Function at 0xb8cd16
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x258
mov eax, dword [0xd08954]
xor eax, esp
mov dword [esp + 0x254], eax
push esi
push edi
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push 1
push ecx
push 0xb2aa08
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0xbd3f66
xor eax, eax
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
cmp dword [esp + 0xc], 0
jne 0xb8cd7c
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
call fcn.00bbe77a
call fcn.00bbfd9d
mov dword [0xd08120], 0xd0a660
call fcn.00bbcbe8
mov eax, 0xd08200
mov ecx, 0xb2b640
push eax
push eax
call fcn.00b8c2c7
mov eax, 0xd082d0
mov ecx, 0xb2b650
push eax
push eax
call fcn.00b8c2c7
push ecx
push ecx
call fcn.00bb7f7a
movzx eax, word [0xb2b2fc]
push eax
push 0xb2b2fc
push 2
push dword [0xd08204]
push dword [0xd08200]
call dword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventSetInformation]
lea eax, [esp + 0x14]
mov edi, 0xb288f0
push eax
push ecx
xor esi, esi
mov edx, edi
push 0xb2ac9c
mov ecx, reloc.SHCORE.dll_Ordinal_1
mov dword [esp + 0x20], esi
call fcn.00b819c7
cmp dword [esp + 0x14], esi
je 0xbd3fae
test dword [0xd0a5c0], 0x2000
je 0xb8ce26
mov edx, 0xb2b590
mov ecx, 0xd08200
call fcn.00b8e628
push 0xb28cc0
call dword [sym.imp.api_ms_win_shcore_sysinfo_l1_1_0.dll_SetCurrentProcessExplicitAppUserModelID]
push 0x4001
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetErrorMode]
push 1
call dword [sym.imp.msvcrt.dll__set_error_mode]
pop ecx
push 0x80
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetPriorityClass]
push esi
call dword [sym.imp.api_ms_win_rtcore_ntuser_wmpointer_l1_1_0.dll_EnableMouseInPointer]
mov eax, dword [ebp + 8]
xor edx, edx
xor ecx, ecx
mov dword [0xd0a648], eax
call fcn.00b847a7
xor eax, eax
push eax
push 0xd0a644
push eax
push 0x2000000
push eax
push eax
push eax
push edi
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
xor edi, edi
call fcn.00b8b7fb
mov esi, eax
cmp esi, 1
jne 0xb8cec8
push 0xb2ad80
xor eax, eax
push eax
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov edi, eax
test edi, edi
je 0xb8ceb8
push 0xffffffffffffffff
push edi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
call fcn.00b8c2ee
test eax, eax
jne 0xbd3fc6
push 3
pop esi
cmp esi, 5
je 0xb8ced8
push 0xb2af78
call dword [sym.imp.NInput.dll_Ordinal_2506]
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_899]
cmp esi, 3
jne 0xbd3fce
xor esi, esi
mov dword [esp + 0xc], esi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathGetArgsW]
test eax, eax
je 0xb8cf08
cmp word [eax], si
jne 0xbd41bd
lea ecx, [esp + 0xc]
call fcn.00bbdcfe
mov esi, dword [esp + 0xc]
test eax, eax
js 0xb8cf21
test esi, esi
jne 0xbd41e1
mov eax, dword [0xd0a5c0]
test eax, 0x2000000
je 0xb8cf41
mov edx, 0xb2b570
mov ecx, 0xd08200
call fcn.00b8e628
mov eax, dword [0xd0a5c0]
test eax, 0x400
jne 0xbd421a
push ecx
push 0xb2b7e0
lea ecx, [esp + 0xc8]
call fcn.00b9362c
lea ecx, [esp + 0xc0]
mov dword [esp + 0xc0], 0xb15388
call fcn.00b938fc
push 1
call dword [sym.imp.SHELL32.dll_Ordinal_188]
xor eax, eax
push eax
push 3
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetProcessShutdownParameters]
call fcn.00bbfd0c
xor eax, eax
push eax
push 0x12
push 0x12
push eax
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_PeekMessageW]
call fcn.00bbe0f6
call fcn.00b91042
mov dword [esp + 0x38], eax
xor eax, eax
push eax
call dword [sym.imp.ole32.dll_OleInitialize]
lea ecx, [esp + 0xa4]
mov dword [esp + 0x34], eax
mov dword [esp + 0xa4], 1
mov dword [esp + 0xa8], 2
mov dword [esp + 0xac], 4
mov dword [esp + 0xb0], 0x258
call fcn.00bbe65d
test esi, esi
jne 0xbd422e
push 1
push 1
call dword [sym.imp.api_ms_win_storage_exports_internal_l1_1_0.dll_SetThreadFlags]
call fcn.00b8c2ee
test eax, eax
jne 0xbd4238
mov byte [esp + 0x12], al
mov byte [esp + 0x13], al
call fcn.00b9231a
test al, al
jne 0xbd4248
xor eax, eax
push 1
push eax
call dword [sym.imp.UxTheme.dll_GetImmersiveUserColorSetPreference]
call fcn.00bbfc5e
mov byte [esp + 0x1b], al
call fcn.00bbf862
call fcn.00bbefb3
call fcn.00bab81e
call fcn.00bb8640
push 1
call fcn.00bbfa56
xor eax, eax
push eax
push eax
push eax
push 0xbb8580
push eax
push 0x20
push 0x20
call dword [sym.imp.api_ms_win_rtcore_ntuser_winevent_l1_1_0.dll_SetWinEventHook]
mov dword [esp + 0x3c], eax
xor eax, eax
mov dword [esp + 0xc], eax
cmp byte [esp + 0x12], al
jne 0xb8d0b9
lea ecx, [esp + 0xc]
call fcn.00b82546
lea eax, [esp + 0xc]
push eax
push 0xb2b844
push 3
xor eax, eax
push eax
push 0xb28b90
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
test eax, eax
js 0xb8d0b9
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x10]
mov ecx, esi
call dword [0xd0cffc]
call esi
call fcn.00bbd275
call fcn.00bbf4c0
call fcn.00bbd7d2
xor ecx, ecx
call fcn.00bbef58
xor eax, eax
mov dword [esp + 0x24], 0xb153b0
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThreadRef]
push dword [esp + 0x2c]
call dword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHSetThreadRef]
push dword [esp + 0x2c]
mov dword [esp + 0x28], 0xb153b0
call dword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SetProcessReference]
xor eax, eax
mov esi, eax
mov dword [esp + 0x1c], esi
cmp byte [esp + 0x12], al
jne 0xb8d132
lea ecx, [esp + 0xc0]
call fcn.00b938ad
call fcn.00b8c31c
mov esi, eax
mov dword [esp + 0x1c], eax
test dword [0xd0a5c0], reloc.api_ms_win_shcore_stream_l1_1_0.dll_IStream_Write
jne 0xbd4264
lea ecx, [esp + 0x180]
call fcn.00bbb864
lea ecx, [esp + 0xc0]
call fcn.00b9385e
lea ecx, [esp + 0x180]
call fcn.00bbb8f8
test dword [0xd0a5c0], 0x200000
jne 0xbd4278
cmp byte [esp + 0x1b], 0
jne 0xb8d187
push 1
push 1
call dword [sym.imp.UxTheme.dll_GetImmersiveUserColorSetPreference]
test edi, edi
je 0xb8d199
push edi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test esi, esi
je 0xbd42e8
xor eax, eax
push eax
push 1
push 0x590
push dword [0xd0ac3c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_PostMessageW]
call fcn.00b84bd5
cmp byte [esp + 0x13], 0
jne 0xb8d1d3
push reloc.OLEAUT32.dll_VariantClear
push 0xb2b108
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
lea eax, [esp + 0x14]
xor ecx, ecx
push eax
push 0xb2b430
push 1
push ecx
push 0xb2b750
mov dword [esp + 0x28], ecx
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
test eax, eax
js 0xb8d212
mov eax, dword [esp + 0x14]
push 0xb2b760
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [esp + 0x1c]
mov edi, 0x2000
test dword [0xd0a5c0], edi
je 0xb8d22e
mov edx, 0xb2b6c0
mov ecx, 0xd08200
call fcn.00b8e628
xor eax, eax
lea ecx, [esp + 0xc0]
push eax
call fcn.00b9368d
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_201]
test dword [0xd0a5c0], edi
jne 0xbd428c
jmp 0xbd429b
lea eax, [esp + 0x14]
xor edx, edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
push 0xb3e4ec
call fcn.00b819c7
lea eax, [esp + 0xc]
xor edx, edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
push 0xb3e520
call fcn.00b819c7
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [esp + 0x14], 0
je 0xb8cd5e
xor eax, eax
jmp 0xb8cd61
call fcn.00cdb508
push 1
push 0xb2ac9c
mov edx, edi
call fcn.00c25f06
jmp 0xb8ce0b
push 5
pop esi
jmp 0xb8ced8
test edi, edi
je 0xbd3fe0
push edi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push 0x20
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetPriorityClass]
cmp esi, 5
jne 0xbd403d
push 0x38
lea eax, [esp + 0x48]
mov dword [esp + 0x44], 0x3c
push 0
push eax
call fcn.00bc259b
add esp, 0xc
mov dword [esp + 0x5c], 1
lea eax, [esp + 0x40]
mov dword [esp + 0x44], 0x200010c
mov dword [esp + 0x4c], 0xb2f42c
mov dword [esp + 0x50], 0xb2f448
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0xbd4438
call fcn.00b91042
mov dword [esp + 0x1c], eax
test eax, eax
js 0xbd4438
push 7
pop ecx
xor eax, eax
lea edi, [esp + 0xa4]
rep stosd dword es:[edi], eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathGetArgsW]
lea edx, [esp + 0xa4]
mov ecx, eax
call fcn.00c248fb
test eax, eax
je 0xbd41a7
push 4
pop edi
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], 0x258
call fcn.00bbe65d
cmp esi, edi
jne 0xbd4109
lea eax, [esp + 0xc]
push eax
push 0xb2b430
push 1
push 0
push 0xb2b750
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
test eax, eax
js 0xbd419a
mov eax, dword [esp + 0xc]
lea edx, [esp + 0xb0]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
js 0xbd4100
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x10]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [esp + 0xc]
jmp 0xbd418a
lea eax, [esp + 0x14]
xor esi, esi
push eax
push 0xb3e590
push 1
push esi
push 0xb473a8
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
test eax, eax
js 0xbd419a
push 0x40
lea eax, [esp + 0x48]
mov dword [esp + 0x44], 0x44
push esi
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
test byte [esp + 0x6c], 1
je 0xbd4158
movzx ecx, word [esp + 0x70]
jmp 0xbd415b
push 0xa
pop ecx
mov eax, dword [esp + 0x14]
push ecx
xor ecx, ecx
push ecx
mov esi, dword [eax]
push ecx
push dword [esp + 0xb8]
push dword [esp + 0xb4]
mov ecx, dword [esi + 0xc]
push 0xb47318
push eax
call dword [0xd0cffc]
call dword [esi + 0xc]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
push dword [esp + 0xa4]
call dword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_ILFree]
cmp dword [esp + 0x1c], 0
jne 0xbd4438
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
jmp 0xbd4438
push 1
or ecx, 0xffffffff
push ecx
push 0xb3e238
push ecx
push eax
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
cmp eax, 2
jne 0xb8cf08
xor esi, esi
inc esi
jmp 0xb8cf21
call fcn.00c25326
test al, al
je 0xb8cf21
call fcn.00cdcd65
test eax, eax
jne 0xb8cf21
call fcn.00c2574a
test eax, eax
js 0xb8cf21
push 2
jmp 0xbd4214
call dword [sym.imp.DUI70.dll_SkipDLLUnloadInitChecks]
push 1
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
mov edx, 0xb3d598
mov ecx, 0xd08200
call fcn.00b8e628
jmp 0xb8cf4c
call fcn.00c2518f
jmp 0xb8cffe
xor eax, eax
mov byte [esp + 0x12], 1
mov byte [esp + 0x13], al
jmp 0xb8d02c
push reloc.OLEAUT32.dll_VariantClear
push 0xb2b108
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
test eax, eax
setns byte [esp + 0x13]
jmp 0xb8d02a
mov edx, 0xb3d528
mov ecx, 0xd08200
call fcn.00b8e628
jmp 0xb8d142
mov edx, 0xb3dc00
mov ecx, 0xd08200
call fcn.00b8e628
jmp 0xb8d176
mov edx, 0xb3d628
mov ecx, 0xd08200
call fcn.00b8e628
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_206]
mov eax, dword [esp + 0xc]
test eax, eax
je 0xbd42ce
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x28]
mov ecx, esi
call dword [0xd0cffc]
call esi
lea ecx, [esp + 0x24]
call fcn.00c25f65
lea ecx, [esp + 0x14]
call fcn.00bbfcd3
xor ecx, ecx
inc ecx
call fcn.00bbef58
lea ecx, [esp + 0x180]
call fcn.00cacbb0
cmp dword [esp + 0x34], 0
jl 0xbd4301
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [esp + 0x38], 0
jne 0xbd430e
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
xor eax, eax
push eax
call dword [sym.imp.SHELL32.dll_Ordinal_188]
push dword [esp + 0x3c]
call dword [sym.imp.api_ms_win_rtcore_ntuser_winevent_l1_1_0.dll_UnhookWinEvent]
lea ecx, [esp + 0x180]
call fcn.00cacb0d
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 0xb153b0
call fcn.00c25f65
lea ecx, [esp + 0xc]
call fcn.00b82546
lea ecx, [esp + 0xc0]
mov dword [esp + 0xc0], 0xb15388
call fcn.00b9374e
mov eax, dword [esp + 0x178]
mov edi, 0xc24f10
test eax, eax
je 0xbd43d5
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
jne 0xbd43cc
mov esi, dword [esp + 0x178]
test esi, esi
je 0xbd43cc
lea ecx, [esi + 0x94]
call fcn.00b845a1
lea ecx, [esi + 0x2c]
call fcn.00b8458c
cmp dword [esi + 4], 1
jne 0xbd43b4
push edi
mov dword [esi + 4], 2
call fcn.00b9377b
lea edx, [esi + 0xc]
mov ecx, dword [eax + 4]
call fcn.00c24f15
push esi
xor eax, eax
mov dword [esi + 4], 3
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esp + 0x178], eax
lea ecx, [esp + 0x16c]
call fcn.00b845a1
lea ecx, [esp + 0x104]
call fcn.00b8458c
cmp dword [esp + 0xdc], 1
jne 0xbd4417
push edi
mov dword [esp + 0xe0], 2
call fcn.00b9377b
lea edx, [esp + 0xe4]
mov ecx, dword [eax + 4]
call fcn.00c24f15
cmp dword [esp + 0xd0], 0
mov dword [esp + 0xdc], 3
je 0xbd4438
lea ecx, [esp + 0xc4]
call fcn.00b54a44
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathGetArgsW]
mov ecx, eax
call fcn.00c2486f
call fcn.00c29155
call fcn.00bbf20f
mov ecx, 0xd08200
call fcn.00c2662d
mov ecx, 0xd082d0
call fcn.00c2662d
call fcn.00ca9c20
call fcn.00c2664f
cmp dword [0xd08e18], 0
je 0xbd4495
push 0xb3e55c
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test eax, eax
je 0xbd4212
jmp 0xbd420c
mov ecx, dword [esp + 0x25c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
mov dword [0xd0ba14], 0xb893b0
inc eax
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 0x10