Function at 0x18001cf80
Capabilities:
Check mutex on windows
Read file via mapping

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov qword [rsp + 0xf0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbp, r9
mov r13, rdx
mov r14, rcx
test rcx, rcx
je 0x18001d41d
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x18001d41d
test rdx, rdx
je 0x18001cff4
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x18001d41d
test r9, r9
je 0x18001d41d
mov r15d, dword [rsp + 0x170]
test r15d, r15d
jle 0x18001d41d
mov r12, qword [rsp + 0x178]
test r12, r12
je 0x18001d41d
xor eax, eax
mov rcx, rsi
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x18001d41d
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
xor ebx, ebx
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, r12
call fcn.18001cdc0
lea rdx, [rsp + 0xf8]
test rdx, rdx
je 0x18001d0a6
xor r9d, r9d
lea r8, [rsp + 0x100]
lea edx, [rbx + 1]
lea rcx, [0x18006cf40]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
lea r8, [rsp + 0x38]
lea rdx, [0x18006cfe0]
lea rcx, [rsp + 0x70]
call fcn.180004150
mov r8, qword [rax]
xor edx, edx
lea rcx, [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x18001d0f6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
call qword [sym.imp.KERNEL32.dll_GetLastError]
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r8, qword [rsp + 0x30]
xor edx, edx
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x18001d179
lea r8, [rsp + 0x30]
lea rdx, [0x18006cfe0]
lea rcx, [rsp + 0x68]
call fcn.180004150
mov r8, qword [rax]
xor edx, edx
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov r12, rax
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001d170
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test r12, r12
je 0x18001d3c4
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x18001d3bb
lea rbx, [rax + 0x10]
mov edi, dword [rax + 8]
lea rcx, [rsp + 0x90]
call fcn.18001fd90
nop
lea r8d, [rdi - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x90]
call fcn.180021990
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x150], rax
lea r9, [rsp + 0x150]
mov r8, r13
mov rdx, r14
lea rcx, [rsp + 0x90]
call fcn.18001fe20
test eax, eax
jne 0x18001d22e
xor eax, eax
mov rcx, rsi
lea rdi, [0x18006c5a8]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x18006c5a8]
lea rcx, [rsp + 0x150]
call fcn.180002290
test r13, r13
jne 0x18001d256
lea ecx, [r15 - 2]
xor eax, eax
test ecx, ecx
cmovg eax, ecx
mov rdi, qword [rsp + 0x150]
mov ebx, dword [rdi - 0x10]
cmp eax, ebx
jge 0x18001d277
xor ebx, ebx
test ecx, ecx
cmovg ebx, ecx
jmp 0x18001d277
lea ecx, [r15 - 1]
xor eax, eax
test ecx, ecx
cmovg eax, ecx
mov rdi, qword [rsp + 0x150]
mov ebx, dword [rdi - 0x10]
cmp eax, ebx
jge 0x18001d277
xor ebx, ebx
test ecx, ecx
cmovg ebx, ecx
cmp dword [rdi - 8], 1
jle 0x18001d295
mov edx, dword [rdi - 0x10]
lea rcx, [rsp + 0x150]
call fcn.180002850
mov rdi, qword [rsp + 0x150]
movsxd r12, ebx
lea r14, [r12 + r12]
mov r9, r14
mov r8, rdi
mov rdx, r14
mov rcx, rbp
call fcn.180034594
test r13, r13
jne 0x18001d2d8
mov rax, r13
test ebx, ebx
jle 0x18001d2db
nop dword [rax]
cmp word [rbp + rax*2], 0xa
jne 0x18001d2ce
mov word [rbp + rax*2], r13w
inc rax
cmp rax, r12
jl 0x18001d2c0
jmp 0x18001d2db
xor r13d, r13d
sub r15d, ebx
movsxd r8, r15d
add r8, r8
lea rcx, [r14 + rbp]
xor edx, edx
call fcn.180035fe0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001d316
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x50], rcx
mov rax, qword [rax]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x80], rcx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xd0], xmm0
movaps xmm1, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0xe0], xmm1
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x90]
call fcn.180024390
mov rcx, qword [rsp + 0xc0]
call fcn.1800340d0
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xc8], r13
mov rcx, qword [rsp + 0x90]
call fcn.1800340d0
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x18001d3dc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001d3fc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x18001d419
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov eax, ebx
jmp 0x18001d41f
xor eax, eax
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret