Function at 0x140242960
Capabilities:
Check mutex on windows
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x14039e2e8]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov bl, 1
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, str.DittoAdminPaste__d
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140242a0a
lea rdx, str.C:UsersScottBrAppDataLocalTempDitto_BuildUAC_Thread.cpp
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r9d, 0x89
mov r8, rax
xor edx, edx
lea rcx, str.Paste_uac_admin_exe_is_already_running_just_signalling_paste
call fcn.14015b6c0
jmp 0x140242b0d
mov r8d, SerializeElements<ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140242b0d
mov dword [rsp + 0x40], WSACleanup
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x44], xmm0
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
mov qword [rbp - 0x5c], rax
mov dword [rbp - 0x54], eax
lea rax, str.runas
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, str._uacpaste:_d
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x70], 1
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea rdx, str.C:UsersScottBrAppDataLocalTempDitto_BuildUAC_Thread.cpp
lea rcx, [rsp + 0x20]
test eax, eax
jne 0x140242ae4
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r9d, 0x9b
mov r8, rax
xor edx, edx
lea rcx, str.Failed_to_startup_paste_as_admin_app__we_are_not_pasting_using_admin_app
call fcn.14015b6c0
xor bl, bl
jmp 0x140242b02
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r9d, 0xa0
mov r8, rax
xor edx, edx
lea rcx, str.Startup_up_ditto_paste_as_admin_app__this_will_send_ctrl_v_to_the_admin_app
call fcn.14015b6c0
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
movzx eax, bl
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1402654f0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret