Function at 0x4749e0
Capabilities:
Check mutex on windows
Create thread
Get session information
Get session user name
Read file on windows
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x004fb010]
xor rax, rsp
mov qword [rbp + 0x270], rax
lea r8, str.D93BD84A_B113_45D9_9799_6F8563F0B8C8
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov rdi, rax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0xb7
jne 0x474ad4
lea rcx, str.Service_is_already_started._r_n
call fcn.00471c00
lfence
mov edx, 0x78
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceServiceMain.cpp
call fcn.004036d0
lea rbx, [0x004d16f0]
lea rdx, [rbx + rax*2]
lea r9, str.Exit:_Service_is_already_started.
mov ecx, 4
mov r8d, 0x2e8
call fcn.0044a600
lfence
mov edx, 0x78
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceServiceMain.cpp
call fcn.004036d0
lea rdx, [rbx + rax*2]
lea r9, str.Exit:_Service_is_already_started.
mov ecx, 4
mov r8d, 0x2e8
call fcn.0044b390
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov r8d, 1
lea rdx, [rsp + 0x38]
lea rcx, [0x004d2308]
call fcn.00471c60
jmp 0x47504b
mov dword [0x00503618], 1
mov edx, 1
lea rcx, [0x00475080]
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_SetConsoleCtrlHandler]
call fcn.00472b60
call fcn.00473350
xor r12d, r12d
mov dword [rsp + 0x3c], r12d
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x0043f290]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov r14, rax
test rax, rax
je 0x47504b
mov dword [rsp + 0x40], 1
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
lea r9, [rsp + 0x40]
lea r8, [0x00472030]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov r15, rax
test rax, rax
jne 0x474b7e
mov edx, 0x1000
mov rcx, r14
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
call fcn.00460eb0
jmp 0x47504b
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x00474680]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov rcx, qword [0x005022e8]
test rcx, rcx
je 0x474bbe
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [0x005022e8], r12
mov rdi, r12
mov ecx, 0x60
call fcn.0047970c
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
mov rcx, rax
call fcn.00440210
mov rsi, rax
test rax, rax
je 0x474e11
mov rcx, rax
call fcn.00440c80
test eax, eax
je 0x474d99
lfence
mov edx, 0x78
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceServiceMain.cpp
call fcn.004036d0
lea rbx, [0x004d16f0]
lea rdx, [rbx + rax*2]
lea r9, str.Service_Core_is_created._r_n
mov ecx, 4
mov r8d, 0x315
call fcn.0044a600
lfence
mov edx, 0x78
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceServiceMain.cpp
call fcn.004036d0
lea rdx, [rbx + rax*2]
lea r9, str.Service_Core_is_created._r_n
mov ecx, 4
mov r8d, 0x315
call fcn.0044b390
mov ecx, 0x50
call fcn.0047970c
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
mov rdx, rsi
mov rcx, rax
call fcn.0043c7c0
nop
mov qword [0x005022e8], rax
mov ecx, 0x3cd98
call fcn.0047970c
mov rdi, rax
mov qword [rsp + 0x48], rax
xor edx, edx
mov r8d, 0x3cd98
mov rcx, rax
call fcn.004a2370
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_WTSGetActiveConsoleSessionId]
mov dword [rsp + 0x44], r12d
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x30]
mov r8d, 5
mov edx, eax
xor ecx, ecx
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
mov r9, qword [rsp + 0x30]
lea r8, str.C:Users_lsAppDataLocalPackages
mov edx, 0x100
lea rcx, [rbp + 0x70]
call fcn.004512e0
lea rax, [rbp + 0x70]
mov qword [rdi + 0x3cd78], rax
lea rax, [0x004720b0]
mov qword [rdi + 0x3cd90], rax
mov qword [rdi + 0x3cd88], rsi
mov dword [rsp + 0x48], r12d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x00451340]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi + 0x3cd80], rax
cmp dword [0x004fcdf8], 0
je 0x474e7d
lea rcx, [0x004fcdd0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
cmp dword [0x004fcdf8], 0
je 0x474e7d
lea rcx, [0x004fcdd0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
jmp 0x474e7d
mov dword [0x00503618], r12d
mov rcx, rsi
call fcn.00440d40
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
mov rsi, r12
lfence
mov edx, 0x78
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceServiceMain.cpp
call fcn.004036d0
lea rbx, [0x004d16f0]
lea rdx, [rbx + rax*2]
lea r9, str.Create_Service_Core_error._r_n
mov ecx, 4
mov r8d, 0x326
call fcn.0044a600
lfence
mov edx, 0x78
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceServiceMain.cpp
call fcn.004036d0
lea r9, str.Create_Service_Core_error._r_n
mov r8d, 0x326
jmp 0x474e6f
mov dword [0x00503618], r12d
lfence
mov edx, 0x78
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceServiceMain.cpp
call fcn.004036d0
lea rbx, [0x004d16f0]
lea rdx, [rbx + rax*2]
lea r9, str.Service_Core_cant_be_created._r_n
mov ecx, 4
mov r8d, 0x32c
call fcn.0044a600
lfence
mov edx, 0x78
lea rcx, str.C:Usersjk_kanDesktopGerritSWMgrAsusSoftwareManagerAsusSoftwareManagerGiftBoxServiceGiftBoxServiceServiceMain.cpp
call fcn.004036d0
lea r9, str.Service_Core_cant_be_created._r_n
mov r8d, 0x32c
lea rdx, [rbx + rax*2]
mov ecx, 4
call fcn.0044b390
mov ecx, 0xfffffff6
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
mov rbx, rax
mov qword [0x00503828], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
cmp dword [0x00503618], 0
je 0x474f92
nop dword [rax]
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x70]
call fcn.004a2370
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x100
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFileEx]
test eax, eax
je 0x474f2f
lea rdx, str.Stop
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x474f2f
lea rdx, str.Stop_r_n
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x474f2f
cmp dword [0x00503618], 0
je 0x474f92
mov rbx, qword [0x00503828]
jmp 0x474eb0
mov rcx, qword [0x005022e8]
test rcx, rcx
je 0x474f4c
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [0x005022e8], r12
cmp dword [0x004fcdf8], 0
je 0x474f78
lea rcx, [0x004fcdd0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
cmp dword [0x004fcdf8], 0
je 0x474f78
lea rcx, [0x004fcdd0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rcx, rsi
call fcn.00440d40
test rsi, rsi
je 0x474f92
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
call fcn.0046e420
mov edx, 0x64
mov rcx, r14
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x474fb7
xor edx, edx
mov rcx, r14
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov edx, 0x64
mov rcx, r15
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x474fe3
mov edx, 0x1000
mov rcx, r15
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
mov rcx, r15
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
call fcn.00460eb0
test rdi, rdi
je 0x47504b
mov rcx, qword [rdi + 0x3cd80]
test rcx, rcx
je 0x47503e
xor edx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
mov qword [rdi + 0x3cd80], r12
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rdi + 0x3cd80]
test rcx, rcx
je 0x47503e
xor edx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
mov qword [rdi + 0x3cd80], r12
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov edx, 0x3cd98
mov rcx, rdi
call fcn.00479330
xor eax, eax
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.00479310
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret