Function at 0x140003390
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Enumerate gui resources
Enumerate process modules
Terminate process

Disassembly:
push r14
push r15
mov eax, 0x1268
call fcn.140006e70
sub rsp, rax
mov rax, qword [0x14000c038]
xor rax, rsp
mov qword [rsp + 0x1250], rax
lea r8, str.CNCMD_RESTART_CNEXT
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov r14, rax
test rax, rax
jne 0x1400033e3
lea r8, str.CNCMD_RESTART_CNEXT
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r14, rax
mov edx, 0x2710
mov rcx, r14
mov r15d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000360f
mov qword [rsp + 0x1280], rbx
mov qword [rsp + 0x1290], rsi
mov qword [rsp + 0x1260], rdi
call fcn.140002e20
test eax, eax
sete sil
test eax, eax
je 0x1400035ed
xor ebx, ebx
mov qword [rsp + 0x30], 0x8004
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x3c], ebx
lea rcx, [0x1400022e0]
mov byte [rsp + 0x40], bl
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x140003476
mov edi, ebx
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140002e20
test eax, eax
sete sil
test eax, eax
je 0x140003476
inc edi
cmp edi, 0x14
jl 0x140003455
test sil, sil
jne 0x1400035ed
xor edx, edx
mov qword [rsp + 0x1288], rbp
lea rcx, [0x140001ec0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ebp, eax
cmp eax, 1
jne 0x1400035ad
lea r8, [rsp + 0x20]
mov edx, 0x1000
lea rcx, [rsp + 0x250]
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x1400035ad
mov edi, dword [rsp + 0x20]
mov esi, ebx
shr edi, 2
mov eax, ebp
mov dword [rsp + 0x20], edi
test edi, edi
je 0x1400035ab
nop word [rax + rax]
movups xmm0, xmmword [str._unknown_]
mov eax, dword [0x140008658]
lea rcx, [rsp + 0x44]
xor edx, edx
mov dword [rsp + 0x40], eax
mov r8d, 0x1f4
movaps xmmword [rsp + 0x30], xmm0
call sub.VCRUNTIME140.dll_memset
mov eax, esi
mov r8d, dword [rsp + rax*4 + 0x250]
test r8d, r8d
je 0x140003592
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140003585
lea r9, [rsp + 0x24]
mov r8d, 8
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x140003585
mov rdx, qword [rsp + 0x28]
lea r8, [rsp + 0x30]
mov r9d, 0x104
mov rcx, rdi
call sub.KERNEL32.dll_K32GetModuleBaseNameW
lea rdx, [0x140008660]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140003585
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1400035a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0x20]
inc esi
mov eax, ebp
cmp esi, edi
jb 0x1400034e0
jmp 0x1400035ab
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ebp, eax
test ebp, ebp
mov rbp, qword [rsp + 0x1288]
jne 0x1400035f7
nop dword [rax]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140002e20
test eax, eax
sete cl
test eax, eax
je 0x1400035e0
inc ebx
cmp ebx, 0x14
jl 0x1400035c0
test cl, cl
je 0x1400035f7
xor ecx, ecx
call fcn.140001a60
jmp 0x1400035f7
xor ecx, ecx
call fcn.140001a60
mov r15d, eax
mov rsi, qword [rsp + 0x1290]
mov rbx, qword [rsp + 0x1280]
mov rdi, qword [rsp + 0x1260]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test r14, r14
je 0x140003626
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r15d
mov rcx, qword [rsp + 0x1250]
xor rcx, rsp
call fcn.140006ed0
add rsp, 0x1268
pop r15
pop r14
ret