Function at 0x14000b500
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
and qword [rbp + 0x20], 0
lea r8, [rbp + 0x20]
xor ebx, ebx
lea rcx, str.D:PAI_A_OICI_FA___WD_
xor r14d, r14d
xor r9d, r9d
mov qword [rbp + 0x28], r14
lea edi, [rbx + 1]
mov edx, edi
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
nop dword [rax + rax]
test eax, eax
jne 0x14000b577
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14000b55d
mov edi, 0x80004005
jmp 0x14000b56b
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14000c4dc
jmp 0x14000b6ad
mov rax, qword [rbp + 0x20]
lea r8, str.GlobalMicrosoft.Windows.Remediation.TelemetryUpdateHealthTools
and dword [rbp - 0x1c], ebx
lea rcx, [rbp - 0x20]
and dword [rbp - 0xc], ebx
xor edx, edx
and dword [rbp - 0x10], ebx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x20], 0x18
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x14000b5b8
mov rbx, rax
test rax, rax
jne 0x14000b5e5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14000b5d2
mov edi, 0x80004005
jmp 0x14000b692
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x14000b692
mov edx, 0x2710
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
test eax, eax
je 0x14000b624
cmp eax, 0x102
je 0x14000b61d
cmp eax, 0xffffffff
jne 0x14000b5c8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14000b5d2
xor edi, edi
jmp 0x14000b699
mov edi, 0x800705b4
jmp 0x14000b692
lea r9, [rbp + 0x28]
lea r8, [0x14003fa60]
lea rdx, str.SoftwareMicrosoftRemediationLocalStateTelemetryUpdateHealthTools
call fcn.14000b334
mov r14, qword [rbp + 0x28]
test eax, eax
cmovs r14, rdi
call fcn.14000d014
mov edi, eax
test eax, eax
jns 0x14000b654
mov ecx, eax
jmp 0x14000b694
xor ecx, ecx
call fcn.14000c400
lea r9, [r14 + 1]
mov dword [rsp + 0x20], 8
lea r8, [0x14003fa60]
lea rdx, str.SoftwareMicrosoftRemediationLocalStateTelemetryUpdateHealthTools
call fcn.14000e10c
mov edi, eax
test eax, eax
jns 0x14000b687
mov ecx, eax
call fcn.14000c4dc
mov ecx, edi
call fcn.14000c400
test edi, edi
jns 0x14000b699
mov ecx, edi
call fcn.14000c4dc
test rbx, rbx
je 0x14000b6ad
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
nop dword [rax + rax]
test edi, edi
jns 0x14000b6bf
lea rdx, str.Failed_to_get_a_proper_GlobalEventCounter_for_telemetry__using_0
mov ecx, edi
call fcn.14000b9e0
test rbx, rbx
je 0x14000b6d3
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14000b6e8
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
lea r11, [rsp + 0x50]
mov rax, r14
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret