Function at 0x1400504a0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rbp, rcx
mov r12, rdx
xor r15d, r15d
mov byte [0x14019bce6], r15b
movzx eax, word [rdx]
lea r8d, [r15 + 0x2a]
cmp r8w, ax
sete dil
lea r13d, [r15 + 0x20]
cmp ax, r15w
je 0x14005051a
mov ecx, 9
cmp cx, ax
ja 0x1400504ff
cmp ax, 0xd
jbe 0x14005051a
cmp r13w, ax
je 0x14005051a
add rdx, 2
mov qword [rsp + 0xe8], rdx
mov ax, word [rdx]
cmp ax, r15w
jne 0x1400504ef
lea rcx, [rsp + 0xe8]
call fcn.140029d28
mov rcx, qword [rsp + 0xe8]
mov qword [rsp + 0x40], rcx
movzx eax, r8b
mov edx, 0x2d
cmp dx, word [rcx]
cmove eax, edx
movsx edx, al
movzx eax, word [rcx]
mov r14d, 1
cmp edx, eax
jne 0x14005058f
movzx eax, word [rcx + 2]
cmp edx, eax
jne 0x14005058f
lea rax, [rcx + 4]
mov qword [rsp + 0x40], rax
mov r8d, r14d
lea rdx, [rsp + 0x40]
lea rcx, [0x14014b42c]
call fcn.140065780
cmp al, r15b
je 0x14005058f
mov ebx, r14d
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xe8], rax
jmp 0x1400505b3
mov r8d, 5
lea rdx, [rsp + 0xe8]
lea rcx, str._user
call fcn.140065780
mov ebx, r15d
cmp al, r15b
cmovne ebx, r14d
lea rax, str.UCallBackhWnd
mov rsi, qword [0x1401958e0]
cmp ebx, r15d
cmovne rsi, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, str.GlobalPECMD:main_u
lea r8, str.GlobalPECMD:main
cmp ebx, r15d
cmovne r8, rax
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp rax, r15
je 0x14005060b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xb7
cmp eax, ecx
jne 0x14005060b
mov eax, ecx
jmp 0x140050ca4
cmp ebx, r15d
je 0x140050619
mov byte [section.flag_dat], r13b
jmp 0x140050630
mov rax, qword [rsp + 0xe8]
cmp word [rax], r15w
setne al
add al, 0x10
mov byte [section.flag_dat], al
lea r13, [0x14014f7a8]
cmp qword [0x14019c058], r15
jne 0x140050667
lea rcx, [0x14014ba02]
call fcn.1400cf470
cmp eax, r15d
je 0x140050667
mov r8, r13
lea rdx, str.D:DebugPeMain.log
lea rcx, [0x14019c170]
call fcn.14003a070
mov r8, r12
lea rdx, str.MAIN__s_r_n
lea rcx, [0x14019c170]
call fcn.14002b578
call fcn.1400354dc
movzx r11d, byte [0x1401b5006]
cmp dil, r15b
cmovne r11d, r14d
mov byte [0x1401b5006], r11b
cmp ebx, r15d
jne 0x1400506eb
mov rax, qword [rsp + 0xe8]
cmp word [rax], r15w
je 0x14005071a
mov r9d, 0x10000000
mov r8d, r14d
xor edx, edx
lea rcx, str.Default
call qword [sym.imp.USER32.dll_OpenDesktopW]
mov rdi, rax
cmp rax, r15
je 0x1400506eb
mov rcx, rax
call qword [sym.imp.USER32.dll_SetThreadDesktop]
cmp eax, r15d
je 0x1400506e2
mov rcx, rdi
call qword [sym.imp.USER32.dll_SwitchDesktop]
mov rcx, rdi
call qword [sym.imp.USER32.dll_CloseDesktop]
mov rax, qword [rsp + 0xe8]
cmp word [rax], r15w
je 0x14005071a
mov qword [rsp + 0x20], r15
mov r9d, 0x24
xor r8d, r8d
mov rdx, r13
mov rcx, rbp
call fcn.14003e7a0
mov rax, qword [rsp + 0xe8]
movzx edi, word [rax]
mov edx, 0x23
lea ecx, [rdx + 7]
cmp di, cx
jne 0x140050748
add rax, 2
cmp dx, word [rax]
je 0x140050748
mov qword [rsp + 0xe8], rax
lea rcx, [rsp + 0xe8]
call fcn.140029d28
mov rdx, r13
mov rcx, r13
call sym.MBROSToolx64.exe_LoadEnvi
movzx r11d, byte [0x14019c660]
mov rax, qword [rsp + 0xe8]
cmp word [rax], r15w
cmove r11d, r14d
mov byte [0x14019c660], r11b
call fcn.14005b970
call fcn.140050460
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xf8], eax
mov ecx, 4
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x20], rax
mov r9d, ecx
lea r8, str.MainPECMDPID
lea rdx, str.SOFTWAREPELOGON
mov r13, 0xffffffff80000002
mov rcx, r13
call qword [0x14019c378]
xor edx, edx
lea rcx, [0x14019c170]
call fcn.1400c21d0
cmp qword [rbp + 0x60], r15
jne 0x140050871
mov eax, dword [0x14019c2b0]
test r14b, al
jne 0x1400507ff
or eax, r14d
mov dword [0x14019c2b0], eax
mov qword [0x14019c2a8], r15
lea rcx, [0x14013b238]
call fcn.14010c694
lea r13, [0x14019c2a8]
mov qword [rbp + 0x60], r13
mov edx, 0x10000
mov rcx, rbp
call fcn.1400602b0
lea rcx, [rsp + 0xf0]
call fcn.140063500
nop
mov rdx, qword [rsp + 0xf0]
mov rcx, r13
call fcn.1400a4890
mov qword [rsp + 0xf0], r15
mov rax, qword [0x14019c2a8]
mov rcx, qword [rax]
mov qword [rbp + 0x68], rcx
mov r8d, r14d
mov rdx, r12
mov rcx, rbp
call fcn.140075040
mov dword [rbp + 0x74], r15d
lea rcx, [rsp + 0xf0]
call fcn.14005b520
mov r13, 0xffffffff80000002
cmp ebx, r15d
jne 0x1400508b2
mov al, byte [section.flag_dat]
mov byte [rsp + 0xf0], al
mov dword [rsp + 0x28], r14d
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8, str.bInMain
lea rdx, str.SOFTWAREPELOGON
mov rcx, r13
call qword [0x14019c378]
mov rax, qword [rsp + 0xe8]
cmp word [rax], r15w
je 0x1400508c5
call fcn.14002d88c
mov dword [rsp + 0x28], 8
lea rax, [0x14019c048]
mov qword [rsp + 0x20], rax
mov r9d, VariantTimeToDosDateTime
mov r8, rsi
lea rdx, str.SOFTWAREPELOGON
mov rcx, r13
call qword [0x14019c378]
cmp di, r15w
jne 0x1400508fd
cmp ebx, r15d
je 0x140050902
call fcn.1400429c8
mov rcx, rbp
call fcn.1400350c0
mov rcx, qword [rsp + 0xe8]
cmp word [rcx], r15w
jne 0x14005091d
cmp ebx, r15d
je 0x140050971
mov dword [rsp + 0xf0], r15d
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
xor r9d, r9d
lea r8, [0x140050490]
mov edx, 0x80000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r15
je 0x140050969
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe8]
jmp 0x140050971
mov rcx, qword [rsp + 0xe8]
mov r8d, 0x2a
cmp word [rcx], r8w
jne 0x1400509ae
lea r9d, [r8 - 7]
lea rax, [rcx + 2]
cmp r9w, word [rax]
je 0x1400509ae
mov qword [rsp + 0xe8], rax
lea rcx, [rsp + 0xe8]
call fcn.140029d28
mov rcx, qword [rsp + 0xe8]
cmp word [rcx], r8w
je 0x140050981
cmp word [rcx], r15w
je 0x140050c4a
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [rax + 0x5c8]
lea rcx, [rsp + 0x50]
call fcn.140063580
nop
mov r14, qword [rsp + 0x50]
mov r8d, 0x104
lea rdx, [r14 + 0x280]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea r8d, [rdx + 0x5c]
lea rcx, [r14 + 0x280]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rdi, rax
cmp rax, r15
jne 0x140050a0d
lea rdi, [r14 + 0x280]
jmp 0x140050a11
add rdi, 2
mov rcx, qword [rsp + 0xe8]
call fcn.14002c9dc
cmp eax, r15d
je 0x140050a67
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0xf0]
call fcn.140071240
nop
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xf0]
mov rcx, rbp
call fcn.14004d38c
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
jmp 0x140050c40
movzx esi, r15w
mov rbx, qword [rsp + 0xe8]
mov qword [rsp + 0xf0], r15
lea rcx, [rsp + 0x48]
call fcn.140063500
nop
mov ecx, 0x22
mov rax, qword [rsp + 0xe8]
cmp cx, word [rax]
jne 0x140050ad2
add rbx, 2
mov si, word [rbx]
mov qword [rsp + 0xf0], rbx
mov edx, ecx
lea rcx, [rsp + 0xf0]
call fcn.14003aeec
mov rcx, qword [rsp + 0xf0]
cmp word [rcx], r15w
je 0x140050aca
mov word [rcx], r15w
jmp 0x140050ad2
mov qword [rsp + 0xf0], r15
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, rbp
call fcn.14006d870
cmp si, r15w
je 0x140050b09
mov word [rbx - 2], si
mov rax, qword [rsp + 0xf0]
cmp rax, r15
je 0x140050b09
mov ecx, 0x22
mov word [rax], cx
mov rcx, qword [rsp + 0x48]
call fcn.1400cf470
cmp eax, r15d
jne 0x140050b80
lea rcx, [rsp + 0x60]
call fcn.140063230
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x6c], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x60]
lea r8, str.SCRIPT
mov edx, 0x66
mov rcx, qword [0x14019c040]
call fcn.140030854
lea r11, str.102
cmp dword [rsp + 0x68], 4
cmovb r11, qword [rsp + 0xe8]
mov qword [rsp + 0xe8], r11
mov rcx, qword [rsp + 0x60]
call fcn.14005b500
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
mov r9, rdi
lea r8, [r14 + 0x280]
lea rdx, str.___exe:__s_____s_
lea rcx, [r14 + 0x708]
call fcn.140029bc4
lea rcx, [r14 + 0x708]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
lea rcx, [r14 + r8*2 + 0x708]
mov r8, qword [rsp + 0xe8]
lea rdx, str.LOAD_sysinit__s
call fcn.140029bc4
cmp word [r14], r15w
je 0x140050c10
mov dword [rsp + 0xf8], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.SysStartuped
lea rdx, str.SOFTWAREPELOGON
mov rcx, 0xffffffff80000002
call qword [0x14019c378]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8, rbp
lea rdx, [r14 + 0x708]
mov rcx, rbp
call fcn.140023208
nop
lea rcx, [rsp + 0x48]
call fcn.14005b520
nop
lea rcx, [rsp + 0x50]
call fcn.14005b520
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, r15d
je 0x140050c90
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, r15d
jne 0x140050c62
mov rcx, qword [0x14019c030]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [rsp + 0x80]
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret