Function at 0x140051d60
Capabilities:
Check mutex on windows
Enumerate processes
Get session user name

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x9b0]
sub rsp, 0xab0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0xb00], rbx
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rbp + 0x9a0], rax
mov rsi, rcx
xor r13d, r13d
mov qword [rcx], r13
test edx, edx
je 0x140051e89
mov qword [rcx + 0x60], r13
mov ecx, 0x26c0
call fcn.1400d5224
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140051dd0
mov rcx, rax
call fcn.140061640
jmp 0x140051dd3
mov rax, r13
mov qword [rsi + 0x60], rax
mov rcx, rax
call fcn.140063db0
test eax, eax
je 0x1400521af
mov byte [rsi + 0x128], 0
cmp byte [rsi + 0x108], 0
je 0x140051e3f
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov qword [rsi + 0x110], rax
test rax, rax
je 0x140051e3f
lea rcx, [rsi + 0x118]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x493e0
mov dword [rsp + 0x20], 0x2ee0
lea r9, [rsi + 0xb8]
lea r8, [0x140059ef0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov rax, qword [rsi + 0x60]
cmp byte [rax + 0x15e4], 0
jne 0x140051e73
mov ecx, 0x188
call fcn.1400d5224
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140051e6f
mov rdx, qword [rsi + 0x60]
mov rcx, rax
call fcn.140087010
mov r13, rax
mov qword [rsi + 0x58], r13
or edx, 0xffffffff
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140051e73
jmp 0x1400521af
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
lea r14, str.LocalF191157A_5740_40ec_9CC5_95DF3D6C6B78_
test r14, 0xffffffffffff0000
jne 0x140051ed9
movzx ebx, r14w
mov ecx, ebx
call fcn.140002830
test rax, rax
je 0x140051f4a
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400029f0
jmp 0x140051f4a
mov r12d, dword [rbx - 0x10]
mov rdi, r14
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x2b
or eax, ecx
jge 0x140051f0c
mov edx, MsiGetActiveDatabase
lea rcx, [rsp + 0x40]
call fcn.1400020c0
mov rbx, qword [rsp + 0x40]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0x56
mov rcx, rbx
add rdx, rdx
cmp rdi, r12
ja 0x140051f2c
lea r8, [rbx + rdi*2]
call fcn.1400d4ebc
jmp 0x140051f34
mov r8, r14
call fcn.1400d4e34
cmp dword [rbx - 0xc], 0x2b
jl 0x1400521a4
mov dword [rbx - 0x10], 0x2b
mov word [rbx + 0x56], r13w
mov word [rbp + 0x1a0], r13w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp + 0x1a2]
call fcn.1400dd9f0
mov dword [rsp + 0x48], 0x3ff
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea r8, [rbp + 0x1a0]
lea rdx, [0x14012f6a8]
lea rcx, [rsp + 0x40]
call fcn.140045040
mov rbx, qword [rsp + 0x40]
mov r8, rbx
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi], rax
test rax, rax
je 0x140052053
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140051fea
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400521af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x1400521af
mov ecx, 0x26c0
call fcn.1400d5224
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140052008
mov rcx, rax
call fcn.140062350
jmp 0x14005200b
mov rax, r13
mov qword [rsi + 0x60], rax
mov rcx, rax
call fcn.140065990
test eax, eax
jne 0x14005201d
jmp 0x140051fc6
mov rax, qword [rsi + 0x60]
cmp byte [rax + 0x15e4], 0
jne 0x140052053
mov ecx, 0x188
call fcn.1400d5224
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14005204c
mov rdx, qword [rsi + 0x60]
mov rcx, rax
call fcn.140087010
jmp 0x14005204f
mov rax, r13
mov qword [rsi + 0x58], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14005219f
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x60]
call fcn.1400dd9f0
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov edi, eax
mov r12d, r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r15d, eax
test edi, edi
je 0x1400520dc
nop word [rax + rax]
mov r8d, dword [rbp - 0x80]
cmp r15d, dword [rsp + 0x68]
cmove r12d, r8d
mov dword [rsp + 0x60], 0x238
test r12d, r12d
jne 0x1400520e0
lea rdx, [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400520b0
mov r8d, dword [rbp - 0x80]
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140052170
cmp rax, 0xffffffffffffffff
je 0x140052110
nop dword [rax + rax]
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140052100
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x140052181
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi + 0x58]
test rcx, rcx
je 0x14005213f
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rcx, qword [rsi + 0x60]
test rcx, rcx
je 0x140052160
call fcn.14006c3d0
mov rcx, qword [rsi + 0x60]
test rcx, rcx
je 0x140052160
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x30], r13
jmp 0x140052181
or edx, 0xffffffff
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140052170
mov rcx, qword [rsi]
test rcx, rcx
je 0x14005219f
cmp rcx, 0xffffffffffffffff
je 0x14005219f
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140051fc6
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov rcx, qword [rbp + 0x9a0]
xor rcx, rsp
call fcn.1400d4d90
mov rbx, qword [rsp + 0xb00]
add rsp, 0xab0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret