Function at 0x2962016a0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rdi
sub rsp, 0x520
mov ecx, 0xeee0
call fcn.296202710
test eax, eax
jne 0x2962013e0
add rsp, 0x520
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.296201ff0
lea rdi, [rsp + 0xf0]
lea r12, [rsp + 0xe0]
call fcn.296203730
xor eax, eax
mov ecx, 0x1e
movabs rdx, 0x6c6c642e6567
rep stosq qword [rdi], rax
mov ecx, 0x1e
mov qword [rsp + 0x28], rdx
xor r8d, r8d
lea r15, [rsp + 0x1f0]
movabs rdx, 0x6c6c642e30
lea r14, [rsp + 0x300]
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0x68], rdx
xor edx, edx
lea r13, [rsp + 0x410]
mov word [rsp + 0x90], dx
movabs rdx, 0x6c6c642e30
mov qword [rsp + 0xa8], rdx
mov rdx, r12
mov qword [rsp + 0xe8], 0
mov dword [rdi], 0
lea rdi, [rsp + 0x200]
rep stosq qword [rdi], rax
mov ecx, 0x1e
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], 0
mov qword [rsp + 0x300], 0
mov qword [rsp + 0x308], 0
mov qword [rsp + 0x410], 0
mov qword [rsp + 0x418], 0
mov dword [rdi], 0
lea rdi, [rsp + 0x310]
rep stosq qword [rdi], rax
mov ecx, 0x1e
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov dword [rdi], 0
lea rdi, [rsp + 0x420]
rep stosq qword [rdi], rax
movabs rax, 0x646972623436785c
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x20], rax
xor eax, eax
mov word [rsp + 0x50], ax
movabs rax, 0x3231706376736d5c
mov qword [rsp + 0x60], rax
movabs rax, 0x3231726376736d5c
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x88], 0
mov dword [rdi], 0
mov qword [rsp + 0xb0], 0
mov word [rsp + 0xd0], r8w
mov r8d, 0x104
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rdx, r12
mov rcx, r15
call sub.msvcrt.dll_strcpy
mov rdx, r12
mov rcx, r14
call sub.msvcrt.dll_strcpy
mov rdx, r12
mov rcx, r13
call sub.msvcrt.dll_strcpy
mov rcx, r15
mov edx, 0x5c
call sub.msvcrt.dll_strrchr
mov rdx, qword [rsp + 0x20]
mov rcx, r14
mov qword [rax], rdx
mov edx, dword [rsp + 0x28]
mov dword [rax + 8], edx
movzx edx, word [rsp + 0x2c]
mov word [rax + 0xc], dx
movzx edx, byte [rsp + 0x2e]
mov byte [rax + 0xe], dl
mov edx, 0x5c
call sub.msvcrt.dll_strrchr
mov rdx, qword [rsp + 0x60]
mov rcx, r13
mov qword [rax], rdx
mov edx, dword [rsp + 0x68]
mov dword [rax + 8], edx
movzx edx, word [rsp + 0x6c]
mov word [rax + 0xc], dx
mov edx, 0x5c
call sub.msvcrt.dll_strrchr
mov rdx, qword [rsp + 0xa0]
mov rcx, r15
mov qword [rax], rdx
mov edx, dword [rsp + 0xa8]
mov dword [rax + 8], edx
movzx edx, word [rsp + 0xac]
mov word [rax + 0xc], dx
call fcn.296202490
mov rcx, r12
call fcn.296202490
mov rcx, r14
call fcn.296202490
mov rcx, r13
call fcn.296202490
jmp 0x2962013ce
push r12
sub rsp, 0x20
call fcn.2962026c0
test eax, eax
je 0x2962016c0
add rsp, 0x20
pop r12
ret
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
xor ecx, ecx
lea r8, str.Mutex6873665297465261609841626463
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x2962016f7
add rsp, 0x20
pop r12
jmp 0x2962013b0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]