Function at 0x1400084d0
Capabilities:
Check mutex on windows
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
and qword [rbp + 0x30], 0
lea r8, [rbp + 0x30]
xor ebx, ebx
lea rcx, str.D:PAI_A_OICI_FA___WD_
xor r14d, r14d
xor r9d, r9d
mov qword [rbp + 0x38], r14
lea edi, [rbx + 1]
mov edx, edi
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x140008530
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x14000851d
mov esi, 0x80004005
jmp 0x140008695
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x140008695
xor eax, eax
lea r8, str.GlobalMicrosoft.Windows.Remediation.TelemetryLauncher
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x10], rax
xor edx, edx
mov rax, qword [rbp + 0x30]
and dword [rbp - 0x10], ebx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x20], 0x18
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x140008509
mov edx, 0x2710
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test eax, eax
je 0x1400085bb
cmp eax, 0x102
je 0x1400085b1
cmp eax, 0xffffffff
jne 0x140008513
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x140008596
xor esi, esi
jmp 0x14000869c
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
je 0x14000869c
jmp 0x140008695
mov esi, 0x800705b4
jmp 0x140008695
lea r9, [rbp + 0x38]
call fcn.14000b590
mov r14, qword [rbp + 0x38]
test eax, eax
cmovs r14, rdi
call fcn.14000b6d8
mov esi, eax
test eax, eax
jns 0x1400085e0
mov ecx, eax
jmp 0x140008697
xor ecx, ecx
call fcn.140009390
and qword [rbp + 0x38], 0
lea rax, [r14 + 1]
lea r9, [rbp + 0x38]
mov qword [rbp + 0x40], rax
mov rcx, 0xffffffff80000002
mov r8d, 2
call fcn.14000c7e8
mov rdi, qword [rbp + 0x38]
mov esi, eax
test eax, eax
jns 0x140008618
mov ecx, eax
jmp 0x140008665
xor ecx, ecx
call fcn.140009390
lea rax, [rbp + 0x40]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x1400232d0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
jne 0x140008651
xor esi, esi
jmp 0x14000866a
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
je 0x14000866a
mov ecx, esi
call fcn.140009374
mov ecx, esi
call fcn.140009390
test rdi, rdi
je 0x14000867f
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
jns 0x14000868a
mov ecx, esi
call fcn.140009374
mov ecx, esi
call fcn.140009390
test esi, esi
jns 0x14000869c
mov ecx, esi
call fcn.140009374
test rbx, rbx
je 0x1400086aa
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test esi, esi
jns 0x1400086bc
lea rdx, str.Failed_to_get_a_proper_GlobalEventCounter_for_telemetry__using_0
mov ecx, esi
call fcn.140008a40
test rbx, rbx
je 0x1400086ca
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x1400086d9
call qword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
mov rax, r14
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret