Function at 0x140016a44
Capabilities:
Accept command line arguments
Create mailslot
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
mov eax, 0x1850
call fcn.14003ad30
sub rsp, rax
mov rax, qword [0x14004de00]
xor rax, rsp
mov qword [rsp + 0x1840], rax
mov r12b, cl
mov r14d, 0x1770
mov rcx, r14
call fcn.14001b160
xor edi, edi
lea rcx, [rsp + 0x48]
mov qword [0x14005b418], rax
lea ebx, [rdi + 0x18]
xor edx, edx
mov r8, rbx
mov byte [rax], dil
call fcn.14001e190
lea edx, [rdi + 0x28]
lea ecx, [rdi + 0x40]
mov dword [rsp + 0x48], ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r13d, [rdi + 1]
mov edx, r13d
mov rcx, rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
call fcn.1400065fc
lea rcx, [rsp + 0xd0]
mov rdx, rax
xor r8d, r8d
call fcn.140007b00
mov ecx, 0x9e
mov rbx, rdi
call fcn.14000468c
cmp eax, edi
je 0x140016b1e
lea rbx, [rsp + 0x48]
lea r8, str.Global_
jmp 0x140016c81
mov ecx, 0xc8
call fcn.14000468c
cmp eax, edi
jne 0x140016c7a
lea rcx, str.user_single_instance
call fcn.140016394
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov rcx, rax
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, edi
je 0x140016c4e
mov ebp, 0x3f8
mov rcx, rbp
call fcn.14001b160
mov rcx, qword [rsp + 0x38]
mov r9d, ebp
mov rsi, rax
lea rax, [rsp + 0x30]
mov edx, r13d
mov r8, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], edi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, edi
je 0x140016c25
mov rcx, qword [rsi]
lea rdx, [rsp + 0x40]
call sub.ADVAPI32.dll_ConvertSidToStringSidA
cmp eax, edi
je 0x140016c0a
mov rcx, qword [0x14005b418]
lea r8, str.Global_
mov rdx, r14
call fcn.140020bbc
mov rcx, qword [0x14005b418]
call fcn.14001bd50
mov rcx, qword [0x14005b418]
mov rbx, r14
sub rbx, rax
call fcn.14001bd50
mov r8, qword [rsp + 0x40]
add rax, qword [0x14005b418]
mov rdx, rbx
mov rcx, rax
call fcn.140020b30
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rbx, [rsp + 0x48]
jmp 0x140016c39
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, dword [rsp + 0x30]
lea rcx, str.could_not_get_convert_sid__d__d
mov edx, eax
call fcn.140016394
jmp 0x140016c39
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.could_not_get_token_information__d
mov edx, eax
call fcn.140016394
mov rcx, rsi
call fcn.14001e44c
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140016c62
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.could_not_open_process_token__d
mov edx, eax
call fcn.140016394
mov rax, qword [0x14005b418]
cmp byte [rax], dil
jne 0x140016c90
lea rcx, str.user_single_instance_failed__fall_back_to_session_single_instance
call fcn.140016394
lea r8, str.Local_
mov rcx, qword [0x14005b418]
mov rdx, r14
call fcn.140020bbc
mov rcx, qword [0x14005b418]
call fcn.14001bd50
lea rdx, [rsp + 0xd0]
add rax, qword [0x14005b418]
mov rcx, rax
call fcn.1400165ac
mov ecx, 0x2715
call fcn.14000468c
cmp eax, edi
je 0x140016e64
lea rcx, str.single_instance_mode
call fcn.140016394
mov r9, qword [0x14005b418]
mov r8d, r13d
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [0x14005b418]
lea rcx, str.semaphore_name__S__code__d__value__p
mov r9, rbp
mov r8d, eax
mov ebx, eax
call fcn.140016394
mov esi, 0xb7
cmp ebx, esi
jne 0x140016de1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400164e0
mov esi, edi
jmp 0x140016d44
mov ecx, esi
add esi, r13d
cmp ecx, 0x32
jge 0x140016d4a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400164e0
mov ebx, eax
cmp eax, edi
je 0x140016d2a
lea rcx, str.other_pid__d
mov edx, ebx
call fcn.140016394
cmp ebx, edi
je 0x140016dc9
mov ecx, 0x2718
call fcn.14000468c
cmp eax, edi
je 0x140016d74
mov dl, r13b
mov ecx, ebx
call fcn.140018e8c
cmp r12b, dil
je 0x140016dc9
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, 0x22
cmp word [rax], dx
jne 0x140016da0
lea rcx, [rax + 2]
call fcn.14001de08
cmp rax, rdi
jne 0x140016da0
lea rax, [0x14003ee24]
jmp 0x140016dbf
mov esi, 0x20
mov rcx, rax
mov edx, esi
call fcn.14001de08
cmp rax, rdi
je 0x140016d97
jmp 0x140016dba
add rax, 2
cmp word [rax], si
je 0x140016db6
mov rdx, rax
mov ecx, ebx
call fcn.1400168f8
lea rcx, str.exiting
call fcn.140016394
xor ecx, ecx
call fcn.140005980
jmp 0x140016f44
call fcn.140016414
cmp r12b, dil
je 0x140016f44
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.140016600
xor r9d, r9d
or r8d, 0xffffffff
mov rcx, rax
mov edx, 0x10000
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CreateMailslotA]
mov rcx, rbx
mov rsi, rax
call fcn.14001c17c
cmp rsi, 0xffffffffffffffff
jne 0x140016e36
lea rcx, str.creating_mailslot_failed
call fcn.140016394
jmp 0x140016f44
lea rcx, str.creating_mailslot_successful
call fcn.140016394
lea r8, [0x14001665c]
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x140016f44
lea rdx, [0x1400422f4]
lea rcx, [rsp + 0x98]
xor r8d, r8d
call fcn.14001d218
mov rcx, qword [0x14005b418]
lea rdx, [rsp + 0x98]
call fcn.14001c320
mov r9, qword [0x14005b418]
mov r8d, r13d
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xb7
jmp 0x140016f21
cmp edi, 0x186a0
jge 0x140016f25
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14005b418]
lea rdx, [rsp + 0xd0]
add edi, r13d
call fcn.1400165ac
lea rdx, [0x1400422f4]
lea rcx, [rsp + 0x60]
mov r8d, edi
call fcn.14001d218
mov rcx, qword [0x14005b418]
lea rdx, [rsp + 0x60]
call fcn.14001c320
mov r9, qword [0x14005b418]
mov r8d, r13d
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
je 0x140016eb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [0x14005b418]
lea rcx, str.semaphore_name__S__code__d__value__p
mov r8d, eax
mov r9, rbp
call fcn.140016394
mov rcx, qword [rsp + 0x1840]
xor rcx, rsp
call fcn.14001c510
lea r11, [rsp + 0x1850]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret