Function at 0x402406
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe68
mov eax, dword [0x407014]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0xe64], edx
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xe58], edi
test ebx, ebx
jne 0x40243e
mov ebx, 0x401594
mov dword [ebp - 0xe64], ebx
push 1
push edi
push ebx
mov edx, 0x104
lea ecx, [ebp - 0x214]
call fcn.00402156
push 1
push edi
push 0x4014c8
mov edx, 0x104
lea ecx, [ebp - 0x624]
call fcn.00402156
xor edi, edi
lea eax, [ebp - 0x624]
push edi
push eax
push ebx
mov edx, 0x208
lea ecx, [ebp - 0xe44]
call fcn.00402156
cmp byte [esi + 4], 0
je 0x40249c
lea ecx, [ebp - 0x214]
call fcn.00403324
mov ebx, eax
test ebx, ebx
jne 0x4024ee
lea eax, [ebp - 0xe44]
push eax
push edi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ebx, eax
test ebx, ebx
jne 0x4024ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4024db
lea eax, [ebp - 0xe44]
push eax
push 0x17b
push 0x4014f8
push 0x40e
call fcn.00405fc5
xor al, al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403865
leave
ret 4
push edi
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push 1
push dword [ebp - 0xe58]
mov edx, 0x104
lea ecx, [ebp - 0x624]
push 0x4014e0
call fcn.00402156
push edi
lea eax, [ebp - 0x624]
mov edx, 0x208
push eax
push dword [ebp - 0xe64]
lea ecx, [ebp - 0xa34]
call fcn.00402156
cmp byte [esi + 4], 0
je 0x40254e
lea ecx, [ebp - 0x214]
call fcn.0040349c
mov dword [ebp - 0xe64], eax
test eax, eax
jne 0x402590
lea eax, [ebp - 0xa34]
push eax
push edi
push 2
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0xe64], eax
test eax, eax
jne 0x402590
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 0xa34]
push eax
push 0x1a2
push 0x4014f8
push 0x409
call fcn.00405fc5
mov eax, dword [ebp - 0xe64]
push edi
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [ebp - 0xe60], eax
test eax, eax
jne 0x4025cf
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 0xa34]
push eax
push 0x1b0
push 0x4014f8
push 0x409
call fcn.00405fc5
mov eax, dword [ebp - 0xe60]
cmp byte [eax + 0x51], 0
jne 0x4025f6
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0xe58]
push 0x1b7
push 0x4014f8
push 0x423
call fcn.00405fc5
cmp byte [esi + 4], 0
je 0x402616
lea edx, [ebp - 0x214]
mov ecx, 0x401598
call fcn.00403183
mov dword [ebp - 0xe68], eax
test eax, eax
jne 0x40264a
push 1
lea eax, [ebp - 0x214]
mov edx, 0x104
push eax
push 0x401598
lea ecx, [ebp - 0x41c]
call fcn.00402156
lea eax, [ebp - 0x41c]
push eax
push edi
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0xe68], eax
cmp byte [esi + 4], 0
je 0x40266a
lea edx, [ebp - 0x214]
mov ecx, 0x4015b4
call fcn.00403183
mov dword [ebp - 0xe5c], eax
test eax, eax
jne 0x4026a1
push 1
lea eax, [ebp - 0x214]
mov edx, 0x104
push eax
push 0x4015b4
lea ecx, [ebp - 0x41c]
call fcn.00402156
lea eax, [ebp - 0x41c]
push eax
push edi
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0xe5c], eax
cmp byte [esi + 4], 0
je 0x4026c1
lea edx, [ebp - 0x214]
mov ecx, 0x4015d4
call fcn.00403183
mov dword [ebp - 0xe58], eax
test eax, eax
jne 0x4026f5
push 1
lea eax, [ebp - 0x214]
mov edx, 0x104
push eax
push 0x4015d4
lea ecx, [ebp - 0x41c]
call fcn.00402156
lea eax, [ebp - 0x41c]
push eax
push edi
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0xe58], eax
cmp byte [esi + 2], 0
mov eax, dword [ebp - 0xe5c]
jne 0x402757
test eax, eax
je 0x40274b
mov ecx, dword [ebp - 0xe60]
push eax
mov dword [ecx + 0x78], edi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [ebp - 0xe68]
call dword [sym.imp.KERNEL32.dll_PulseEvent]
push 0x9c4
push dword [ebp - 0xe5c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x402745
push dword [ebp - 0xe5c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 0xe5c]
cmp byte [esi + 2], 0
jne 0x402757
cmp byte [esi + 1], 0
je 0x40279b
test eax, eax
je 0x40279b
mov ecx, dword [ebp - 0xe60]
push eax
mov dword [ecx + 0x78], edi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [ebp - 0xe58]
call dword [sym.imp.KERNEL32.dll_PulseEvent]
push 0x9c4
push dword [ebp - 0xe5c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40279b
push dword [ebp - 0xe5c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [ebp - 0xe68]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xe5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xe58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 3], 0
je 0x40281d
push dword [esi + 8]
push edi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xe58], eax
test eax, eax
je 0x40281d
push dword [esi + 8]
push 0x3a9b
call fcn.00405a4d
push eax
call fcn.00405d89
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0xffffffffffffffff
push dword [ebp - 0xe58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xe58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 2], 0
mov dword [ebp - 0xe58], edi
jne 0x4028c2
push 0x10
push 0x4015f4
push dword [esi + 0x10]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfsopen]
mov edi, eax
add esp, 0xc
mov dword [ebp - 0xe58], edi
test edi, edi
jne 0x402867
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 0x10]
push 0x209
push 0x4014f8
push 0x57
call fcn.00405fc5
lea eax, [ebp - 0xe54]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
je 0x402896
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 0x10]
push 0x210
push 0x4014f8
push 0x40b
call fcn.00405fc5
mov edx, dword [ebp - 0xe60]
lea eax, [ebp - 0xe54]
push eax
push edi
mov ecx, esi
call fcn.00402321
push dword [ebp - 0xe58]
mov edi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
mov dword [ebp - 0xe58], eax
jmp 0x4028cd
push dword [ebp - 0xe60]
call fcn.004060fc
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub edi, 1
je 0x40291f
sub edi, 1
je 0x40291f
cmp dword [ebp - 0xe58], 0
je 0x4028fb
push dword [esi + 0x10]
push 0x236
push 0x4014f8
push 0x5b
call fcn.00405fc5
push dword [ebp - 0xe60]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0xe64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
mov al, 1
jmp 0x4024dd
push 0x40f
push 0x3a99
call fcn.00405a4d
push eax
call fcn.004045b8
push dword [esi + 0x10]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
pop ecx
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3