Function at 0x140003bf0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Get hostname
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x20c0]
mov eax, 0x21c0
call fcn.14002cfb0
sub rsp, rax
mov rax, qword [0x140058008]
xor rax, rsp
mov qword [rbp + 0x20a0], rax
call fcn.1400039f0
call fcn.140003ac0
call fcn.140008f60
test eax, eax
jne 0x140003c3a
call fcn.1400039f0
mov eax, 1
jmp 0x140004150
mov qword [rsp + 0x21d0], rbx
mov qword [rsp + 0x21d8], rsi
mov qword [rsp + 0x21e0], rdi
mov qword [rsp + 0x21b0], r15
call fcn.140008100
mov rbx, rax
call fcn.140003ac0
mov rcx, rbx
call fcn.140008140
xor edx, edx
mov ecx, 0x20004
mov rsi, rax
call fcn.1400088e0
mov edx, 3
mov ecx, 0x22002
call fcn.1400088e0
call fcn.1400039f0
call fcn.140003ac0
mov edx, 3
mov ecx, 0x22003
call fcn.1400088e0
call fcn.1400039f0
mov edx, dword [rsi + 8]
mov ecx, 0x21001
call fcn.1400088e0
call fcn.140003ac0
mov edx, dword [rsi + 0xc]
mov ecx, 0x21002
call fcn.1400088e0
call fcn.1400039f0
mov edx, dword [rsi + 0x10]
mov ecx, 0x21003
call fcn.1400088e0
call fcn.140003ac0
mov edx, 8
mov ecx, 0x21004
call fcn.1400088e0
call fcn.1400039f0
mov edx, 0x18
mov ecx, 0x21005
call fcn.1400088e0
call fcn.140003ac0
mov edx, 8
mov ecx, 0x21006
call fcn.1400088e0
xor r15d, r15d
lea r8, str.glText
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov edx, 0x1e0
mov ecx, 0x280
call fcn.140008360
mov rdi, rax
call fcn.1400039f0
lea r8, [0x1400534ac]
lea rdx, str.C:UsersPublicPicturesconfig.jpg
lea rcx, [rbp + 0xfa8]
call fcn.140014e24
test eax, eax
jne 0x140003d81
mov rcx, qword [rbp + 0xfa8]
test rcx, rcx
je 0x140003d81
call fcn.140014ac8
call fcn.140003ac0
call fcn.1400039f0
xor eax, eax
jmp 0x140004130
lea r8, [0x1400534ac]
lea rdx, str.C:Windowscomsetup.log
lea rcx, [rbp + 0xfa8]
call fcn.140014e24
test eax, eax
jne 0x140003db0
mov rcx, qword [rbp + 0xfa8]
test rcx, rcx
je 0x140003db0
call fcn.140014ac8
call fcn.140003ac0
xor edx, edx
mov dword [rbp + 0xfa8], 0x104
mov r8d, 0x208
lea rcx, [rbp + 0x1040]
call fcn.140011920
lea rdx, [rbp + 0xfa8]
lea rcx, [rbp + 0x1040]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r8, [rbp + 0x1040]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140003d7a
mov rcx, rdi
call fcn.140006900
call fcn.1400039f0
mov ecx, 1
call fcn.1400069a0
call fcn.1400049a0
test eax, eax
je 0x1400040b8
call fcn.1400039f0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, 0x12c
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, 0xfffffed4
sub ecx, ebx
movsxd rdx, ecx
add rax, rdx
mov r9, rax
shr r9, 0x20
mov r8d, r9d
xor r8d, eax
sub r8d, r9d
cmp r8d, 0x64
jg 0x1400040b8
mov qword [rsp + 0x21b8], r14
call fcn.140003ac0
xor edx, edx
mov ecx, 0x20004
call fcn.1400088e0
mov edx, 3
mov ecx, 0x22002
call fcn.1400088e0
mov edx, 3
mov ecx, 0x22003
call fcn.1400088e0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r14, rax
mov ebx, 0xa
nop dword [rax + rax]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x1f4
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Beep]
sub rbx, 1
jne 0x140003ec0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, r14d
mov r14, qword [rsp + 0x21b8]
cmp eax, 0x2710
jl 0x140004168
call fcn.1400039f0
lea rcx, [rsp + 0x50]
call fcn.140004430
mov rdx, rax
lea rcx, [rbp + 0x1040]
mov r8d, 0x1052
call fcn.140011ed0
mov edx, dword [rsi + 8]
mov ecx, 0x21001
call fcn.1400088e0
mov edx, dword [rsi + 0xc]
mov ecx, 0x21002
call fcn.1400088e0
call fcn.140003ac0
mov edx, dword [rsi + 0x10]
mov ecx, 0x21003
call fcn.1400088e0
call fcn.1400039f0
lea edx, [rbx + 0x65]
lea rcx, [rbp + 0x1156]
call fcn.140004e40
call fcn.140003ac0
lea edx, [rbx + 0x66]
lea rcx, [rbp + 0x125a]
call fcn.140004e40
call fcn.1400039f0
lea edx, [rbx + 0x67]
lea rcx, [rbp + 0x1462]
call fcn.140004e40
call fcn.140003ac0
lea edx, [rbx + 0x68]
lea rcx, [rbp + 0x135e]
call fcn.140004e40
call fcn.1400039f0
mov rcx, rdi
call fcn.140006900
lea ecx, [rbx + 1]
call fcn.1400069a0
xorps xmm0, xmm0
lea rcx, [rbp + 0x1156]
xor eax, eax
xor r9d, r9d
mov qword [rbp + 0x1030], rax
xor r8d, r8d
mov qword [rbp + 0xfc0], rax
xor edx, edx
lea rax, [rbp + 0xfb0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xfd0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
movups xmmword [rbp + 0xfd0], xmm0
movups xmmword [rbp + 0xfe0], xmm0
movups xmmword [rbp + 0xff0], xmm0
movups xmmword [rbp + 0x1000], xmm0
movups xmmword [rbp + 0x1010], xmm0
movups xmmword [rbp + 0x1020], xmm0
movups xmmword [rbp + 0xfb0], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140004058
mov rcx, qword [rbp + 0xfb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xfb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400039f0
mov edx, dword [rsi + 8]
mov ecx, 0x21001
call fcn.1400088e0
mov edx, dword [rsi + 0xc]
mov ecx, 0x21002
call fcn.1400088e0
mov edx, dword [rsi + 0x10]
mov ecx, 0x21003
call fcn.1400088e0
call fcn.140003ac0
lea r8, [0x1400534b0]
lea rdx, str.C:UsersPublicPicturesconfig.jpg
lea rcx, [rbp + 0xfa8]
call fcn.140014e24
test eax, eax
jne 0x1400040b8
mov rcx, qword [rbp + 0xfa8]
test rcx, rcx
je 0x1400040b8
call fcn.140014ac8
mov rcx, rdi
call fcn.140008bf0
test eax, eax
je 0x140004119
call fcn.140007250
call fcn.140003ac0
lea r8, [rbp + 0xfc8]
mov rcx, rdi
lea rdx, [rbp + 0xfcc]
call fcn.140008890
mov edx, 0x100
mov rcx, rdi
call fcn.1400071d0
test eax, eax
je 0x140004102
mov edx, 1
mov rcx, rdi
call fcn.1400088c0
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call fcn.140008bf0
test eax, eax
jne 0x1400040c4
call fcn.1400039f0
mov rcx, rdi
call fcn.1400087b0
call fcn.140009030
mov eax, 1
mov rdi, qword [rsp + 0x21e0]
mov rsi, qword [rsp + 0x21d8]
mov rbx, qword [rsp + 0x21d0]
mov r15, qword [rsp + 0x21b0]
mov rcx, qword [rbp + 0x20a0]
xor rcx, rsp
call fcn.140004fa0
add rsp, 0x21c0
pop rbp
ret
call fcn.1400039f0
call fcn.140004f40
call fcn.140003ac0
call fcn.140004ee0
call fcn.1400039f0
lea rcx, [rsp + 0x50]
call fcn.140004430
call fcn.140003ac0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]