Function at 0x18000eac0
Capabilities:
Check mutex on windows

Disassembly:
mov r11, rsp
push rbp
sub rsp, 0x4b0
mov rax, qword [0x18009c160]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov qword [r11 + 0x20], r12
mov dword [0x1800ae168], 4
mov qword [r11 - 0x18], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, str.AgentU64
lea rcx, [0x1800b1b58]
mov r8d, 0xff
mov dword [0x1800ae16c], eax
call fcn.1800194ec
lea rcx, [0x1800b1a80]
call fcn.180004450
cmp dword [0x1800b1b40], 0
je 0x18000eb48
lea r9, str.RunAgentU64_1
lea r8, str.AgentU64
lea rcx, [0x1800b1a88]
mov edx, 0x1f
call fcn.180008e60
xor r12d, r12d
mov ebp, r12d
call fcn.18002f9f0
lea r14, [0x1800b2450]
test eax, eax
jne 0x18000eb66
lea ebp, [rax + 1]
jmp 0x18000f170
mov qword [rsp + 0x4c0], rbx
mov qword [rsp + 0x4c8], rsi
lea rcx, str.WinSta0
xor edx, edx
mov r8d, 0x10000000
mov qword [rsp + 0x4d0], rdi
mov qword [rsp + 0x4a8], r13
call qword [sym.imp.USER32.dll_OpenWindowStationW]
mov rdi, rax
test rax, rax
jne 0x18000eba8
mov ebx, r12d
jmp 0x18000ebbc
mov rcx, rax
call qword [sym.imp.USER32.dll_SetProcessWindowStation]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_CloseWindowStation]
cmp dword [0x1800b1b40], ebp
je 0x18000ebe7
lea r9, str.RunAgentU64_11___d_
lea r8, str.AgentU64
lea rcx, [0x1800b1a88]
mov edx, 0x1f
mov dword [rsp + 0x20], ebx
call fcn.180008e60
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], r12w
call fcn.18001ab30
or rcx, 0xffffffffffffffff
xor eax, eax
lea rsi, str.TEC_OCULAR__AGENT_V3_MUTEX_AGENT
lea r13, str.Global_
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rbx, rcx
cmp rcx, 0x104
jae 0x18000ed02
call fcn.18002fa90
test eax, eax
je 0x18000ece7
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
add rcx, rbx
cmp rcx, 0x104
ja 0x18000ed02
mov rcx, r12
movzx eax, word [rcx + r13]
add rcx, 2
mov word [rsp + rcx + 0x6e], ax
test ax, ax
jne 0x18000ec61
xor eax, eax
lea rdi, [rsp + 0x70]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str.TEC_OCULAR__AGENT_V3_MUTEX_AGENT]
mov qword [rdi - 2], rax
mov rax, qword [0x180080868]
mov qword [rdi + 6], rax
mov rax, qword [0x180080870]
mov qword [rdi + 0xe], rax
mov rax, qword [0x180080878]
mov qword [rdi + 0x16], rax
mov rax, qword [0x180080880]
mov qword [rdi + 0x1e], rax
mov rax, qword [0x180080888]
mov qword [rdi + 0x26], rax
mov rax, qword [0x180080890]
mov qword [rdi + 0x2e], rax
mov rax, qword [0x180080898]
mov qword [rdi + 0x36], rax
movzx eax, word [0x1800808a0]
mov word [rdi + 0x3e], ax
jmp 0x18000ed02
mov rcx, r12
nop word [rax + rax]
movzx eax, word [rcx + rsi]
add rcx, 2
mov word [rsp + rcx + 0x6e], ax
test ax, ax
jne 0x18000ecf0
lea r8, [rsp + 0x70]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
jne 0x18000ed2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x18000ed37
mov ebp, 2
jmp 0x18000f150
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.18002fa50
test eax, eax
je 0x18000ed7f
lea rcx, str.WinSta0
xor edx, edx
mov r8d, 0x10000000
call qword [sym.imp.USER32.dll_OpenWindowStationW]
mov rbx, rax
test rax, rax
je 0x18000ed75
mov rcx, rax
call qword [sym.imp.USER32.dll_SetProcessWindowStation]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.USER32.dll_CloseWindowStation]
test edi, edi
jne 0x18000ed7f
mov ebp, 3
jmp 0x18000f150
lea rcx, [rsp + 0x282]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x280], r12w
call fcn.18001ab30
call fcn.18002fa50
test eax, eax
jne 0x18000edab
mov r9d, r12d
jmp 0x18000ee0b
mov rax, qword [0x1800b24f8]
test rax, rax
jne 0x18000eddb
lea rcx, [0x180081f90]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.ProcessIdToSessionId
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800b24f8], rax
mov r9d, r12d
mov dword [rsp + 0x30], r12d
test rax, rax
je 0x18000ee0b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x30]
mov ecx, eax
call qword [0x1800b24f8]
mov r9d, dword [rsp + 0x30]
test eax, eax
cmove r9d, r12d
mov dword [rsp + 0x30], r9d
lea r8, str.TEC_OCULAR__AGENT_V3_MUTEX_AGENTU64
lea rdx, [0x180089378]
lea rcx, [rsp + 0x280]
call fcn.180019b90
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], r12w
call fcn.18001ab30
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x280]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rbx, rcx
cmp rcx, 0x104
jae 0x18000eef6
call fcn.18002fa90
test eax, eax
je 0x18000eed4
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
add rcx, rbx
cmp rcx, 0x104
ja 0x18000eef6
mov rcx, r12
nop
movzx eax, word [rcx + r13]
add rcx, 2
mov word [rsp + rcx + 0x6e], ax
test ax, ax
jne 0x18000ee90
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x280]
nop dword [rax + rax]
movzx eax, word [rdx + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x18000eec0
jmp 0x18000eef6
mov rcx, r12
nop word [rax + rax]
movzx eax, word [rsp + rcx + 0x280]
add rcx, 2
mov word [rsp + rcx + 0x6e], ax
test ax, ax
jne 0x18000eee0
lea r8, [rsp + 0x70]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
jne 0x18000f142
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x18000f14b
cmp qword [0x1800b19d0], rbp
jne 0x18000f04d
call fcn.180018a40
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x70], r12w
mov rsi, rax
call fcn.18001ab30
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x280]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rbx, rcx
cmp rcx, 0x104
jae 0x18000f006
call fcn.18002fa90
test eax, eax
je 0x18000efe4
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
add rcx, rbx
cmp rcx, 0x104
ja 0x18000f006
mov rcx, r12
nop
movzx eax, word [rcx + r13]
add rcx, 2
mov word [rsp + rcx + 0x6e], ax
test ax, ax
jne 0x18000efa0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x280]
nop dword [rax + rax]
movzx eax, word [rdx + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x18000efd0
jmp 0x18000f006
mov rcx, r12
nop word [rax + rax]
movzx eax, word [rsp + rcx + 0x280]
add rcx, 2
mov word [rsp + rcx + 0x6e], ax
test ax, ax
jne 0x18000eff0
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x1800b19d0], rax
test rax, rax
je 0x18000f043
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18000f04d
mov rcx, qword [0x1800b19d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1800b19d0], r12
mov ebp, 5
jmp 0x18000f150
call fcn.18000ea00
test eax, eax
jne 0x18000f05e
lea ebp, [rax + 6]
jmp 0x18000f150
lea rax, vtable.CAgentU64.0
mov rcx, r14
mov qword [0x1800ae180], r14
mov qword [0x1800b2490], rax
call fcn.1800179f0
test eax, eax
jne 0x18000f090
lea ebp, [rax + 5]
jmp 0x18000f150
xor eax, eax
lea rcx, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x18000f119
nop dword [rax]
lea rcx, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x18000f150
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x18000f0d0
mov rcx, qword [0x1800b19d8]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x18000f090
mov rcx, qword [0x1800b19d8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x18000f150
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, 4
mov rdi, qword [rsp + 0x4d0]
mov rsi, qword [rsp + 0x4c8]
mov rbx, qword [rsp + 0x4c0]
mov r13, qword [rsp + 0x4a8]
mov rax, qword [0x1800ae180]
test rax, rax
je 0x18000f1ab
mov dword [rax + 0x48], 1
cmp dword [0x1800b1b40], r12d
je 0x18000f1d3
lea r9, str.CAgentU64Thread::Exit_1
lea r8, str.AgentU64
lea rcx, [0x1800b1a88]
mov edx, 0x1f
call fcn.180008e60
cmp dword [0x1800b1b40], r12d
je 0x18000f1d3
lea r9, str.CAgentU64Thread::Kill_1
lea r8, str.AgentU64
lea rcx, [0x1800b1a88]
mov edx, 0x1f
call fcn.180008e60
mov rcx, r14
call fcn.1800177c0
mov r14, qword [rsp + 0x4a0]
cmp dword [0x1800b1b40], r12d
je 0x18000f20b
lea r9, str.CAgentU64Thread::Kill_2
lea r8, str.AgentU64
lea rcx, [0x1800b1a88]
mov edx, 0x1f
call fcn.180008e60
mov rcx, qword [0x1800b19d8]
test rcx, rcx
je 0x18000f224
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1800b19d8], r12
mov rcx, qword [0x1800b19d0]
test rcx, rcx
je 0x18000f23d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1800b19d0], r12
cmp dword [0x1800b1b40], 0
mov r12, qword [rsp + 0x4d8]
je 0x18000f271
lea r9, str.RunAgentU64_2__dbgerr___d_
lea r8, str.AgentU64
lea rcx, [0x1800b1a88]
mov edx, 0x1f
mov dword [rsp + 0x20], ebp
call fcn.180008e60
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1800190b0
add rsp, 0x4b0
pop rbp
ret