Function at 0x140007da0
Capabilities:
Check mutex on windows
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
and qword [rbp + 0x30], 0
lea r8, [rbp + 0x30]
xor ebx, ebx
lea rcx, str.D:PAI_A_OICI_FA___WD_
xor r14d, r14d
xor r9d, r9d
mov qword [rbp + 0x38], r14
lea edi, [rbx + 1]
mov edx, edi
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x140007e00
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x140007ded
mov esi, 0x80004005
jmp 0x140007f65
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x140007f65
xor eax, eax
lea r8, str.GlobalMicrosoft.Windows.Remediation.TelemetryPlugin
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x10], rax
xor edx, edx
mov rax, qword [rbp + 0x30]
and dword [rbp - 0x10], ebx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x20], 0x18
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x140007dd9
mov edx, 0x2710
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test eax, eax
je 0x140007e8b
cmp eax, 0x102
je 0x140007e81
cmp eax, 0xffffffff
jne 0x140007de3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x140007e66
xor esi, esi
jmp 0x140007f6c
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
je 0x140007f6c
jmp 0x140007f65
mov esi, 0x800705b4
jmp 0x140007f65
lea r9, [rbp + 0x38]
call fcn.140009b20
mov r14, qword [rbp + 0x38]
test eax, eax
cmovs r14, rdi
call fcn.140009c68
mov esi, eax
test eax, eax
jns 0x140007eb0
mov ecx, eax
jmp 0x140007f67
xor ecx, ecx
call fcn.140008b64
and qword [rbp + 0x38], 0
lea rax, [r14 + 1]
lea r9, [rbp + 0x38]
mov qword [rbp + 0x40], rax
mov rcx, 0xffffffff80000002
mov r8d, 2
call fcn.14000ad68
mov rdi, qword [rbp + 0x38]
mov esi, eax
test eax, eax
jns 0x140007ee8
mov ecx, eax
jmp 0x140007f35
xor ecx, ecx
call fcn.140008b64
lea rax, [rbp + 0x40]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x140023200]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
jne 0x140007f21
xor esi, esi
jmp 0x140007f3a
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
je 0x140007f3a
mov ecx, esi
call fcn.140008b48
mov ecx, esi
call fcn.140008b64
test rdi, rdi
je 0x140007f4f
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
jns 0x140007f5a
mov ecx, esi
call fcn.140008b48
mov ecx, esi
call fcn.140008b64
test esi, esi
jns 0x140007f6c
mov ecx, esi
call fcn.140008b48
test rbx, rbx
je 0x140007f7a
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test esi, esi
jns 0x140007f8c
lea rdx, str.Failed_to_get_a_proper_GlobalEventCounter_for_telemetry__using_0
mov ecx, esi
call fcn.14000821c
test rbx, rbx
je 0x140007f9a
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140007fa9
call qword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
mov rax, r14
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret