Function at 0x1400117b7
Capabilities:
Check mutex on windows
Create thread

Disassembly:
jmp 0x140021fc0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x480
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xb4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4a8]
mov rax, qword [0x14003a040]
xor rax, rbp
mov qword [rbp + 0x440], rax
lea rcx, [0x140041365]
call fcn.140011a5a
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x140033380]
lea rdx, str.CONIN_
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll_freopen_s]
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x14003338c]
lea rdx, str.CONOUT_
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll_freopen_s]
mov ecx, 1
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x14003338c]
lea rdx, str.CONOUT_
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll_freopen_s]
lea r8, str.jdhuisndcmutx2137
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbp + 0x28], rax
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400220c0
mov eax, 1
jmp 0x1400222d3
mov edx, 0x20
lea rcx, [rbp + 0x48]
call fcn.14001188e
lea rcx, [rbp + 0x264]
call fcn.1400118b1
mov qword [rbp + 0x438], rax
lea rax, str.ida.exe
mov qword [rbp + 0x3c0], rax
lea rax, str.ida64.exe
mov qword [rbp + 0x3c8], rax
lea rax, str.winword.exe
mov qword [rbp + 0x3d0], rax
lea rax, str.excel.exe
mov qword [rbp + 0x3d8], rax
lea rax, str.pptview.exe
mov qword [rbp + 0x3e0], rax
lea rax, str.outlook.exe
mov qword [rbp + 0x3e8], rax
lea rax, str.notepad.exe
mov qword [rbp + 0x3f0], rax
lea rax, str.node.exe
mov qword [rbp + 0x3f8], rax
lea rax, str.Creative_Cloud_Helper.exe
mov qword [rbp + 0x400], rax
lea rax, str.CoreSync.exe
mov qword [rbp + 0x408], rax
lea rax, str.CCXProcess.exe
mov qword [rbp + 0x410], rax
lea rax, str.CCLibrary.exe
mov qword [rbp + 0x418], rax
lea rax, str.AdobeIPCBroker.exe
mov qword [rbp + 0x420], rax
lea rax, str.Adobe_Desktop_Service.exe
mov qword [rbp + 0x428], rax
lea rax, [rbp + 0x430]
mov r8, rax
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x288]
call fcn.1400112d5
lea rcx, [rbp + 0x2b8]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x390]
lea rcx, [rbp + 0x2b8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rbp + 0x438]
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x48]
call fcn.140011208
lea rax, [rbp + 0x2e8]
mov qword [rbp + 0x328], rax
lea rdx, [rbp + 0x48]
mov rcx, qword [rbp + 0x328]
call fcn.14001141f
mov rcx, rax
call fcn.1400110aa
cmp eax, 1
jne 0x140022251
mov dword [rbp + 0x344], 1
lea rcx, [rbp + 0x48]
call fcn.140011537
mov eax, dword [rbp + 0x344]
jmp 0x1400222d3
lea rdx, [0x1400335d0]
lea rcx, [rbp + 0x88]
call fcn.140011361
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbp + 0x88]
lea r8, [fcn.140011820]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xc8], rax
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov dword [rbp + 0x364], 0
lea rcx, [rbp + 0x88]
call fcn.140011929
lea rcx, [rbp + 0x48]
call fcn.140011537
mov eax, dword [rbp + 0x364]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400330f0]
call fcn.1400118d4
mov rax, rdi
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.1400114ec
lea rsp, [rbp + 0x450]
pop rdi
pop rsi
pop rbp
ret