Function at 0x1800168b0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Get system information on windows
Initialize winsock library
Terminate process

Disassembly:
push rbx
sub rsp, 0x200
mov rax, qword [0x1800680c0]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
test edx, edx
je 0x180016b20
cmp edx, 1
jne 0x180016b39
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.18001db90
xor eax, eax
mov qword [0x18006b238], rax
mov dword [0x18006b230], eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsp + 0x20], 9
jne 0x180016947
cmp dword [0x18006b230], 0
jne 0x180016947
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.Wow64DisableWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180016947
mov dword [0x18006b230], 1
lea rcx, [0x18006b238]
call rax
mov ecx, 1
call fcn.180005f20
mov r8, rax
mov edx, 0x104
lea rcx, [0x18006b4c0]
call fcn.180030008
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x18006b684], eax
call fcn.180005a70
mov dword [0x18006bb30], eax
lea r9, [0x18006b4c0]
lea r8, str._sJSBLogger.log
mov edx, 0x1f4
lea rcx, [0x18006b760]
call fcn.18000f2c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x100
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rcx, [0x180010320]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edx, 1
xor ecx, ecx
call fcn.180032400
lea r8, str.MutexJSB20080506
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x18006b690], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180016ac8
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x180016ab8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, eax
lea r8, [0x18005dcd8]
mov edx, 0x6bd
lea rcx, str.C:UserscjsworkJSBPartTunnelJSBProxyJSBProxy.cpp
call fcn.180004d20
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
call fcn.18000f410
mov rcx, rax
mov r9d, ebx
lea r8, [0x18005dcd8]
mov edx, dword [0x18006b688]
call fcn.18000f4b0
xor edx, edx
lea rcx, str.cmd__c_netsh.exe_int_ip_reset___filelog.log
call qword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jae 0x180016a7a
lea rdx, str._int_ip_reset___filelog.log
call fcn.180006210
xor edx, edx
lea rcx, str.cmd__c_netsh.exe_winsock_reset_all_catalog___filelog.log
call qword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jae 0x180016ab1
call fcn.1800047e0
test al, al
je 0x180016aa5
lea rdx, str._winsock_reset_all_catalog___filelog.log
call fcn.180006210
jmp 0x180016ab1
lea rcx, str.netsh.exe_winsock_reset_all_catalog___filelog.log
call fcn.1800063a0
xor eax, eax
jmp 0x180016b5a
call fcn.1800047e0
test al, al
je 0x180016b39
call fcn.18000f970
jmp 0x180016b39
mov rcx, qword [0x18006b690]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov r9d, 0x40010
lea r8, [0x18005dd4c]
lea rdx, [0x18005dd58]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.18000f410
mov rcx, rax
lea r8, [0x18005dd80]
mov edx, dword [0x18006b688]
call fcn.18000f4b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
jmp 0x180016b5a
mov rcx, qword [0x18006b690]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.WS2_32.dll_WSACancelBlockingCall]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x180016b5a
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.180023640
add rsp, 0x200
pop rbx
ret