Function at 0x140008960
Capabilities:
Check mutex on windows
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x1400ae088]
xor rax, rsp
mov qword [rbp + 0x210], rax
lea rcx, [0x14008ac34]
call fcn.140018760
lea r9, [0x1400af290]
mov r8d, 0xa
lea rdx, str.ReRunBTServer
lea rcx, str.__hs_____d_:_____s
call fcn.140018f50
lea r8, str.F0CE0ABE_6466_4831_8095_13A558945687
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov rbx, rax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0xb7
jne 0x140008a0d
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
lea rcx, str.Another_RunBTServerThread_not_end
call fcn.140018760
lea r9, [0x1400af290]
mov r8d, 0x11
lea rdx, str.ReRunBTServer
lea rcx, str.__hs_____d_:_____s
call fcn.140018f50
jmp 0x140008c9c
mov qword [rsp + 0x330], rdi
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_WTSGetActiveConsoleSessionId]
xor edi, edi
lea rdx, [rsp + 0x68]
mov ecx, eax
mov qword [rsp + 0x68], rdi
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x140008a89
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.WTSQueryUserToken_failed__GetLastError_d
call fcn.140018760
lea r9, [0x1400af290]
lea r8d, [rdi + 0x1d]
lea rdx, str.ReRunBTServer
lea rcx, str.__hs_____d_:_____s
call fcn.140018f50
test rbx, rbx
je 0x140008a72
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
lea rcx, str.RunBTServerThread__
call fcn.140018760
mov r8d, 0x23
jmp 0x140008c7a
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0x2000000
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rdi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateTokenEx]
test eax, eax
jne 0x140008ae1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.DuplicateTokenEx_fail__GetLastError_d
call fcn.140018760
mov r8d, 0x36
jmp 0x140008c07
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
xor r8d, r8d
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x140008b16
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateEnvironmentBlock_fail__GetLastError_d
call fcn.140018760
mov r8d, 0x3f
jmp 0x140008c07
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x20a
call fcn.140026290
mov r8d, 0x104
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
jne 0x140008b54
lea rcx, str.GetModuleFileName__0
call fcn.140018760
mov r8d, 0x47
jmp 0x140008c07
lea rcx, [rbp]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea r8, [0x14008ae50]
mov edx, 0x105
lea rcx, [rbp]
call fcn.14004a4fc
xor edx, edx
lea rcx, [rbp - 0x6c]
lea r8d, [rdx + 0x64]
call fcn.140026290
mov rcx, qword [rsp + 0x60]
lea r8, [0x14008ac30]
xor eax, eax
mov dword [rbp - 0x70], 0x68
mov qword [rsp + 0x78], rax
lea rdx, [rbp]
mov qword [rbp - 0x80], rax
xor r9d, r9d
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x430
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessAsUserW]
test eax, eax
jne 0x140008c21
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp]
lea rcx, str.CreateProcessAsUser__s__fail_with_0x_x
call fcn.140018760
mov r8d, 0x5c
lea r9, [0x1400af290]
lea rdx, str.ReRunBTServer
lea rcx, str.__hs_____d_:_____s
call fcn.140018f50
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140008c36
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rsp + 0x68], rdi
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140008c4b
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rsp + 0x60], rdi
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140008c5a
call sub.USERENV.dll_DestroyEnvironmentBlock
test rbx, rbx
je 0x140008c68
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
lea rcx, [0x14008aec0]
call fcn.140018760
mov r8d, 0x79
lea r9, [0x1400af290]
lea rdx, str.ReRunBTServer
lea rcx, str.__hs_____d_:_____s
call fcn.140018f50
mov rdi, qword [rsp + 0x330]
xor eax, eax
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140023950
mov rbx, qword [rsp + 0x338]
add rsp, 0x320
pop rbp
ret