Function at 0x1400084ec
Capabilities:
Check mutex on windows
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
and qword [rbp + 0x30], 0
lea r8, [rbp + 0x30]
xor ebx, ebx
lea rcx, str.D:PAI_A_OICI_FA___WD_
xor r14d, r14d
xor r9d, r9d
mov qword [rbp + 0x38], r14
lea edi, [rbx + 1]
mov edx, edi
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x14000854c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x140008539
mov esi, 0x80004005
jmp 0x1400086b1
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x1400086b1
xor eax, eax
lea r8, str.GlobalMicrosoft.Windows.Remediation.TelemetryLauncher
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x10], rax
xor edx, edx
mov rax, qword [rbp + 0x30]
and dword [rbp - 0x10], ebx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x20], 0x18
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x140008525
mov edx, 0x2710
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test eax, eax
je 0x1400085d7
cmp eax, 0x102
je 0x1400085cd
cmp eax, 0xffffffff
jne 0x14000852f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x1400085b2
xor esi, esi
jmp 0x1400086b8
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
je 0x1400086b8
jmp 0x1400086b1
mov esi, 0x800705b4
jmp 0x1400086b1
lea r9, [rbp + 0x38]
call fcn.14000b5b0
mov r14, qword [rbp + 0x38]
test eax, eax
cmovs r14, rdi
call fcn.14000b6f8
mov esi, eax
test eax, eax
jns 0x1400085fc
mov ecx, eax
jmp 0x1400086b3
xor ecx, ecx
call fcn.1400093b0
and qword [rbp + 0x38], 0
lea rax, [r14 + 1]
lea r9, [rbp + 0x38]
mov qword [rbp + 0x40], rax
mov rcx, 0xffffffff80000002
mov r8d, 2
call fcn.14000c808
mov rdi, qword [rbp + 0x38]
mov esi, eax
test eax, eax
jns 0x140008634
mov ecx, eax
jmp 0x140008681
xor ecx, ecx
call fcn.1400093b0
lea rax, [rbp + 0x40]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x1400232e0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
jne 0x14000866d
xor esi, esi
jmp 0x140008686
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
je 0x140008686
mov ecx, esi
call fcn.140009394
mov ecx, esi
call fcn.1400093b0
test rdi, rdi
je 0x14000869b
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
jns 0x1400086a6
mov ecx, esi
call fcn.140009394
mov ecx, esi
call fcn.1400093b0
test esi, esi
jns 0x1400086b8
mov ecx, esi
call fcn.140009394
test rbx, rbx
je 0x1400086c6
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test esi, esi
jns 0x1400086d8
lea rdx, str.Failed_to_get_a_proper_GlobalEventCounter_for_telemetry__using_0
mov ecx, esi
call fcn.140008a60
test rbx, rbx
je 0x1400086e6
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x1400086f5
call qword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
mov rax, r14
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret