Function at 0x140023590
Capabilities:
Allocate or change rwx memory
Check mutex on windows
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov dword [rsp + 0x40], 0
xor edx, edx
lea rcx, [0x140043cc0]
call fcn.14000d560
mov qword [0x140051ee0], rax
xor edx, edx
lea rcx, [0x140043ce0]
call fcn.14000d560
mov qword [0x140051ee8], rax
lea rcx, [rsp + 0x20]
call fcn.1400135c0
mov r8d, 0x20
lea rdx, [rsp + 0x48]
lea rcx, [0x140043d0c]
call fcn.14000d3a0
lea rdx, [0x1400403d0]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov byte [rsp + 0x4f], 0x72
mov byte [rsp + 0x50], 0x64
mov byte [rsp + 0x51], 0x65
mov byte [rsp + 0x52], 0x63
mov byte [rsp + 0x53], 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
lea r8, [rsp + 0x48]
lea rdx, str._S__x
lea rcx, [rsp + 0x20]
call fcn.140014990
lea rcx, [rsp + 0x20]
call fcn.140013f00
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r11, rax
mov rax, qword [rsp + 0xb8]
mov qword [rax], r11
mov rax, qword [rsp + 0xb8]
cmp qword [rax], 0
je 0x140023854
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xb8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r11, qword [rsp + 0xc0]
mov qword [0x140051ec8], r11
mov rax, qword [rsp + 0xc8]
mov qword [0x140051ed0], rax
cmp qword [0x140051ee0], 0
je 0x1400236cb
cmp qword [0x140051ee8], 0
jne 0x14002380c
mov edx, 1
lea rcx, [0x140043ca0]
call fcn.14000d610
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 4]
and eax, 0xffffff
mov dword [rsp + 0x84], eax
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 7]
mov byte [rsp + 0x81], al
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 8]
mov byte [rsp + 0x8c], al
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 9]
mov byte [rsp + 0x80], al
cmp dword [rsp + 0x88], 0x4244c8b
jne 0x14002380a
cmp dword [rsp + 0x84], 0x241c8b
jne 0x14002380a
movzx eax, byte [rsp + 0x81]
cmp eax, 0x51
jne 0x14002380a
movzx eax, byte [rsp + 0x8c]
cmp eax, 0x53
jne 0x14002380a
movzx eax, byte [rsp + 0x80]
cmp eax, 0xe8
jne 0x14002380a
mov rcx, qword [rsp + 0x70]
add rcx, 0xa
lea r9, [rsp + 0x68]
mov r8d, 0x40
mov edx, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14002380a
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 0xa]
mov rax, qword [rsp + 0x70]
lea rax, [rax + rcx + 0xe]
mov qword [0x140051ed8], rax
lea rcx, [0x1400234f0]
sub rcx, qword [rsp + 0x70]
sub rcx, 0xe
mov rax, qword [rsp + 0x70]
mov dword [rax + 0xa], ecx
mov rcx, qword [rsp + 0x70]
add rcx, 0xa
lea r9, [rsp + 0x68]
mov r8d, dword [rsp + 0x68]
mov edx, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x40], 1
jmp 0x140023854
lea rdx, [0x140023460]
mov ecx, 1
call qword [0x140051ee0]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
je 0x14002383e
mov dword [rsp + 0x9c], 1
jmp 0x140023849
mov dword [rsp + 0x9c], 0
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x14002387d
mov rcx, qword [rsp + 0xb8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xb8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x98], eax
lea rcx, [rsp + 0x20]
call fcn.140013980
mov eax, dword [rsp + 0x98]
add rsp, 0xa8
ret