Function at 0x140002c10
Capabilities:
Check mutex on windows
Delete file

Disassembly:
push rbp
sub rsp, 0x3e0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x370], rcx
mov qword [rbp + 0x378], rdx
mov qword [rbp + 0x380], r8
mov dword [rbp + 0x388], r9d
mov qword [rbp + 0x358], 0
mov qword [rbp + 0x338], 0
mov qword [rbp + 0x330], 0
mov qword [rbp + 0x328], 0
mov dword [rbp + 0x324], 0
mov qword [rbp + 0x318], 0
lea r8, str.mtx_uninstall_glx64
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateMutexA]
call rax
mov qword [rbp + 0x318], rax
cmp qword [rbp + 0x318], 0
je 0x140001971
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0xb7
je 0x14000190e
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp + 0x314], eax
and dword [rbp + 0x314], 0xffff
add dword [rbp + 0x314], 0x2710
mov eax, dword [rbp + 0x314]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, str.uninstall.1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp + 0x358], rax
cmp qword [rbp + 0x358], 0
je 0x140001911
mov rax, qword [0x1400654e0]
mov qword [rbp + 0x350], rax
mov rax, qword [0x1400654d0]
mov qword [rbp + 0x308], rax
mov rax, qword [rbp + 0x308]
sub rax, qword [rbp + 0x350]
mov dword [rbp + 0x304], eax
mov rax, qword [rbp + 0x350]
mov qword [rbp + 0x2f8], rax
mov rax, qword [rbp + 0x2f8]
mov eax, dword [rax]
mov dword [rbp + 0x2f4], eax
add qword [rbp + 0x350], 4
mov eax, dword [rbp + 0x304]
sub eax, 4
mov dword [rbp + 0x304], eax
mov rax, qword [rbp + 0x350]
movzx eax, byte [rax]
test al, al
je 0x1400018ad
mov rax, qword [rbp + 0x350]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp + 0x338], rax
cmp qword [rbp + 0x338], 0
je 0x140001914
mov rax, qword [rbp + 0x350]
mov rcx, rax
call sub.msvcrt.dll_strlen
add rax, 1
add qword [rbp + 0x350], rax
mov rax, qword [rbp + 0x350]
movzx eax, byte [rax]
cmp al, 0xff
jne 0x1400017c8
add qword [rbp + 0x350], 1
jmp 0x1400018a8
mov rax, qword [rbp + 0x350]
movzx eax, word [rax]
cmp ax, 0xffff
jne 0x14000180e
add qword [rbp + 0x350], 2
mov rax, qword [rbp + 0x350]
mov qword [rbp + 0x2e8], rax
mov rax, qword [rbp + 0x2e8]
movzx eax, word [rax]
movzx eax, ax
mov qword [rbp + 0x340], rax
mov dword [rbp + 0x34c], 8
jmp 0x140001834
mov rax, qword [rbp + 0x350]
mov qword [rbp + 0x340], rax
mov rax, qword [rbp + 0x340]
mov rcx, rax
call sub.msvcrt.dll_strlen
add eax, 1
mov dword [rbp + 0x34c], eax
mov rdx, qword [rbp + 0x340]
mov rax, qword [rbp + 0x338]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x2e0], rax
mov eax, dword [rbp + 0x34c]
cdqe
add qword [rbp + 0x350], rax
mov rax, qword [rbp + 0x350]
mov eax, dword [rax]
mov dword [rbp + 0x2dc], eax
add qword [rbp + 0x350], 4
mov edx, dword [rbp + 0x2dc]
mov rax, qword [rbp + 0x358]
add rax, rdx
mov qword [rbp + 0x2d0], rax
mov rax, qword [rbp + 0x2d0]
mov rdx, qword [rbp + 0x2e0]
mov qword [rax], rdx
jmp 0x1400017ad
jmp 0x140001759
nop
mov rax, qword [rbp + 0x358]
add rax, 0x1000
mov rcx, rax
call fcn.1400014cf
mov rax, qword [rbp + 0x358]
add rax, 0x60b010
mov rcx, rax
call fcn.140001552
mov rax, qword [rbp + 0x358]
lea rdx, str.Start
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x2e0], rax
cmp qword [rbp + 0x2e0], 0
je 0x140001917
mov rax, qword [rbp + 0x2e0]
call rax
jmp 0x140001918
nop
jmp 0x140001918
nop
jmp 0x140001918
nop
jmp 0x140001918
nop
cmp qword [rbp + 0x358], 0
je 0x140001935
mov rax, qword [rbp + 0x358]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
cmp qword [rbp + 0x328], 0
je 0x140001952
mov rax, qword [rbp + 0x328]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
cmp qword [rbp + 0x318], 0
je 0x140001974
mov rax, qword [rbp + 0x318]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call rax
jmp 0x140001975
nop
jmp 0x140001975
nop
mov eax, 0
add rsp, 0x3e0
pop rbp
ret
push rdi
push rsi
push rbx
sub rsp, 0x90
xor esi, esi
call fcn.140001a40
call fcn.140002a80
mov rbx, qword [rax]
test rbx, rbx
jne 0x140002c5b
jmp 0x140002cd1
test cl, cl
je 0x140002c88
and esi, 1
je 0x140002c70
mov esi, 1
call sub.msvcrt.dll__ismbblead
test eax, eax
je 0x140002c57
cmp byte [rbx + 1], 1
sbb rbx, 0xffffffffffffffff
add rbx, 1
movsx ecx, byte [rbx]
cmp cl, 0x20
jle 0x140002c38
mov eax, esi
xor eax, 1
cmp cl, 0x22
cmove esi, eax
jmp 0x140002c46
test cl, cl
je 0x140002c88
nop dword [rax]
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
je 0x140002c88
cmp al, 0x20
jle 0x140002c78
lea rdx, [rsp + 0x20]
xor eax, eax
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov r9d, 0xa
test byte [rsp + 0x5c], 1
je 0x140002cb6
movzx r9d, word [rsp + 0x60]
mov rcx, qword [0x1400653a0]
mov r8, rbx
xor edx, edx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
jmp 0x1400015e9
lea rbx, [0x140065030]
jmp 0x140002c88