Function at 0x180049840
Capabilities:
Check mutex on windows
Read file via mapping

Disassembly:
mov rax, rsp
push r12
push r13
push r14
sub rsp, 0xc0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r14, rcx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
xor esi, esi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x54], esi
mov dword [rsp + 0x58], esi
lea rax, [rsp + 0x80]
test rax, rax
je 0x1800498d8
xor r9d, r9d
lea r8, [rsp + 0x88]
lea edx, [rsi + 1]
lea rcx, str.D:_D_OICI_GA___BG__D_OICI_GA___AN__A_OICI_GA___AU__A_OICI_GA___BA_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
mov r8, r14
lea rdx, str._s__d_Mutex
lea rcx, [rsp + 0x38]
call fcn.180001a50
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x70]
call fcn.180041f40
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.180012744
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180049939
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea r12, str.Global_
mov rbp, r12
shr rbp, 0x10
test rbp, rbp
jne 0x18004998a
movzx edi, r12w
xor edx, edx
mov ecx, edi
call fcn.180002d04
test rax, rax
je 0x1800499aa
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.180002bbc
jmp 0x1800499aa
xor eax, eax
mov rcx, rbx
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.1800029d0
nop
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.180012fe4
mov r8, qword [rax]
xor edx, edx
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r13, rax
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1800499f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180049a13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
or edx, 0xffffffff
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
mov r8, r14
lea rdx, str._s__d_FileMap
lea rcx, [rsp + 0x30]
call fcn.180001a50
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.180041f40
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180012744
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180049a7c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
test rbp, rbp
jne 0x180049abf
movzx edi, r12w
xor edx, edx
mov ecx, edi
call fcn.180002d04
test rax, rax
je 0x180049adf
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.180002bbc
jmp 0x180049adf
xor eax, eax
mov rcx, rbx
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.1800029d0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x78]
call fcn.180012fe4
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 8
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbp, rax
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x180049b3e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180049b5d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test rbp, rbp
je 0x180049c47
mov qword [rsp + 0x20], 8
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x180049c47
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180049c32
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.180049560
test eax, eax
je 0x180049c3e
mov r12d, dword [rsp + 0x58]
mov rcx, r12
call fcn.18004a00c
mov rbp, rax
test rax, rax
je 0x180049c28
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.180054ba0
lea r11, [rsp + 0xa0]
lea rax, [rsp + 0x50]
mov rcx, qword [rax]
mov qword [r11], rcx
mov ecx, dword [rax + 8]
mov dword [r11 + 8], ecx
lea r8, [rsp + 0xa0]
mov rdx, rbp
mov rcx, r14
call fcn.1800496c0
test eax, eax
je 0x180049c28
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
call fcn.1800492e0
mov rsi, rax
test rax, rax
je 0x180049c28
mov qword [rdi], rax
mov rcx, rbp
call fcn.180052b58
jmp 0x180049c3e
mov rsi, qword [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180049c7a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x180049c9c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
jmp 0x180049c9f
mov rax, rsi
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret