Function at 0x10000dc4c
Capabilities:
Check mutex on windows
Check os version
Get common file path
Set current directory

Disassembly:
mov edx, 4
lea rcx, [0x1000903c0]
lea r8d, [rdx + 1]
call fcn.10000c73c
cmp eax, r12d
jl 0x100001020
call qword [sym.imp.ole32.dll_CoResumeClassObjects]
call fcn.100007fd0
cmp al, r12b
jne 0x10001df79
lea rcx, [rsp + 0xa0]
call fcn.10000df88
lea rcx, [rsp + 0xa0]
call fcn.100009930
cmp rax, r12
je 0x10001e00a
cmp sil, r12b
jne 0x10001dfb5
mov rcx, qword [0x1000921e0]
mov edx, 0x6d
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
lea rcx, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rbx, rax
call qword [sym.imp.USER32.dll_GetMessageW]
jmp 0x100001084
cmp eax, r12d
setne dil
cmp edi, r12d
je 0x100016aa9
cmp edi, 0xffffffff
je 0x1000010e1
mov rcx, qword [rsp + 0xa8]
lea r8, [rsp + 0x68]
mov rdx, rbx
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
cmp eax, r12d
jne 0x1000010e1
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xa0]
call fcn.100001130
cmp eax, r12d
jne 0x1000010e1
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
mov edi, r12d
jmp 0x100001084
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x410
mov rax, qword [0x100090120]
xor rax, rsp
mov qword [rsp + 0x400], rax
xor r9d, r9d
mov rbx, r8
mov rbp, rcx
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea rdx, str._Home
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
xor r12d, r12d
lea rdx, str._Embedding
cmp eax, r12d
mov rcx, rbx
sete sil
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r12d
jne 0x10001dd43
mov edi, r12d
cmp qword [0x100090180], r12
jne 0x10000ddcd
cmp byte [0x1000900e9], r12b
jne 0x10001dd6f
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0xa0], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, r12d
je 0x10000dd13
cmp dword [rsp + 0xa4], 6
setb al
mov byte [0x1000900ea], al
cmp al, r12b
jne 0x10000dd94
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
cmp rax, r12
je 0x10001dd62
lea rdx, str.EventWrite
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x100090170], rax
cmp rax, r12
je 0x10001dd62
lea rdx, str.EventRegister
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x100090130], rax
cmp rax, r12
je 0x10001dd54
lea rdx, str.EventUnregister
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x100090178], rax
cmp rax, r12
je 0x10001dd54
mov al, byte [0x1000900ea]
jmp 0x10000dd94
mov byte [0x1000900e9], 1
jmp 0x10000dd9d
cmp al, r12b
lea rax, [0x10006ad10]
jne 0x10001dd7a
lea r9, [0x100090180]
lea r8, [0x1000919e0]
lea rdx, [0x10000df50]
mov rcx, rax
call qword [0x100090130]
jmp 0x10000ddcd
cmp dword [0x100091a04], r12d
je 0x10000de00
mov al, byte [0x100091a08]
cmp byte [0x1000900ea], r12b
jne 0x10001ddc7
cmp al, 4
jb 0x10001dde3
bt qword [0x1000919f0], 0x10
jb 0x10001ddf1
cmp sil, r12b
jne 0x10001de29
lea rcx, str._Home
xor edx, edx
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
mov ebx, 0x104
lea rcx, [rsp + 0x1f0]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, r12d
je 0x10000de44
cmp eax, ebx
jae 0x10000de44
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], 8
mov qword [rsp + 0x30], r12
lea rcx, [0x100066690]
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 2
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea r8, str.LocalHelpPaneRunningMutex
xor edx, edx
xor ecx, ecx
mov qword [0x100090138], r12
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x100090138], rax
cmp rax, r12
je 0x10000debf
mov edx, 0x32
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, r12d
jne 0x10001de66
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 8
mov dword [rsp + 0x64], 0x24
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea rbx, [0x100092140]
movdqu xmm5, xmmword [0x10006acd0]
movdqu xmmword [0x100090198], xmm5
cmp rbx, 0xffffffffffffffff
je 0x10000df15
mov qword [0x100090408], rbx
cmp qword [0x100092140], r12
je 0x10000df15
mov cl, 1
call qword [rbx + 0x40]
add rbx, 0x48
cmp qword [rbx], r12
jne 0x10000df07
mov rbx, qword [0x100090370]
mov rax, qword [0x100090378]
jmp 0x10000df25
cmp rbx, rax
jae section..text
mov rdx, qword [rbx]
cmp rdx, r12
je 0x10000df42
mov cl, 1
call qword [rdx + 0x40]
mov rax, qword [0x100090378]
add rbx, 8
jmp 0x10000df25
jmp 0x100016aab
lea rcx, [rsp + 0xa0]
call fcn.100016f50
mov rcx, qword [0x100090138]
cmp rcx, r12
jne 0x10001e01a
cmp dword [0x100091a04], r12d
je 0x100016afb
mov al, byte [0x100091a08]
cmp byte [0x1000900ea], r12b
jne 0x10001e039
cmp al, 4
jb 0x10001e055
bt qword [0x1000919f0], 0x10
jb 0x10001e063
cmp byte [0x1000900e9], r12b
je 0x100016b2f
mov rbx, qword [0x100090180]
cmp rbx, r12
je 0x100016b2f
cmp byte [0x1000900ea], r12b
jne 0x10001e09b
mov rcx, rbx
call qword [0x100090178]
jmp 0x100016b28
mov qword [0x100090180], r12
mov rbx, qword [0x100090408]
mov eax, r12d
cmp rbx, r12
je 0x100016b68
cmp qword [rbx], r12
je 0x100016b68
cmp eax, r12d
jne 0x100016ba2
mov ecx, dword [rbx + 0x28]
cmp ecx, r12d
je 0x10001e0b8
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
add rbx, 0x48
cmp qword [rbx], r12
jne 0x100016b43
cmp eax, r12d
jne 0x100016ba2
mov rbx, qword [0x100090370]
mov eax, r12d
jmp 0x100016b74
cmp rbx, qword [0x100090378]
jae 0x100016ba2
cmp eax, r12d
jne 0x100016ba2
mov rcx, qword [rbx]
cmp rcx, r12
je 0x100016b9c
mov ecx, dword [rcx + 0x28]
cmp ecx, r12d
je 0x10001e0c0
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
add rbx, 8
jmp 0x100016b74
mov rbx, qword [0x100090408]
cmp rbx, r12
je 0x100016bd1
jmp 0x100016bb0
cmp qword [rbx], r12
je 0x100016bd1
mov rcx, qword [rbx + 0x20]
cmp rcx, r12
jne 0x10001e0c8
xor ecx, ecx
mov qword [rbx + 0x20], r12
call qword [rbx + 0x40]
add rbx, 0x48
jmp 0x100016bb0
mov rbx, qword [0x100090370]
jmp 0x100016bda
cmp rbx, qword [0x100090378]
jae 0x100016bf6
mov rdx, qword [rbx]
cmp rdx, r12
je 0x100016bf0
xor ecx, ecx
call qword [rdx + 0x40]
add rbx, 8
jmp 0x100016bda
lea rcx, [0x1000903c0]
call fcn.100017664
call qword [sym.imp.ole32.dll_OleUninitialize]
mov eax, edi
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.100001100
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
cmp sil, r12b
jne 0x10000dcbe
or eax, 0xffffffff
jmp 0x100016c0a
lea rax, [0x100023f50]
mov qword [0x100090130], rax
mov al, 1
mov byte [0x1000900ea], al
jmp 0x10000dd94
mov al, byte [0x1000900ea]
jmp 0x10000dd9d
lea rdx, [0x1000919e0]
lea rcx, [rsp + 0x50]
mov r9d, 1
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rcx
lea rcx, [0x100023ec0]
mov r8, rax
mov qword [0x100090180], rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r12
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
nop
jmp 0x10000ddcd
cmp al, 4
jae 0x10001ddd4
cmp al, r12b
jne 0x10000de00
bt dword [0x100091a00], 0x10
jb 0x10001de09
jmp 0x10000de00
cmp al, r12b
je 0x10000ddf1
jmp 0x10000de00
mov rcx, qword [0x1000919f8]
mov rax, rcx
and eax, 0x10000
cmp rax, rcx
jne 0x10000de00
mov rcx, qword [0x100090180]
lea r8, [0x10006bfa8]
lea rdx, [0x10006c098]
call fcn.10002469c
nop
jmp 0x10000de00
mov ecx, 8
call fcn.100001710
cmp rax, r12
je 0x10001de44
lea rcx, [0x10006dff8]
mov qword [rax], rcx
jmp 0x10001de47
mov rax, r12
cmp rax, r12
je 0x10000de09
mov rcx, rax
call fcn.10003b750
cmp al, r12b
jne 0x10000de09
jmp 0x10001dd4c
cmp eax, 0x80
je 0x10000debf
cmp eax, 0x102
jne 0x10001de8c
mov rcx, qword [0x100090138]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x100090138], r12
xor edx, edx
lea rax, [rsp + 0x50]
lea r9, [0x10006be80]
lea rcx, [0x10006be90]
lea r8d, [rdx + 1]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, r12d
mov r9d, eax
jl 0x10001def9
mov rdi, qword [rsp + 0x50]
lea rcx, str.mshelp:__help__idhome
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
cmp rax, r12
jne 0x10001dee2
mov ecx, 0x8007000e
call fcn.1000242f0
int3
mov rax, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x10001df62
cmp dword [0x100091a04], r12d
je 0x10001df62
mov al, byte [0x100091a08]
cmp byte [0x1000900ea], r12b
je 0x10001df1a
cmp al, 2
jae 0x10001df48
cmp al, r12b
jmp 0x10001df46
cmp al, 2
jae 0x10001df23
cmp al, r12b
jne 0x10001df62
movabs rdx, 0x8000000000000000
test qword [0x1000919f0], rdx
je 0x10001df62
mov rcx, qword [0x1000919f8]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x10001df62
mov rcx, qword [0x100090180]
lea r8, [0x10006bfe8]
lea rdx, [0x10006c238]
call fcn.100005170
mov rcx, qword [rsp + 0x50]
cmp rcx, r12
je 0x10001df72
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
jmp 0x100016c0a
mov qword [rsp + 0x38], r12
mov r9d, 0xda
mov qword [rsp + 0x30], 0xfffd
lea r8d, [r9 - 0x73]
mov rdx, rbp
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0xdb
call qword [sym.imp.COMCTL32.dll_Ordinal_344]
or edi, 0xffffffff
jmp 0x100016ab8
lea rcx, str.mshelp:__help__idhome
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x50], rax
cmp rax, r12
jne 0x10001dfd7
mov ecx, 0x8007000e
call fcn.1000242f0
int3
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xa0]
xor edx, edx
call fcn.1000157c0
mov rcx, qword [rsp + 0xa8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x700
call qword [sym.imp.USER32.dll_PostMessageW]
nop
jmp 0x10000105a
lea rcx, [rsp + 0x50]
call fcn.1000247f0
nop
jmp 0x100016aab
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [0x100090138]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x100090138], r12
jmp 0x100016ac8
cmp al, 4
jae 0x10001e046
cmp al, r12b
jne 0x100016afb
bt dword [0x100091a00], 0x10
jb 0x10001e07b
jmp 0x100016afb
cmp al, r12b
je 0x100016aec
jmp 0x100016afb
mov rcx, qword [0x1000919f8]
mov rax, rcx
and eax, 0x10000
cmp rax, rcx
jne 0x100016afb
mov rcx, qword [0x100090180]
lea r8, [0x10006bfb8]
lea rdx, [0x10006c0c8]
call fcn.10002469c
nop
jmp 0x100016afb
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov dword [rbx + 0x20], r12d
mov byte [rbx + 0x28], r12b
mov qword [rbx + 8], r12
mov qword [rbx], r12
jmp 0x100016b28
mov eax, r12d
jmp 0x100016b5a
mov eax, r12d
jmp 0x100016b9c
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x100016bc2