Function at 0x659ff0
Capabilities:
Check mutex on windows
Read file via mapping

Disassembly:
push rbp
push rbx
sub rsp, 0x88
mov rbp, rsp
mov rbx, rcx
lea rcx, [rbp + 0x40]
mov edx, 1
call sub.advapi32.dll_InitializeSecurityDescriptor
lea rcx, [rbp + 0x40]
or edx, 0xffffffff
xor r8, r8
xor r9, r9
call sub.advapi32.dll_SetSecurityDescriptorDacl
mov dword [rbp + 0x68], 0x18
lea rax, [rbp + 0x40]
mov qword [rbp + 0x70], rax
mov dword [rbp + 0x78], 0xffffffff
mov rcx, qword [0x006d76d8]
call fcn.00411070
or rcx, 0xffffffffffffffff
lea rdx, [rbp + 0x68]
mov r8d, 4
xor r9, r9
mov dword [rsp + 0x20], 0x800
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateFileMappingW
mov qword [0x006ee910], rax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x65a1e0
mov rcx, qword [0x006d76d8]
call fcn.00411070
mov ecx, 0xf001f
xor edx, edx
mov r8, rax
call sub.kernel32.dll_OpenFileMappingW
mov qword [0x006ee910], rax
cmp qword [0x006ee910], 0
jne 0x65a0c1
call sub.kernel32.dll_GetLastError
mov dword [rbp + 0x30], eax
mov byte [rbp + 0x38], 0
mov cl, 0x3a
lea rdx, [rbp + 0x30]
xor r8, r8
call fcn.00643800
mov rcx, qword [0x006ee910]
mov edx, 0xf001f
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_MapViewOfFile
mov qword [0x006ee940], rax
cmp qword [0x006ee940], 0
jne 0x65a10c
call sub.kernel32.dll_GetLastError
mov dword [rbp + 0x30], eax
mov byte [rbp + 0x38], 0
mov cl, 0x3a
lea rdx, [rbp + 0x30]
xor r8, r8
call fcn.00643800
mov rax, qword [0x006ee940]
lea rax, [rax + 0xff8]
mov qword [0x006ee948], rax
mov rax, qword [0x006ee948]
lea rax, [rax - 4]
mov qword [0x006ee950], rax
mov rax, qword [0x006ee950]
lea rax, [rax - 4]
mov qword [0x006ee958], rax
mov rax, qword [0x006ee958]
lea rax, [rax - 8]
mov qword [0x006ee968], rax
mov rax, qword [0x006ee968]
lea rax, [rax - 4]
mov qword [0x006ee960], rax
mov rcx, qword [0x006d76d0]
call fcn.00411070
mov ecx, 0x1f0001
xor edx, edx
mov r8, rax
call sub.kernel32.dll_OpenMutexW
mov qword [0x006ee918], rax
mov rcx, rbp
mov edx, 2
call fcn.00659f20
mov qword [0x006ee920], rax
mov rcx, rbp
mov edx, 3
call fcn.00659f20
mov qword [0x006ee928], rax
mov rcx, rbp
mov edx, 4
call fcn.00659f20
mov qword [0x006ee930], rax
mov rcx, rbp
mov edx, 5
call fcn.00659f20
mov qword [0x006ee938], rax
jmp 0x65a308
mov rcx, qword [0x006d76d0]
call fcn.00411070
lea rcx, [rbp + 0x68]
xor edx, edx
mov r8, rax
call fcn.0041d360
mov qword [0x006ee918], rax
mov rcx, rbp
mov edx, 2
xor r8, r8
call fcn.00659f80
mov qword [0x006ee920], rax
mov rcx, rbp
mov edx, 3
mov r8b, 1
call fcn.00659f80
mov qword [0x006ee928], rax
mov rcx, rbp
mov edx, 4
xor r8, r8
call fcn.00659f80
mov qword [0x006ee930], rax
mov rcx, rbp
mov edx, 5
xor r8, r8
call fcn.00659f80
mov qword [0x006ee938], rax
mov rcx, qword [0x006ee910]
mov edx, 0xf001f
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_MapViewOfFile
mov qword [0x006ee940], rax
mov rax, qword [0x006ee940]
lea rax, [rax + 0xff8]
mov qword [0x006ee948], rax
mov rax, qword [0x006ee948]
lea rax, [rax - 4]
mov qword [0x006ee950], rax
mov rax, qword [0x006ee950]
lea rax, [rax - 4]
mov qword [0x006ee958], rax
mov rax, qword [0x006ee958]
lea rax, [rax - 8]
mov qword [0x006ee968], rax
mov rax, qword [0x006ee968]
lea rax, [rax - 4]
mov qword [0x006ee960], rax
mov rax, qword [0x006ee948]
mov dword [rax], 0
mov rax, qword [0x006ee950]
mov dword [rax], 0
mov rax, qword [0x006ee960]
mov dword [rax], 0
mov rax, qword [0x006ee948]
cmp dword [rax], 0
jge 0x65a321
mov rax, qword [0x006ee948]
mov dword [rax], 0
mov rax, qword [0x006ee950]
cmp dword [rax], 0
jge 0x65a33a
mov rax, qword [0x006ee950]
mov dword [rax], 0
mov byte [rbx + 0x1b], 1
lea rsp, [rbp + 0x88]
pop rbx
pop rbp
ret