Function at 0x140002560
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Create thread
Terminate process

Disassembly:
push rbp
mov rbp, rsp
push r12
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x150
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x34]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test rax, rax
je 0x1400025e0
mov r12, rax
lea r8, str.FLKu3v5JAb8D
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x140036500], rax
test rax, rax
je 0x1400025e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400025fe
mov r8, qword [0x140003018]
mov r9d, 0x1010
lea rdx, [0x140004100]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r8, qword [0x140003018]
mov r9d, 0x1010
lea rdx, [0x140004162]
jmp 0x1400025cf
mov dword [rsp + 0x3c], 0x114
lea rcx, [rsp + 0x3c]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
cmp dword [rsp + 0x40], 9
ja 0x140002639
mov r8, qword [0x140003018]
mov r9d, 0x1010
lea rdx, [0x140004196]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400027ce
cmp dword [rsp + 0x34], 2
jg 0x1400027ce
call fcn.140001fc0
test eax, eax
je 0x14000271e
cmp dword [rsp + 0x34], 2
jne 0x14000271e
mov ecx, 0x63
call fcn.140002070
mov qword [0x140006280], rax
test rax, rax
je 0x1400027ce
call fcn.140001ec0
mov edx, 0x5e618
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [0x140006008], rax
test rax, rax
je 0x1400027ce
xor ebx, ebx
call fcn.1400028a0
test al, al
jne 0x1400026c3
mov rax, qword [0x140006008]
mov dx, word [0x1400062b4]
mov byte [rax + rbx], dl
inc rbx
cmp rbx, 0x5e618
jne 0x14000269d
lea rax, [rsp + 0x38]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x140001580]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [r12 + 8]
mov rdx, qword [str.proceed]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x140002704
call fcn.140002290
mov ecx, dword [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x12
call qword [sym.imp.USER32.dll_PostThreadMessageA]
jmp 0x1400027c1
call fcn.140001e60
mov ecx, 0x64
call fcn.140002070
mov qword [0x140006280], rax
test rax, rax
je 0x1400027ce
call fcn.140001ec0
mov edx, 0x5e618
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [0x140006008], rax
test rax, rax
je 0x1400027ce
xor ebx, ebx
call fcn.1400028a0
test al, al
jne 0x140002786
mov rax, qword [0x140006008]
mov dx, word [0x1400062b4]
mov byte [rax + rbx], dl
inc rbx
cmp rbx, 0x5e618
jne 0x140002760
xor ecx, ecx
call fcn.1400020b0
cmp dword [0x140006150], 0
je 0x1400027c1
mov r9, qword [str.proceed]
mov rdx, qword [0x140003008]
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r8, qword [r12]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [0x140006008]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x140036500]
test rcx, rcx
je 0x1400025d7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400025d7