Function at 0x1400ecbf0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Get hostname
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x20c0]
mov eax, 0x21c0
call fcn.140115fb0
sub rsp, rax
mov rax, qword [0x140141008]
xor rax, rsp
mov qword [rbp + 0x20a0], rax
call fcn.1400ec9f0
call fcn.1400ecac0
call fcn.1400f1f60
test eax, eax
jne 0x1400ecc3a
call fcn.1400ec9f0
mov eax, 1
jmp 0x1400ed150
mov qword [rsp + 0x21d0], rbx
mov qword [rsp + 0x21d8], rsi
mov qword [rsp + 0x21e0], rdi
mov qword [rsp + 0x21b0], r15
call fcn.1400f1100
mov rbx, rax
call fcn.1400ecac0
mov rcx, rbx
call fcn.1400f1140
xor edx, edx
mov ecx, 0x20004
mov rsi, rax
call fcn.1400f18e0
mov edx, 3
mov ecx, 0x22002
call fcn.1400f18e0
call fcn.1400ec9f0
call fcn.1400ecac0
mov edx, 3
mov ecx, 0x22003
call fcn.1400f18e0
call fcn.1400ec9f0
mov edx, dword [rsi + 8]
mov ecx, 0x21001
call fcn.1400f18e0
call fcn.1400ecac0
mov edx, dword [rsi + 0xc]
mov ecx, 0x21002
call fcn.1400f18e0
call fcn.1400ec9f0
mov edx, dword [rsi + 0x10]
mov ecx, 0x21003
call fcn.1400f18e0
call fcn.1400ecac0
mov edx, 8
mov ecx, 0x21004
call fcn.1400f18e0
call fcn.1400ec9f0
mov edx, 0x18
mov ecx, 0x21005
call fcn.1400f18e0
call fcn.1400ecac0
mov edx, 8
mov ecx, 0x21006
call fcn.1400f18e0
xor r15d, r15d
lea r8, str.glText
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov edx, 0x1e0
mov ecx, 0x280
call fcn.1400f1360
mov rdi, rax
call fcn.1400ec9f0
lea r8, [0x14013c4ac]
lea rdx, str.C:UsersPublicPicturesconfig.jpg
lea rcx, [rbp + 0xfa8]
call fcn.1400fde24
test eax, eax
jne 0x1400ecd81
mov rcx, qword [rbp + 0xfa8]
test rcx, rcx
je 0x1400ecd81
call fcn.1400fdac8
call fcn.1400ecac0
call fcn.1400ec9f0
xor eax, eax
jmp 0x1400ed130
lea r8, [0x14013c4ac]
lea rdx, str.C:Windowscomsetup.log
lea rcx, [rbp + 0xfa8]
call fcn.1400fde24
test eax, eax
jne 0x1400ecdb0
mov rcx, qword [rbp + 0xfa8]
test rcx, rcx
je 0x1400ecdb0
call fcn.1400fdac8
call fcn.1400ecac0
xor edx, edx
mov dword [rbp + 0xfa8], 0x104
mov r8d, 0x208
lea rcx, [rbp + 0x1040]
call fcn.1400fa920
lea rdx, [rbp + 0xfa8]
lea rcx, [rbp + 0x1040]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r8, [rbp + 0x1040]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400ecd7a
mov rcx, rdi
call fcn.1400ef900
call fcn.1400ec9f0
mov ecx, 1
call fcn.1400ef9a0
call fcn.1400ed9a0
test eax, eax
je 0x1400ed0b8
call fcn.1400ec9f0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, 0x12c
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, 0xfffffed4
sub ecx, ebx
movsxd rdx, ecx
add rax, rdx
mov r9, rax
shr r9, 0x20
mov r8d, r9d
xor r8d, eax
sub r8d, r9d
cmp r8d, 0x64
jg 0x1400ed0b8
mov qword [rsp + 0x21b8], r14
call fcn.1400ecac0
xor edx, edx
mov ecx, 0x20004
call fcn.1400f18e0
mov edx, 3
mov ecx, 0x22002
call fcn.1400f18e0
mov edx, 3
mov ecx, 0x22003
call fcn.1400f18e0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r14, rax
mov ebx, 0xa
nop dword [rax + rax]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x1f4
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Beep]
sub rbx, 1
jne 0x1400ecec0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, r14d
mov r14, qword [rsp + 0x21b8]
cmp eax, 0x2710
jl 0x1400ed168
call fcn.1400ec9f0
lea rcx, [rsp + 0x50]
call fcn.1400ed430
mov rdx, rax
lea rcx, [rbp + 0x1040]
mov r8d, 0x1052
call fcn.1400faed0
mov edx, dword [rsi + 8]
mov ecx, 0x21001
call fcn.1400f18e0
mov edx, dword [rsi + 0xc]
mov ecx, 0x21002
call fcn.1400f18e0
call fcn.1400ecac0
mov edx, dword [rsi + 0x10]
mov ecx, 0x21003
call fcn.1400f18e0
call fcn.1400ec9f0
lea edx, [rbx + 0x65]
lea rcx, [rbp + 0x1156]
call fcn.1400ede40
call fcn.1400ecac0
lea edx, [rbx + 0x66]
lea rcx, [rbp + 0x125a]
call fcn.1400ede40
call fcn.1400ec9f0
lea edx, [rbx + 0x67]
lea rcx, [rbp + 0x1462]
call fcn.1400ede40
call fcn.1400ecac0
lea edx, [rbx + 0x68]
lea rcx, [rbp + 0x135e]
call fcn.1400ede40
call fcn.1400ec9f0
mov rcx, rdi
call fcn.1400ef900
lea ecx, [rbx + 1]
call fcn.1400ef9a0
xorps xmm0, xmm0
lea rcx, [rbp + 0x1156]
xor eax, eax
xor r9d, r9d
mov qword [rbp + 0x1030], rax
xor r8d, r8d
mov qword [rbp + 0xfc0], rax
xor edx, edx
lea rax, [rbp + 0xfb0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xfd0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
movups xmmword [rbp + 0xfd0], xmm0
movups xmmword [rbp + 0xfe0], xmm0
movups xmmword [rbp + 0xff0], xmm0
movups xmmword [rbp + 0x1000], xmm0
movups xmmword [rbp + 0x1010], xmm0
movups xmmword [rbp + 0x1020], xmm0
movups xmmword [rbp + 0xfb0], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400ed058
mov rcx, qword [rbp + 0xfb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xfb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400ec9f0
mov edx, dword [rsi + 8]
mov ecx, 0x21001
call fcn.1400f18e0
mov edx, dword [rsi + 0xc]
mov ecx, 0x21002
call fcn.1400f18e0
mov edx, dword [rsi + 0x10]
mov ecx, 0x21003
call fcn.1400f18e0
call fcn.1400ecac0
lea r8, [0x14013c4b0]
lea rdx, str.C:UsersPublicPicturesconfig.jpg
lea rcx, [rbp + 0xfa8]
call fcn.1400fde24
test eax, eax
jne 0x1400ed0b8
mov rcx, qword [rbp + 0xfa8]
test rcx, rcx
je 0x1400ed0b8
call fcn.1400fdac8
mov rcx, rdi
call fcn.1400f1bf0
test eax, eax
je 0x1400ed119
call fcn.1400f0250
call fcn.1400ecac0
lea r8, [rbp + 0xfc8]
mov rcx, rdi
lea rdx, [rbp + 0xfcc]
call fcn.1400f1890
mov edx, 0x100
mov rcx, rdi
call fcn.1400f01d0
test eax, eax
je 0x1400ed102
mov edx, 1
mov rcx, rdi
call fcn.1400f18c0
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call fcn.1400f1bf0
test eax, eax
jne 0x1400ed0c4
call fcn.1400ec9f0
mov rcx, rdi
call fcn.1400f17b0
call fcn.1400f2030
mov eax, 1
mov rdi, qword [rsp + 0x21e0]
mov rsi, qword [rsp + 0x21d8]
mov rbx, qword [rsp + 0x21d0]
mov r15, qword [rsp + 0x21b0]
mov rcx, qword [rbp + 0x20a0]
xor rcx, rsp
call fcn.1400edfa0
add rsp, 0x21c0
pop rbp
ret
call fcn.1400ec9f0
call fcn.1400edf40
call fcn.1400ecac0
call fcn.1400edee0
call fcn.1400ec9f0
lea rcx, [rsp + 0x50]
call fcn.1400ed430
call fcn.1400ecac0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]