Function at 0x140029d30
Capabilities:
Check mutex on windows
Create thread
Get session user name

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0x7d0]
sub rsp, 0x8d0
mov rax, qword [0x140064d98]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
mov r14, rcx
mov rdi, r8
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp eax, 0x400
jne 0x14002a3b6
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
cmp eax, 1
je 0x14002a3b6
xor edx, edx
lea rcx, [rbp + 0xd0]
mov r8d, 0x4d0
call fcn.14002d420
mov dword [rbp + 0x100], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140029df8
cmp qword [rbp + 0x118], 0
jne 0x14002a3b6
cmp qword [rbp + 0x120], 0
jne 0x14002a3b6
cmp qword [rbp + 0x128], 0
jne 0x14002a3b6
cmp qword [rbp + 0x130], 0
jne 0x14002a3b6
call fcn.14000d150
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140029e1c
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.140016670
cmp dword [0x14006e78c], 5
jl 0x14002a3b6
cmp dword [0x14006e81c], 1
jne 0x14002a3b6
mov qword [rsp + 0x8f8], rbx
mov qword [rsp + 0x8c8], rsi
mov qword [rsp + 0x8c0], r15
call fcn.14000d0b0
mov qword [0x14006e9d0], r14
call fcn.140025600
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140029e70
test rax, rax
je 0x140029e87
mov rcx, rdi
call fcn.14001bca0
xor r15d, r15d
cmp dword [0x140063168], 1
mov esi, r15d
jne 0x140029e9d
call fcn.14000d370
mov esi, eax
mov edx, 0x16
lea rcx, [0x14006bfd8]
call fcn.14000b480
mov rcx, rax
call fcn.140005d80
lea rcx, str.User32
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006bf08], rax
test rax, rax
je 0x140029ee0
call rax
cmp dword [0x14006e81c], 2
jne 0x14002a39e
mov ebx, 0xdc
lea rcx, [rbp - 0x10]
mov r8d, ebx
xor edx, edx
call fcn.14002d420
lea r8, [rbp - 0x10]
mov dword [rbp + 0x34], ebx
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplaySettingsW]
mov eax, dword [rbp + 0x9c]
mov ecx, dword [rbp + 0xa0]
mov dword [0x14006e6e0], eax
mov eax, dword [rbp + 0xa8]
mov dword [0x14006e6e8], eax
mov dword [0x14006e6e4], ecx
test esi, esi
jne 0x140029f64
mov eax, dword [0x1400630f4]
cmp ecx, 0x438
mov edx, 0xb
cmovg eax, edx
cmp ecx, 0x5a0
mov edx, 0xc
cmovg eax, edx
mov dword [0x1400630f4], eax
inc dword [0x14006e81c]
call fcn.14000e550
xor edx, edx
lea rcx, [rbp + 0x5a0]
mov r8d, 0x208
call fcn.14002d420
lea rdx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x103
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rsi, [0x14006ee68]
mov rdx, 0xffffffffffffffff
lea r9, [rbp + 0x5a0]
mov qword [rsp + 0x20], rsi
lea r8, [0x1400458a0]
lea rcx, [rbp + 0x5a0]
call fcn.140003760
lea r8, [rbp + 0x5a0]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14002a00e
test rbx, rbx
je 0x140029ffa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rsi
mov rcx, rdi
call fcn.140029c70
test rax, rax
je 0x14002a39e
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
xorps xmm0, xmm0
mov qword [rsp + 0x60], 0x50
xorps xmm1, xmm1
mov qword [0x14006e938], rax
lea rax, [0x140027170]
movdqa xmmword [rsp + 0x70], xmm0
mov edx, 0x7f00
mov qword [rsp + 0x68], rax
xor ecx, ecx
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x60], xmm1
call qword [sym.imp.USER32.dll_LoadCursorW]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x78], rax
lea rax, [rbp + 0x5a0]
mov qword [rbp - 0x60], rax
mov rax, qword [0x14006e938]
mov qword [rbp - 0x70], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
cmp dword [0x14006e81c], 3
movzx ebx, ax
je 0x14002a095
call fcn.14001d1c0
test bx, bx
je 0x14002a39e
mov rax, qword [0x14006e9d0]
lea rdx, [rbp + 0x5a0]
mov qword [rsp + 0x58], r15
mov r9d, 0x80000000
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov eax, dword [0x14006e6e4]
mov ecx, 0xa080080
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0x208
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x14006e728], rax
test rax, rax
je 0x14002a39e
cmp dword [0x14006e800], 2
jge 0x14002a22e
xor r9d, r9d
mov r8d, 0x3e8
mov rcx, rax
lea edx, [r9 + 0x64]
call qword [sym.imp.USER32.dll_SetTimer]
mov rcx, qword [0x14006e728]
xor r9d, r9d
mov edx, 0x46b
mov r8d, 0x1f4
call qword [sym.imp.USER32.dll_SetTimer]
mov rcx, qword [0x14006e728]
xor r9d, r9d
mov r8d, 0x927c0
lea edx, [r9 + 0x65]
call qword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [0x1400630f0]
imul ecx, dword [0x14006e6d0], 0x78
mov eax, dword [0x14006e85c]
mov r8d, dword [0x14006e6e0]
add eax, 9
mov r9d, dword [0x14006e710]
add edx, eax
imul edx, dword [0x14006e6d0]
mov eax, dword [0x14006e6e4]
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [0x14006e728]
sub r8d, edx
mov edx, 1
mov dword [0x14006e6ec], r8d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x14006e728]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x14006e728]
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [0x1400293d0]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [0x14001d5f0]
mov qword [0x14006e950], rax
xor edx, edx
mov dword [rsp + 0x20], r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14006e968], rax
xor r9d, r9d
lea rcx, [rbp - 0x48]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x14002a39e
nop dword [rax + rax]
lea rcx, [rbp - 0x48]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x48]
call qword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [0x14006e810], 1
jne 0x14002a2ac
cmp dword [0x14006e814], r15d
mov dword [0x14006e810], r15d
jne 0x14002a2ac
mov qword [rsp + 0x28], r15
lea r8, [0x14001d490]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov dword [0x14006e814], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14006e940], rax
cmp dword [0x14006e840], 1
jne 0x14002a2f4
cmp dword [0x14006e844], r15d
mov dword [0x14006e840], r15d
jne 0x14002a2f4
mov qword [rsp + 0x28], r15
lea r8, [0x14000bce0]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov dword [0x14006e844], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14006e958], rax
cmp dword [0x14006e818], 1
jne 0x14002a33c
cmp dword [0x14006e83c], r15d
mov dword [0x14006e818], r15d
jne 0x14002a33c
mov qword [rsp + 0x28], r15
lea r8, [0x14001d410]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov dword [0x14006e83c], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14006e948], rax
cmp dword [0x14006e848], 1
jne 0x14002a384
cmp dword [0x14006e84c], r15d
mov dword [0x14006e848], r15d
jne 0x14002a384
mov qword [rsp + 0x28], r15
lea r8, [0x14001c600]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov dword [0x14006e84c], 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14006e960], rax
xor r9d, r9d
lea rcx, [rbp - 0x48]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x14002a250
mov rsi, qword [rsp + 0x8c8]
mov rbx, qword [rsp + 0x8f8]
mov r15, qword [rsp + 0x8c0]
xor eax, eax
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.14002ba20
add rsp, 0x8d0
pop r14
pop rdi
pop rbp
ret