Function at 0x14000a6f4
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
and qword [rbp + 0x20], 0
lea r8, [rbp + 0x20]
xor ebx, ebx
lea rcx, str.D:PAI_A_OICI_FA___WD_
xor r14d, r14d
xor r9d, r9d
mov qword [rbp + 0x28], r14
lea edi, [rbx + 1]
mov edx, edi
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
nop dword [rax + rax]
test eax, eax
jne 0x14000a76b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14000a751
mov edi, 0x80004005
jmp 0x14000a75f
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.14000b6d0
jmp 0x14000a8a1
mov rax, qword [rbp + 0x20]
lea r8, str.GlobalMicrosoft.Windows.Remediation.TelemetryUpdateHealthTools
and dword [rbp - 0x1c], ebx
lea rcx, [rbp - 0x20]
and dword [rbp - 0xc], ebx
xor edx, edx
and dword [rbp - 0x10], ebx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x20], 0x18
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x14000a7ac
mov rbx, rax
test rax, rax
jne 0x14000a7d9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14000a7c6
mov edi, 0x80004005
jmp 0x14000a886
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x14000a886
mov edx, 0x2710
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
test eax, eax
je 0x14000a818
cmp eax, 0x102
je 0x14000a811
cmp eax, 0xffffffff
jne 0x14000a7bc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14000a7c6
xor edi, edi
jmp 0x14000a88d
mov edi, 0x800705b4
jmp 0x14000a886
lea r9, [rbp + 0x28]
lea r8, [0x14003b300]
lea rdx, str.SoftwareMicrosoftRemediationLocalStateTelemetryUpdateHealthTools
call fcn.14000c098
mov r14, qword [rbp + 0x28]
test eax, eax
cmovs r14, rdi
call fcn.14000c264
mov edi, eax
test eax, eax
jns 0x14000a848
mov ecx, eax
jmp 0x14000a888
xor ecx, ecx
call fcn.14000b5f4
lea r9, [r14 + 1]
mov dword [rsp + 0x20], 8
lea r8, [0x14003b300]
lea rdx, str.SoftwareMicrosoftRemediationLocalStateTelemetryUpdateHealthTools
call fcn.14000d474
mov edi, eax
test eax, eax
jns 0x14000a87b
mov ecx, eax
call fcn.14000b6d0
mov ecx, edi
call fcn.14000b5f4
test edi, edi
jns 0x14000a88d
mov ecx, edi
call fcn.14000b6d0
test rbx, rbx
je 0x14000a8a1
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
nop dword [rax + rax]
test edi, edi
jns 0x14000a8b3
lea rdx, str.Failed_to_get_a_proper_GlobalEventCounter_for_telemetry__using_0
mov ecx, edi
call fcn.14000abd4
test rbx, rbx
je 0x14000a8c7
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14000a8dc
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
lea r11, [rsp + 0x50]
mov rax, r14
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret