Function at 0x14000f91c
Capabilities:
Check mutex on windows
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov byte [rsp + 8], cl
push rdi
push r14
push r15
sub rsp, 0x220
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov r15b, cl
call fcn.14000fd10
xor r14d, r14d
test al, al
je 0x140022d18
lea rcx, [rsp + 0x1d0]
call fcn.14000f830
lea rcx, [rsp + 0x1d0]
call fcn.14000fc64
test al, al
je 0x140022d7f
lea r8, str.VCTIP_14.29.30148.0_CLIENT_MUTEX
lea edx, [r14 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140022db3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140022de5
lea r9, str.VCTIP_14.29.30148.0_READY_EVENT
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140022e68
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140022fe4
cmp eax, 0x102
jne 0x140022e9a
call fcn.14000fcc4
test al, al
jne 0x140022ecc
test r15b, r15b
jne 0x140022efd
lea rcx, [rsp + 0x1f0]
call fcn.14000d0fc
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rsp + 0x164]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x160], 0x68
lea rax, [rsp + 0x1f0]
cmp qword [rsp + 0x208], 8
cmovae rax, qword [rsp + 0x1f0]
lea rcx, [rsp + 0x1d0]
cmp qword [rsp + 0x1e8], 8
cmovae rcx, qword [rsp + 0x1d0]
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x48], rdx
lea rdx, [rsp + 0x160]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140022f0f
mov rsi, qword [rsp + 0x80]
test rsi, rsi
je 0x140022f41
mov qword [rsp + 0x60], rsi
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rsi
mov r9d, 0x3e8
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x140022f6a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1f0]
call fcn.14000ed54
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1d0]
call fcn.14000ed54
mov al, 1
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.140011450
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
test r15b, r15b
je 0x140022d78
lea rcx, str.Not_launching_VCTIP:_CLR_not_present_n
call fcn.14002ab94
jmp 0x140022d78
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1f0]
call fcn.14000ed54
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1d0]
call fcn.14000ed54
xor al, al
jmp 0x14000fb41
test r15b, r15b
je 0x140023013
lea rdx, [rsp + 0x1d0]
cmp qword [rsp + 0x1e8], 8
cmovae rdx, qword [rsp + 0x1d0]
lea rcx, str.Not_launching_VCTIP:_Binary_not_found____S_n
call fcn.14002ab94
jmp 0x140023013
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.CreateMutex
lea rcx, [rsp + 0x98]
call fcn.14002e130
lea rdx, [0x140057f28]
lea rcx, [rsp + 0x98]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov edx, 0x3e8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000f9b2
cmp eax, 0x80
je 0x14000f9b2
cmp eax, 0x102
je 0x140022e3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140054ba0]
lea rcx, [rsp + 0xb0]
call fcn.14002e130
lea rdx, [0x140057f28]
lea rcx, [rsp + 0xb0]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea rdx, str.WaitForSingleObject_timed_out
lea rcx, [rsp + 0xc8]
call fcn.14002db80
lea rdx, [0x140057f28]
lea rcx, [rsp + 0xc8]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.CreateEvent
lea rcx, [rsp + 0xe0]
call fcn.14002e130
lea rdx, [0x140057f28]
lea rcx, [rsp + 0xe0]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140054ba0]
lea rcx, [rsp + 0xf8]
call fcn.14002e130
lea rdx, [0x140057f28]
lea rcx, [rsp + 0xf8]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
test r15b, r15b
je 0x140022edd
lea rcx, str.Not_launching_VCTIP:_it_is_flagged_as_unstable_n
call fcn.14002ab94
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140023013
lea rcx, str.Launching_VCTIP_n
call fcn.14002ab94
nop
jmp 0x14000fa0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.CreateProcess
lea rcx, [rsp + 0x110]
call fcn.14002e130
lea rdx, [0x140057f28]
lea rcx, [rsp + 0x110]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea rdx, str.CreateProcess_returned_NULL_process_handle
lea rcx, [rsp + 0x128]
call fcn.14002db80
lea rdx, [0x140057f28]
lea rcx, [rsp + 0x128]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
sub eax, 1
je 0x140022fb6
cmp eax, 0x101
je 0x140022fa8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140054e10]
lea rcx, [rsp + 0x140]
call fcn.14002e130
lea rdx, [0x140057f28]
lea rcx, [rsp + 0x140]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
test r15b, r15b
je 0x140022fc8
lea rcx, str.Failed_to_launch_VCTIP:_timeout_n
jmp 0x140022fc2
test r15b, r15b
je 0x140022fc8
lea rcx, str.Failed_to_launch_VCTIP:_crash_during_startup_n
call fcn.14002ab94
nop
test r15b, r15b
je 0x140022fd9
lea rcx, str.Marking_VCTIP_as_unstable_n
call fcn.14002ab94
call fcn.14002e034
nop
jmp 0x140022d3a
test r15b, r15b
je 0x140022ff5
lea rcx, str.Not_launching_VCTIP:_VCTIP_is_already_running_n
call fcn.14002ab94
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14b, 1
lea rcx, [rsp + 0x1d0]
call fcn.14000ed54
mov al, r14b
jmp 0x14000fb41