Function at 0x1402819d0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Encode data using xor
Get hostname
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x11b0
call fcn.140286970
sub rsp, rax
mov rsi, rcx
mov rax, qword [0x14058d998]
xor rax, rsp
mov qword [rsp + 0x11a8], rax
mov dword [0x14058f840], 0x6c6c6548
mov word [0x14058f844], 0x6f
movaps xmm0, xmmword [0x1402c2980]
movups xmmword [0x1405a0150], xmm0
mov byte [0x1405a0160], 0
movaps xmm0, xmmword [str.1234567890abcdef]
movups xmmword [0x1405a0161], xmm0
mov byte [0x1405a0171], 0
lea rcx, [0x14058f940]
lea r8, str.ab2adfc1e6cd689c3eb6c6135e49791c68956c2e41537b8b11ba
mov edx, 0x104
call fcn.1402a9df8
lea rcx, [0x14058fa44]
lea r8, str.bb7fe5e0e2c9688a3eabda12404f692f4a8e470943487f9d0c83c75177586a2c43887e3271714d9375
mov edx, 0x104
call fcn.1402a9df8
lea rcx, [0x14058fb48]
lea r8, str.db26b3c0e7c963c1079ed6
mov edx, 0x104
call fcn.1402a9df8
lea rcx, [0x14058fc4c]
lea r8, str.db26b3e7f1867f9707
mov edx, 0x104
call fcn.1402a9df8
lea rcx, [0x14058fd50]
lea r8, str.ab2adfc1e6cd689c3eb6c6135e49791c7c937834584e7f9c3e85dc1f54497d6e468a7c
mov edx, 0x104
call fcn.1402a9df8
cmp byte [0x14058fa44], 0
je 0x140281b0a
lea rdi, [rsp + 0x30]
xor r15d, r15d
lea r12, [0x14058f840]
lea rbx, [0x14058fa44]
lea r14, str._2hhx
nop dword [rax + rax]
lea rcx, [r15 + r12]
add rcx, 0x204
mov rdx, r14
mov r8, rdi
call fcn.140282e20
add r15, 2
mov rcx, rbx
call fcn.1402aa2e0
inc rdi
cmp rax, r15
ja 0x140281ae0
lea rcx, [0x14058fd50]
call fcn.1402aa2e0
mov rdi, rax
shr rdi, 1
cmp byte [0x14058fd50], 0
je 0x140281b7a
lea rbx, [rsp + 0x30]
xor r12d, r12d
lea r13, [0x14058f840]
lea r14, [0x14058fd50]
lea r15, str._2hhx
nop word cs:[rax + rax]
lea rcx, [r12 + r13]
add rcx, 0x510
mov rdx, r15
mov r8, rbx
call fcn.140282e20
add r12, 2
mov rcx, r14
call fcn.1402aa2e0
inc rbx
cmp rax, r12
ja 0x140281b50
test edi, edi
jle 0x140281c5a
mov eax, edi
cmp rax, 8
jae 0x140281b91
xor ecx, ecx
jmp 0x140281c2f
cmp eax, 0x20
jae 0x140281b9a
xor ecx, ecx
jmp 0x140281bec
mov edx, edi
and edx, 0x1f
mov rcx, rax
sub rcx, rdx
xor r8d, r8d
lea r9, [0x1402c29c0]
nop
movaps xmm0, xmmword [r8 + r9]
movaps xmm1, xmmword [r8 + r9 + 0x10]
xorps xmm0, xmmword [rsp + r8 + 0x30]
xorps xmm1, xmmword [rsp + r8 + 0x40]
movaps xmmword [rsp + r8 + 0x1140], xmm0
movaps xmmword [rsp + r8 + 0x1150], xmm1
add r8, 0x20
cmp rcx, r8
jne 0x140281bb0
test rdx, rdx
je 0x140281c5a
cmp edx, 8
jb 0x140281c2f
mov rdx, rcx
mov r8d, edi
and r8d, 7
mov rcx, rax
sub rcx, r8
lea r9, [0x1402c29c0]
nop word cs:[rax + rax]
mov r10, qword [rdx + r9]
xor r10, qword [rsp + rdx + 0x30]
mov qword [rsp + rdx + 0x1140], r10
add rdx, 8
cmp rcx, rdx
jne 0x140281c10
test r8, r8
je 0x140281c5a
lea rdx, [0x1402c29c0]
nop word cs:[rax + rax]
movzx r8d, byte [rcx + rdx]
xor r8b, byte [rsp + rcx + 0x30]
mov byte [rsp + rcx + 0x1140], r8b
inc rcx
cmp rax, rcx
jne 0x140281c40
movsxd rax, edi
mov byte [rsp + rax + 0x1140], 0
call fcn.14027d030
call fcn.14027d040
call fcn.14027d030
lea r8, [0x1402cb3d0]
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x1140]
call fcn.1402a73d4
test eax, eax
jne 0x140281cb8
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140281cb8
call fcn.1402a6c84
call fcn.14027d040
call fcn.14027d030
lea rcx, [0x1402c2a3f]
call fcn.1402a9098
jmp 0x140281d33
lea rdx, str.error.log
lea r8, [0x1402cb3d0]
lea rcx, [rsp + 0x30]
call fcn.1402a73d4
test eax, eax
jne 0x140281ce3
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140281ce3
call fcn.1402a6c84
call fcn.14027d040
mov dword [rsp + 0x1090], 0x104
lea rdi, [rsp + 0x30]
mov r8d, 0x208
mov rcx, rdi
xor edx, edx
call fcn.1402975a0
lea rdx, [rsp + 0x1090]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor ecx, ecx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140281d58
mov rcx, qword [rsp + 0x11a8]
xor rcx, rsp
call fcn.1402869d0
xor eax, eax
add rsp, 0x11b0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14027d030
lea rdi, [0x14058fb48]
mov rcx, rdi
call fcn.1402aa2e0
shr rax, 1
mov dword [rsp + 0x20], eax
lea rbx, [0x1402c29c0]
lea r14, [rsp + 0x1120]
mov rdx, rdi
mov r8, rbx
mov r9, r14
call fcn.140281f40
lea rdi, [0x14058fc4c]
mov rcx, rdi
call fcn.1402aa2e0
shr rax, 1
mov dword [rsp + 0x20], eax
lea r15, [rsp + 0x1100]
mov rdx, rdi
mov r8, rbx
mov r9, r15
call fcn.140281f40
mov rcx, rsi
mov rdx, r14
mov r8, r15
call fcn.1402820e0
call fcn.14027d030
call fcn.1402821d0
test eax, eax
jne 0x140281f37
call fcn.14027d040
call fcn.140282220
mov edi, eax
call fcn.14027d030
test edi, edi
je 0x140281e26
call fcn.14027d030
call fcn.14027d040
call fcn.1402821d0
call fcn.14027d040
call fcn.14027d030
call fcn.14027d040
call fcn.140282220
call fcn.14027d030
call fcn.14027d040
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdi, [0x14058f940]
mov rcx, rdi
call fcn.1402aa2e0
shr rax, 1
mov dword [rsp + 0x20], eax
lea r8, [0x1402c29c0]
lea rbx, [rsp + 0x1090]
mov rdx, rdi
mov r9, rbx
call fcn.140281f40
lea rdx, [rsp + 0x30]
mov r8, rbx
call fcn.140282330
call fcn.14027d040
call fcn.14027d030
lea rdi, [rsp + 0x146]
mov dword [rsp + 0x20], 0
lea r8, [0x140403380]
mov r9d, 0x84a90
mov rcx, rsi
mov rdx, rdi
call fcn.140282970
call fcn.14027d040
lea rdx, [rsp + 0x24a]
mov dword [rsp + 0x20], 8
lea r8, [0x140487e10]
mov r9d, 0x214b8
mov rcx, rsi
call fcn.140282970
call fcn.14027d030
lea rdx, [rsp + 0x452]
mov dword [rsp + 0x20], 0
lea r8, [0x1404a92d0]
mov r9d, 0x59ea5
mov rcx, rsi
call fcn.140282970
call fcn.14027d040
lea rdx, [rsp + 0x34e]
mov dword [rsp + 0x20], 0
lea r8, [0x140503180]
mov r9d, 0xd800
mov rcx, rsi
call fcn.140282970
call fcn.14027d030
mov rdx, rdi
call fcn.1402829c0
call fcn.14027d030
call fcn.14027d040
lea rdx, [rsp + 0x1140]
call fcn.140282ad0
call fcn.14027d030
int3