp - 0xc48], edi
mov dword [ebp - 0xc58], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x614]
push 0x200
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x6461208a
test byte [eax + 0x1c], 2
je 0x6461208a
cmp byte [eax + 0x19], 5
jb 0x6461208a
push dword [eax + 0x14]
mov edx, 0x64603008
push dword [eax + 0x10]
push 0x54
pop ecx
call fcn.64604453
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x6461209c
add eax, 2
lea ecx, [ebp - 0xc34]
push ecx
lea edx, [ebp - 0xc38]
mov ecx, eax
call fcn.64611698
mov esi, eax
test esi, esi
je 0x646120f0
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646120e2
test byte [eax + 0x1c], 2
je 0x646120e2
cmp byte [eax + 0x19], 2
jb 0x646120e2
push esi
push dword [eax + 0x14]
mov edx, 0x64603008
push dword [eax + 0x10]
push 0x55
pop ecx
call fcn.64604471
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x64612df0
lea eax, [ebp - 0x81c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x64612155
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x6461213d
test byte [eax + 0x1c], 2
je 0x6461213d
cmp byte [eax + 0x19], 2
jb 0x6461213d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64603008
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x56
pop ecx
call fcn.64604471
mov ecx, dword [ebp - 0xc38]
call fcn.6460cda9
mov ecx, dword [ebp - 0xc34]
call fcn.6460cda9
jmp 0x646120e9
push 0x100
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push ebx
call dword [sym.imp.msvcrt.dll__wsplitpath_s]
add esp, 0x24
test eax, eax
je 0x646121ad
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646121a0
test byte [eax + 0x1c], 2
je 0x646121a0
cmp byte [eax + 0x19], 2
jb 0x646121a0
push dword [eax + 0x14]
mov edx, 0x64603008
push dword [eax + 0x10]
push 0x57
pop ecx
call fcn.64604453
push 0x65b
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x6461213d
push 1
lea eax, [ebp - 0x20c]
push 0x6460266c
push eax
mov dword [ebp - 0xc50], eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x646121dc
lea eax, [ebp - 0x20a]
mov dword [ebp - 0xc50], eax
jmp 0x646121e2
lea eax, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x414]
push ecx
push eax
push ecx
lea edx, [ebp - 0x81c]
call fcn.6460f734
cmp eax, edi
jne 0x64612247
cmp edx, edi
jne 0x64612247
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612dd8
test byte [eax + 0x1c], 2
je 0x64612dd8
cmp byte [eax + 0x19], 2
jb 0x64612dd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64603008
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x58
pop ecx
call fcn.64604471
jmp 0x64612dd8
push edi
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x6461229f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612b5a
test byte [eax + 0x1c], 2
je 0x64612b5a
cmp byte [eax + 0x19], 2
jb 0x64612b5a
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x59
mov edx, 0x64603008
pop ecx
call fcn.64604471
jmp 0x64612b5a
push edi
push edi
push 0x100
lea eax, [ebp - 0x614]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x414]
push edi
push eax
call dword [sym.imp.msvcrt.dll__wsplitpath_s]
add esp, 0x24
test eax, eax
je 0x646122fa
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646122f0
test byte [eax + 0x1c], 2
je 0x646122f0
cmp byte [eax + 0x19], 2
jb 0x646122f0
push dword [eax + 0x14]
mov edx, 0x64603008
push dword [eax + 0x10]
push 0x5a
pop ecx
call fcn.64604453
mov esi, 0x65b
jmp 0x64612b5a
push 0x64602dec
push edi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ebx, eax
mov dword [ebp - 0xc30], ebx
test ebx, ebx
jne 0x6461240f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x6461235a
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612b5a
test byte [eax + 0x1c], 2
je 0x64612b5a
cmp byte [eax + 0x19], 2
jb 0x64612b5a
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x5b
jmp 0x6461228f
mov eax, 0x1f0001
mov esi, edi
push ecx
mov edx, eax
mov ecx, eax
call fcn.6461503d
mov ebx, eax
test ebx, ebx
jne 0x646123ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612b5a
test byte [eax + 0x1c], 2
je 0x64612b5a
cmp byte [eax + 0x19], 2
jb 0x64612b5a
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x5c
jmp 0x6461228f
push 0x64602dec
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0xc30], eax
test eax, eax
jne 0x64612403
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646123f7
test byte [eax + 0x1c], 2
je 0x646123f7
cmp byte [eax + 0x19], 2
jb 0x646123f7
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x5d
mov edx, 0x64603008
pop ecx
call fcn.64604471
mov ecx, ebx
call fcn.64615449
jmp 0x64612b5a
mov ecx, ebx
call fcn.64615449
jmp 0x646124d1
push 0x493e0
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x64612466
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612454
test byte [eax + 0x1c], 2
je 0x64612454
cmp byte [eax + 0x19], 2
jb 0x64612454
push esi
push dword [eax + 0x14]
mov edx, 0x64603008
push dword [eax + 0x10]
push 0x5e
pop ecx
call fcn.64604471
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc30], edi
jmp 0x64612b5a
cmp eax, 0x102
jne 0x6461249f
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612498
test byte [eax + 0x1c], 2
je 0x64612498
cmp byte [eax + 0x19], 2
jb 0x64612498
push dword [eax + 0x14]
mov edx, 0x64603008
push dword [eax + 0x10]
push 0x5f
pop ecx
call fcn.64604453
mov esi, 0x102
jmp 0x64612454
cmp eax, 0x80
jne 0x646124d1
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646124d1
test byte [eax + 0x1c], 2
je 0x646124d1
cmp byte [eax + 0x19], 3
jb 0x646124d1
push dword [eax + 0x14]
mov edx, 0x64603008
push dword [eax + 0x10]
push 0x60
pop ecx
call fcn.64604453
push ecx
xor edx, edx
mov ecx, 0x1f0003
call fcn.6461503d
mov dword [ebp - 0xc40], eax
test eax, eax
jne 0x64612522
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612b5a
test byte [eax + 0x1c], 2
je 0x64612b5a
cmp byte [eax + 0x19], 2
jb 0x64612b5a
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x61
jmp 0x6461228f
mov ebx, edi
cmp dword [ebp + ebx - 0xc60], edi
jne 0x6461254e
push dword [ebp + ebx - 0xc38]
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp + ebx - 0xc60], eax
test eax, eax
je 0x646125ac
mov eax, dword [ebp - 0xc40]
add ebx, 4
cmp ebx, 8
jb 0x64612524
mov ecx, eax
call fcn.64615449
push dword [ebp - 0xc44]
push 0x64602e20
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x646125eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612b5a
test byte [eax + 0x1c], 2
je 0x64612b5a
cmp byte [eax + 0x19], 2
jb 0x64612b5a
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x63
jmp 0x6461228f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646125e0
test byte [eax + 0x1c], 2
je 0x646125e0
cmp byte [eax + 0x19], 2
jb 0x646125e0
push esi
push dword [eax + 0x14]
mov edx, 0x64603008
push dword [eax + 0x10]
push 0x62
pop ecx
call fcn.64604471
mov ecx, dword [ebp - 0xc40]
jmp 0x646123f9
push ecx
push 6
xor edx, edx
pop ecx
call fcn.6461503d
mov ebx, eax
test ebx, ebx
jne 0x64612636
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612b5a
test byte [eax + 0x1c], 2
je 0x64612b5a
cmp byte [eax + 0x19], 2
jb 0x64612b5a
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x64
jmp 0x6461228f
push 0x64602e44
push 0x1000
push edi
push 0x8000004
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0xc4c], eax
test eax, eax
jne 0x64612695
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x646123f7
test byte [ecx + 0x1c], 2
je 0x646123f7
cmp byte [ecx + 0x19], 2
jb 0x646123f7
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x65
jmp 0x646123ec
mov ecx, ebx
call fcn.64615449
mov eax, dword [ebp - 0xc4c]
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc48], eax
test eax, eax
jne 0x646126f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x64612b5a
test byte [ecx + 0x1c], 2
je 0x64612b5a
cmp byte [ecx + 0x19], 2
jb 0x64612b5a
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x66
jmp 0x6461228f
push ecx
push dword [ebp - 0xc44]
mov edx, 0x800
push ecx
mov ecx, eax
call fcn.646043da
mov ebx, eax
test ebx, ebx
jns 0x64612756
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x6461273c
test byte [ecx + 0x1c], 2
je 0x6461273c
cmp byte [ecx + 0x19], 2
jb 0x6461273c
push ebx
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x67
mov edx, 0x64603008
pop ecx
call fcn.64604471
mov eax, ebx
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x64612ac6
movzx esi, bx
jmp 0x64612b5a
mov eax, dword [ebp - 0xc48]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov ebx, dword [ebp - 0xc44]
pop ecx
pop ecx
lea edx, [eax + 2]
mov dword [ebp - 0xc40], edx
test ebx, ebx
je 0x64612795
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, di
jne 0x6461277c
sub ebx, ecx
sar ebx, 1
push 0xfffffffffffffffe
pop ecx
lea eax, [ebx + ebx]
sub ecx, eax
jmp 0x64612797
mov ecx, edi
lea eax, [ecx + 0x1000]
shr eax, 1
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, 0x7ff8ffa9
add ebx, 0x80070057
test eax, eax
je 0x646127cd
push ecx
lea ecx, [ebp - 0x614]
mov edx, eax
push ecx
push ecx
mov ecx, dword [ebp - 0xc40]
call fcn.646043da
mov ebx, eax
test ebx, ebx
jns 0x64612803
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x6461273c
test byte [eax + 0x1c], 2
je 0x6461273c
cmp byte [eax + 0x19], 2
jb 0x6461273c
push ebx
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x68
jmp 0x64612731
push dword [ebp - 0xc54]
lea eax, [ebp - 0xc2c]
push 0x64602e7c
push 0x208
push eax
call fcn.64604373
mov ebx, eax
add esp, 0x10
test ebx, ebx
jns 0x6461285c
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x6461273c
test byte [ecx + 0x1c], 2
je 0x6461273c
cmp byte [ecx + 0x19], 2
jb 0x6461273c
push ebx
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x69
jmp 0x64612731
lea eax, [ebp - 0x414]
mov dword [ebp - 0xc9c], 0x3c
mov dword [ebp - 0xc8c], eax
lea eax, [ebp - 0xc2c]
mov dword [ebp - 0xc88], eax
lea eax, [ebp - 0x81c]
mov dword [ebp - 0xc84], eax
mov eax, dword [ebp - 0xc50]
push 0x64602e98
push eax
mov dword [ebp - 0xc98], 0x500
mov dword [ebp - 0xc94], edi
mov dword [ebp - 0xc90], 0x64602e88
mov dword [ebp - 0xc80], 7
mov dword [ebp - 0xc7c], edi
mov dword [ebp - 0xc78], edi
mov dword [ebp - 0xc74], edi
mov dword [ebp - 0xc70], edi
mov dword [ebp - 0xc6c], edi
mov dword [ebp - 0xc68], edi
mov dword [ebp - 0xc64], edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x64612901
or dword [ebp - 0xc98], 1
mov dword [ebp - 0xc74], 0x64602ea0
push ecx
xor edx, edx
mov ecx, 0x1f0001
call fcn.6461503d
mov ebx, eax
test ebx, ebx
jne 0x6461294e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612b5a
test byte [eax + 0x1c], 2
je 0x64612b5a
cmp byte [eax + 0x19], 2
jb 0x64612b5a
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x6a
jmp 0x6461228f
push 0x64602ec0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0xc3c], eax
test eax, eax
jne 0x646129a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x646123f7
test byte [ecx + 0x1c], 2
je 0x646123f7
cmp byte [ecx + 0x19], 2
jb 0x646123f7
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x6b
jmp 0x646123ec
mov ecx, ebx
call fcn.64615449
lea eax, [ebp - 0xc9c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x64612a3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646129f1
test byte [eax + 0x1c], 2
je 0x646129f1
cmp byte [eax + 0x19], 2
jb 0x646129f1
push esi
push dword [eax + 0x14]
mov edx, 0x64603008
push dword [eax + 0x10]
push 0x6c
pop ecx
call fcn.64604471
cmp esi, 0x483
jne 0x64612a1b
lea ecx, [ebp - 0x414]
call fcn.64611851
test eax, eax
je 0x64612a1f
mov ecx, dword [ebp - 0xc54]
lea edx, [ebp - 0x414]
call fcn.646118db
mov esi, eax
test esi, esi
je 0x64612a3e
lea eax, [ebp - 0x20c]
push eax
push 0xc0007d73
push 1
push 1
push 3
call fcn.64615542
add esp, 0x14
jmp 0x64612b5a
push 0x493e0
push edi
lea eax, [ebp - 0xc60]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
jne 0x64612a92
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612b5a
test byte [eax + 0x1c], 2
je 0x64612b5a
cmp byte [eax + 0x19], 2
jb 0x64612b5a
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x6d
jmp 0x6461228f
mov ebx, 0x102
cmp eax, ebx
jne 0x64612acd
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612ac6
test byte [eax + 0x1c], 2
je 0x64612ac6
cmp byte [eax + 0x19], 2
jb 0x64612ac6
push dword [eax + 0x14]
mov edx, 0x64603008
push dword [eax + 0x10]
push 0x6e
pop ecx
call fcn.64604453
mov esi, ebx
jmp 0x64612b5a
xor ebx, ebx
inc ebx
cmp eax, ebx
jne 0x64612b06
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612aff
test byte [eax + 0x1c], 2
je 0x64612aff
cmp byte [eax + 0x19], 2
jb 0x64612aff
push dword [eax + 0x14]
mov edx, 0x64603008
push dword [eax + 0x10]
push 0x6f
pop ecx
call fcn.64604453
mov esi, 0x4d3
jmp 0x64612b5a
mov eax, dword [ebp - 0xc3c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x64612b4e
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612b4e
test byte [eax + 0x1c], 2
je 0x64612b4e
cmp byte [eax + 0x19], 3
jb 0x64612b4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64603008
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x70
pop ecx
call fcn.64604471
mov dword [ebp - 0xc3c], edi
mov dword [ebp - 0xc58], ebx
push edi
push 0x64602e20
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x64612ba1
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612ba1
test byte [eax + 0x1c], 2
je 0x64612ba1
cmp byte [eax + 0x19], 3
jb 0x64612ba1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64603008
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x71
pop ecx
call fcn.64604471
mov ebx, edi
mov eax, dword [ebp + ebx*4 - 0xc60]
test eax, eax
je 0x64612bf0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x64612bf0
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612bf0
test byte [eax + 0x1c], 2
je 0x64612bf0
cmp byte [eax + 0x19], 3
jb 0x64612bf0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64603008
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x72
pop ecx
call fcn.64604471
inc ebx
cmp ebx, 2
jb 0x64612ba3
mov eax, dword [ebp - 0xc3c]
test eax, eax
je 0x64612c42
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x64612c42
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612c42
test byte [eax + 0x1c], 2
je 0x64612c42
cmp byte [eax + 0x19], 3
jb 0x64612c42
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64603008
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x73
pop ecx
call fcn.64604471
mov eax, dword [ebp - 0xc48]
test eax, eax
je 0x64612c8e
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x64612c8e
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612c8e
test byte [eax + 0x1c], 2
je 0x64612c8e
cmp byte [eax + 0x19], 3
jb 0x64612c8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64603008
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x74
pop ecx
call fcn.64604471
mov eax, dword [ebp - 0xc4c]
test eax, eax
je 0x64612cda
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x64612cda
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612cda
test byte [eax + 0x1c], 2
je 0x64612cda
cmp byte [eax + 0x19], 3
jb 0x64612cda
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64603008
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x75
pop ecx
call fcn.64604471
mov ebx, dword [ebp - 0xc30]
test ebx, ebx
je 0x64612d6c
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x64612d2a
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612d2a
test byte [eax + 0x1c], 2
je 0x64612d2a
cmp byte [eax + 0x19], 3
jb 0x64612d2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64603008
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x76
pop ecx
call fcn.64604471
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x64612d6c
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612d6c
test byte [eax + 0x1c], 2
je 0x64612d6c
cmp byte [eax + 0x19], 3
jb 0x64612d6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64603008
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x77
pop ecx
call fcn.64604471
mov ebx, dword [ebp - 0xc58]
test ebx, ebx
jne 0x64612d7d
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x64612dd6
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64612dc5
test byte [eax + 0x1c], 2
je 0x64612dc5
cmp byte [eax + 0x19], 3
jb 0x64612dc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x64617004]
mov edx, 0x64603008
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x78
pop ecx
call fcn.64604471
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 5
jb 0x64612d7d
mov edi, ebx
mov ecx, dword [ebp - 0xc38]
call fcn.6460cda9
mov ecx, dword [ebp - 0xc34]
call fcn.6460cda9
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.64615dc0
leave
ret 4