Function at 0x140026700
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rbp + 0x1f], rax
xor r14d, r14d
mov word [rbp + 0x1b], 0x500
mov qword [rbp - 0x39], r14
mov r12, r9
mov dword [rbp + 0x17], r14d
mov r15, r8
mov r13, rcx
mov edi, r14d
mov ebx, r14d
mov esi, r14d
test rcx, rcx
jne 0x140026764
mov ecx, 0x80070057
mov r14d, ecx
call fcn.140025d30
jmp 0x140026961
test r15, r15
je 0x140026752
lea rax, [rbp - 0x39]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x17]
mov dword [rsp + 0x48], r14d
mov r8d, 0x20
mov dword [rsp + 0x40], r14d
mov dl, 2
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
nop dword [rax + rax]
test eax, eax
jne 0x1400267e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x1400267ca
mov r14d, 0x80004005
jmp 0x1400267db
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
mov ecx, r14d
jmp 0x14002675a
lea rcx, [rbp - 0x31]
call fcn.140028724
mov r14d, eax
test eax, eax
jns 0x1400267fa
mov ecx, eax
jmp 0x14002675a
mov rcx, qword [rbp - 0x39]
mov rbx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
nop dword [rax + rax]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
nop dword [rax + rax]
add edi, 0x18
add eax, edi
mov dword [rbp - 0x31], eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140026859
mov r14d, 0x8007000e
jmp 0x1400267db
mov edx, dword [rbp - 0x31]
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
nop dword [rax + rax]
test eax, eax
je 0x1400267b2
mov r9, qword [rbp - 0x39]
mov edx, 2
mov r8d, 0x10000000
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
nop dword [rax + rax]
test eax, eax
je 0x1400267b2
mov r9, rbx
mov edx, 2
mov r8d, 0x10000000
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
nop dword [rax + rax]
test eax, eax
je 0x1400267b2
mov edx, 1
lea rcx, [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
nop dword [rax + rax]
test eax, eax
je 0x1400267b2
xor r9d, r9d
lea rcx, [rbp - 0x11]
mov r8, rdi
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
je 0x1400267b2
mov qword [rbp - 0x19], rcx
lea rax, [rbp - 0x11]
lea rcx, [rbp - 0x29]
mov qword [rbp - 0x21], rax
mov r8, r13
mov qword [rbp - 0x29], 0x18
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x1400267b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor ecx, ecx
cmp eax, 0xb7
mov rax, rsi
mov qword [r15], rax
sete cl
xor esi, esi
test r12, r12
je 0x140026961
mov dword [r12], ecx
mov ecx, r14d
call fcn.140025d50
test rsi, rsi
je 0x14002697d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x1400269a2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x1400269bc
call qword [sym.imp.ADVAPI32.dll_FreeSid]
nop dword [rax + rax]
and qword [rbp - 0x39], 0
test rdi, rdi
je 0x1400269e1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov eax, r14d
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140094220
mov rbx, qword [rsp + 0x108]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret