Function at 0x14000b3e0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Terminate process

Disassembly:
test rcx, rcx
je 0x14000bc70
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x140019028]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbp, rcx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x10
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80223028
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000b494
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.driverCompatVersionIsSameAsOurs:_DeviceIoControl
lea rdx, str._s_failed_with_0x_08X
lea rcx, [rsp + 0x60]
call fcn.14000d550
lea ecx, [r13 + 1]
lea rdx, [rsp + 0x60]
call fcn.14000d2b0
jmp 0x14000b4c1
movabs rax, 0x123456789abcdef
cmp qword [rsp + 0x48], rax
je 0x14000b4ae
lea rcx, str.driverCompatVersionIsSameAsOurs:_invalid_output_from_driver
jmp 0x14000b4bc
cmp dword [rsp + 0x50], 6
je 0x14000b4cd
lea rcx, str.Driver_version_mismatch._Ignore_this_if_the_driver_was_updated_or_rolled_back.
call fcn.14000d390
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor r15b, r15b
cmp qword [0x14001a028], r13
jne 0x14000b64c
mov ecx, 0x198
call fcn.14000e140
mov rsi, rax
mov qword [rsp + 0x40], rax
xor edx, edx
mov r8d, 0x198
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rsi
call fcn.14000cc60
nop
lea rax, vtable.ChildProcAgent.0
mov qword [rsi], rax
mov qword [rsi + 0x98], rbp
lea rdi, [rsi + 0xa0]
mov qword [rsp + 0x48], rdi
lea rax, vtable.Channel_struct_ChildProcAgent::UserSessionEventMessage_.0
mov qword [rdi], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x48], rbx
mov qword [rbx], r13
mov qword [rbx + 8], r13
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov qword [rbx + 0x20], r13
mov ecx, 0x10
call fcn.14000e140
mov qword [rax + 8], r13
mov qword [rbx], rax
mov qword [rax], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi + 0x30], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x38], rax
lea rdi, [rsi + 0xe0]
mov qword [rsp + 0x48], rdi
lea rax, vtable.Channel_class_SensorsAgent____ptr64_.0
mov qword [rdi], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x48], rbx
mov qword [rbx], r13
mov qword [rbx + 8], r13
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov qword [rbx + 0x20], r13
mov ecx, 0x10
call fcn.14000e140
mov qword [rax + 8], r13
mov qword [rbx], rax
mov qword [rax], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi + 0x30], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x38], rax
lea rcx, [rsi + 0x120]
call fcn.140002170
mov qword [rsi + 0x160], r13
mov qword [rsi + 0x168], r13
mov qword [rsi + 0x170], r13
mov qword [rsi + 0x178], r13
mov qword [rsi + 0x180], r13
mov qword [rsi + 0x188], r13
mov qword [rsi + 0x190], r13
mov rcx, qword [0x14001a028]
mov qword [0x14001a028], rsi
test rcx, rcx
je 0x14000b649
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov r15b, 1
mov eax, dword [0x140019ffc]
test eax, eax
je 0x14000b7db
cmp qword [0x14001a000], 0
jne 0x14000b7db
mov ecx, 0xe0
call fcn.14000e140
mov rdi, rax
mov qword [rsp + 0x48], rax
xor edx, edx
mov r8d, 0xe0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
call fcn.14000cc60
nop
lea rax, vtable.SensorsAgent.0
mov qword [rdi], rax
mov qword [rdi + 0x98], rbp
lea rcx, [rdi + 0xa0]
call fcn.140002170
nop
mov rcx, qword [0x14001a000]
mov qword [0x14001a000], rdi
test rcx, rcx
je 0x14000b6d5
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rdi, qword [0x14001a000]
test r15b, r15b
je 0x14000b6ed
mov rax, qword [0x14001a028]
mov qword [rax + 0x190], rdi
jmp 0x14000b7aa
mov r14, qword [0x14001a028]
mov edx, 0xffffffff
mov rcx, qword [r14 + 0x110]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rbx, [r14 + 0xe8]
mov rcx, qword [rbx + 0x20]
movzx eax, cl
add al, byte [rbx + 0x18]
test al, 1
jne 0x14000b730
lea rax, [rcx + 2]
shr rax, 1
cmp qword [rbx + 0x10], rax
ja 0x14000b730
mov rcx, rbx
call fcn.140003d80
mov rdx, qword [rbx + 0x10]
lea rcx, [rdx*2 - 1]
and rcx, qword [rbx + 0x18]
mov qword [rbx + 0x18], rcx
mov rsi, qword [rbx + 0x20]
add rsi, rcx
mov rcx, rsi
shr rcx, 1
lea rax, [rdx - 1]
and rcx, rax
lea r12, [rcx*8]
mov rax, qword [rbx + 8]
cmp qword [r12 + rax], 0
jne 0x14000b77d
mov ecx, 0x10
call fcn.14000e140
mov rcx, qword [rbx + 8]
mov qword [r12 + rcx], rax
and esi, 1
mov rax, qword [rbx + 8]
mov rcx, qword [r12 + rax]
mov qword [rcx + rsi*8], rdi
inc qword [rbx + 0x20]
mov rcx, qword [r14 + 0x118]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r14 + 0x110]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rbx, qword [0x14001a000]
cmp qword [rbx + 0x50], 0
jne 0x14000b7db
lea r9, [rbx + 0x58]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
lea r8, [0x14000d600]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x50], rax
mov eax, dword [0x140019fe8]
test eax, eax
je 0x14000b88e
cmp qword [0x14001a020], 0
jne 0x14000b88e
mov ecx, 0xe0
call fcn.14000e140
mov rbx, rax
mov qword [rsp + 0x48], rax
xor edx, edx
mov r8d, 0xe0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call fcn.14000cc60
nop
lea rax, vtable.MonitorCountAgent.0
mov qword [rbx], rax
mov qword [rbx + 0x98], rbp
lea rcx, [rbx + 0xa0]
call fcn.140002170
nop
mov rcx, qword [0x14001a020]
mov qword [0x14001a020], rbx
test rcx, rcx
je 0x14000b864
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [0x14001a020]
cmp qword [rbx + 0x50], 0
jne 0x14000b88e
lea r9, [rbx + 0x58]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
lea r8, [0x14000d600]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x50], rax
mov eax, dword [0x140019ff0]
test eax, eax
je 0x14000b99f
cmp qword [0x140019fd0], 0
jne 0x14000b99f
mov ecx, 0xe0
call fcn.14000e140
mov rbx, rax
mov qword [rsp + 0x48], rax
xor edx, edx
mov r8d, 0xe0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call fcn.14000cc60
nop
lea rax, vtable.PeripheralCountAgent.0
mov qword [rbx], rax
mov qword [rbx + 0x98], rbp
lea rsi, [rbx + 0xa0]
mov qword [rsp + 0x40], rsi
lea rax, vtable.Channel_enum_PeripheralCountAgent::Event_.0
mov qword [rsi], rax
lea rdi, [rsi + 8]
mov qword [rsp + 0x40], rdi
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], r13
mov qword [rdi + 0x20], r13
mov ecx, 0x10
call fcn.14000e140
mov qword [rax + 8], r13
mov qword [rdi], rax
mov qword [rax], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 0x30], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x38], rax
mov rcx, qword [0x140019fd0]
mov qword [0x140019fd0], rbx
test rcx, rcx
je 0x14000b975
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [0x140019fd0]
cmp qword [rbx + 0x50], 0
jne 0x14000b99f
lea r9, [rbx + 0x58]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
lea r8, [0x14000d600]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x50], rax
mov eax, dword [0x140019ff4]
test eax, eax
je 0x14000ba79
cmp qword [0x14001a008], 0
jne 0x14000ba79
mov ecx, 0xf0
call fcn.14000e140
mov rbx, rax
mov qword [rsp + 0x48], rax
xor edx, edx
mov r8d, 0xf0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call fcn.14000cc60
nop
lea rax, vtable.BatteryAgent.0
mov qword [rbx], rax
mov qword [rbx + 0x98], rbp
mov dword [rbx + 0xa0], r13d
mov qword [rbx + 0xa4], 0xffffffffffffffff
lea rcx, [rbx + 0xb0]
call fcn.140002170
nop
mov rcx, qword [0x14001a008]
mov qword [0x14001a008], rbx
test rcx, rcx
je 0x14000ba3a
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [0x14001a008]
mov rax, qword [0x14001a028]
mov qword [rax + 0x180], rbx
mov rbx, qword [0x14001a008]
cmp qword [rbx + 0x50], 0
jne 0x14000ba79
lea r9, [rbx + 0x58]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
lea r8, [0x14000d600]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x50], rax
mov eax, dword [0x140019ff8]
test eax, eax
je 0x14000bc0a
cmp qword [0x14001a018], 0
jne 0x14000bc0a
mov ecx, 0x120
call fcn.14000e140
mov rbx, rax
mov qword [rsp + 0x48], rax
xor edx, edx
mov r8d, 0x120
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call fcn.14000cc60
nop
lea rax, vtable.PerfCounterAgent.0
mov qword [rbx], rax
mov qword [rbx + 0x98], rbp
lea rsi, [rbx + 0xa0]
mov qword [rsp + 0x40], rsi
lea rax, vtable.Channel_struct_PerfCounterAgent::AppCpuTrackingMessage_.0
mov qword [rsi], rax
lea rdi, [rsi + 8]
mov qword [rsp + 0x40], rdi
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], r13
mov qword [rdi + 0x20], r13
mov ecx, 0x10
call fcn.14000e140
mov qword [rax + 8], r13
mov qword [rdi], rax
mov qword [rax], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 0x30], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x38], rax
lea rsi, [rbx + 0xe0]
mov qword [rsp + 0x40], rsi
lea rax, vtable.Channel_struct_PerfCounterAgent::PerfCounterPollingMessage_.0
mov qword [rsi], rax
lea rdi, [rsi + 8]
mov qword [rsp + 0x40], rdi
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], r13
mov qword [rdi + 0x20], r13
mov ecx, 0x10
call fcn.14000e140
mov qword [rax + 8], r13
mov qword [rdi], rax
mov qword [rax], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 0x30], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x38], rax
mov rcx, qword [0x14001a018]
mov qword [0x14001a018], rbx
test rcx, rcx
je 0x14000bbcb
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [0x14001a018]
mov rax, qword [0x14001a028]
mov qword [rax + 0x188], rbx
mov rbx, qword [0x14001a018]
cmp qword [rbx + 0x50], 0
jne 0x14000bc0a
lea r9, [rbx + 0x58]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
lea r8, [0x14000d600]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x50], rax
test r15b, r15b
je 0x14000bc40
mov rbx, qword [0x14001a028]
cmp qword [rbx + 0x50], 0
jne 0x14000bc40
lea r9, [rbx + 0x58]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
lea r8, [0x14000d600]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x50], rax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14000e120
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret