Function at 0x1005daf
Capabilities:
Check mutex on windows

Disassembly:
push 0xa8
push 0x10093d0
call fcn.010092d0
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x40], ebx
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x23], bl
mov byte [ebp - 0x22], bl
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1f], 5
mov byte [ebp - 0x2c], bl
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], bl
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x27], 1
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], ebx
mov eax, dword [0x100aabc]
cmp eax, ebx
jne 0x1005f91
push 0x60
push ebx
lea eax, [ebp - 0xb8]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0x24]
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
call edi
test eax, eax
jne 0x1005e42
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1005ffd
mov dword [ebp - 0xb8], 0x1f0001
push 2
pop esi
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], 5
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push esi
lea eax, [ebp - 0x24]
push eax
call edi
test eax, eax
je 0x1005e35
mov dword [ebp - 0x98], 0x1f0001
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], esi
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x2c]
push eax
call edi
test eax, eax
je 0x1005e35
mov dword [ebp - 0x78], 0x120001
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], 5
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0xb8]
push eax
push 3
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
mov esi, eax
cmp esi, ebx
jne 0x1005ffd
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov dword [ebp - 0x40], edi
cmp edi, ebx
je 0x1005e35
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x1005e35
push ebx
push dword [ebp - 0x38]
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x1005e35
mov dword [ebp - 0x58], 0xc
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x54], edi
mov dword [ebp - 4], ebx
push 0x10018d8
push ebx
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x100aabc], eax
cmp eax, ebx
jne 0x1005f86
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x44], esi
mov eax, dword [0x100aabc]
mov dword [ebp - 4], 0xfffffffe
cmp eax, ebx
je 0x1005fb0
mov dword [ebp - 4], 1
push 0x927c0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 4], 0xfffffffe
cmp esi, ebx
je 0x1005ffb
cmp esi, 0x80
je 0x1005ffb
cmp esi, 0xffffffff
jne 0x1005ffd
jmp 0x1005e35
xor esi, esi
cmp dword [ebp - 0x34], ebx
je 0x100600b
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x3c], ebx
je 0x1006019
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x30], ebx
je 0x1006027
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x38], ebx
je 0x1006035
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x40], ebx
je 0x1006043
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
call fcn.01009318
ret