Function at 0x14013cd00
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Get hostname
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x31c0]
mov eax, 0x32c0
call fcn.140175890
sub rsp, rax
mov rax, qword [0x1402ba010]
xor rax, rsp
mov qword [rbp + 0x31b0], rax
mov eax, dword [str.Hello]
lea r10, [0x1404629b0]
movups xmm0, xmmword [str.0123456789abcdef]
movzx r8d, byte [0x1402994f8]
xor edx, edx
movups xmm1, xmmword [str.1234567890abcdef]
movzx r9d, byte [0x140299510]
xor ecx, ecx
mov dword [rbp + 0xfa8], eax
movzx eax, word [0x1402994e4]
mov word [rbp + 0xfac], ax
lea rax, str.ab2adfc1e6cd689c3eb6c6135e49791c68956c2e41537b8b11ba
mov qword [rbp + 0xfb0], rax
lea rax, str.bb7fe5e0e2c9688a3eabda12404f692f4a8e470943487f9d0c83c75177586a2c43887e3271714d9375
mov qword [rbp + 0xfb8], rax
lea rax, str.db26b3c0e7c963c1079ed6
mov qword [rbp + 0xfc0], rax
lea rax, str.db26b3e7f1867f9707
mov qword [rbp + 0xfc8], rax
lea rax, str.ab2adfc1e6cd689c3eb6c6135e49791c7c937834584e7f9c3e85dc1f54497d6e468a7c
mov qword [rbp + 0xfd0], rax
movups xmmword [rbp + 0x2040], xmm0
mov byte [rbp + 0x2050], r8b
movups xmmword [rbp + 0x2058], xmm1
mov byte [rbp + 0x2068], r9b
nop dword [rax + rax]
movzx eax, byte [rbp + rcx + 0xfa8]
add edx, 6
mov byte [rcx + r10], al
movzx eax, byte [rbp + rcx + 0xfa9]
mov byte [rcx + r10 + 1], al
movzx eax, byte [rbp + rcx + 0xfaa]
mov byte [rcx + r10 + 2], al
movzx eax, byte [rbp + rcx + 0xfab]
mov byte [rcx + r10 + 3], al
movzx eax, byte [rbp + rcx + 0xfac]
mov byte [rcx + r10 + 4], al
movzx eax, byte [rbp + rcx + 0xfad]
mov byte [rcx + r10 + 5], al
lea rcx, [rcx + 6]
cmp edx, 6
jb 0x14013cde0
xor ecx, ecx
movaps xmmword [0x1404732c0], xmm0
mov byte [0x1404732d0], r8b
nop dword [rax]
inc ecx
cmp ecx, 0x11
jb 0x14013ce50
movsxd rdx, ecx
cmp rdx, 0x11
jae 0x14013ce7b
movzx eax, byte [rbp + rdx + 0x2040]
inc ecx
mov byte [rdx + r10 + 0x10910], al
lea rdx, [rdx + 1]
cmp ecx, 0x11
jb 0x14013ce60
xor ecx, ecx
mov byte [0x1404732e1], r9b
movups xmmword [0x1404732d1], xmm1
nop dword [rax + rax]
inc ecx
cmp ecx, 0x11
jb 0x14013ce90
movsxd rdx, ecx
cmp rdx, 0x11
jae 0x14013cebb
movzx eax, byte [rbp + rdx + 0x2058]
inc ecx
mov byte [rdx + r10 + 0x10921], al
lea rdx, [rdx + 1]
cmp ecx, 0x11
jb 0x14013cea0
xor ebx, ebx
lea rdi, [rbp + 0xfb0]
lea r14, [0x140462ab0]
nop dword [rax + rax]
mov r8, qword [rdi]
mov edx, 0x104
movsxd rax, ebx
imul rcx, rax, 0x104
add rcx, r14
call fcn.140156ed8
inc ebx
lea rdi, [rdi + 8]
cmp ebx, 5
jb 0x14013ced0
mov rdi, 0xffffffffffffffff
lea rcx, [0x140462bb4]
mov r9, rdi
inc r9
cmp byte [rcx + r9], 0
jne 0x14013cf06
shr r9, 1
lea r8, [rbp + 0x2150]
call fcn.14013dd90
lea rcx, [0x140462ec0]
mov r9, rdi
nop dword [rax]
inc r9
cmp byte [rcx + r9], 0
jne 0x14013cf30
shr r9, 1
lea r8, [rbp + 0x2070]
call fcn.14013dd90
call fcn.14013ab00
call fcn.14013bb10
call fcn.14013ab00
lea r8, [0x14029989c]
lea rdx, [rbp + 0x2070]
lea rcx, [rbp + 0xfa8]
call fcn.140156ff4
test eax, eax
jne 0x14013cfa4
mov rcx, qword [rbp + 0xfa8]
test rcx, rcx
je 0x14013cfa4
call fcn.140156c78
call fcn.14013bb10
call fcn.14013ab00
lea rcx, [0x140299634]
call fcn.14013a3c0
xor eax, eax
jmp 0x14013d3d8
lea r8, [0x14029989c]
lea rdx, str.error.log
lea rcx, [rbp + 0xfa8]
call fcn.140156ff4
test eax, eax
jne 0x14013cfd3
mov rcx, qword [rbp + 0xfa8]
test rcx, rcx
je 0x14013cfd3
call fcn.140156c78
call fcn.14013bb10
xor edx, edx
mov dword [rbp + 0xfa8], 0x104
mov r8d, 0x208
lea rcx, [rbp + 0x2150]
call fcn.14014f360
lea rdx, [rbp + 0xfa8]
lea rcx, [rbp + 0x2150]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea r8, [rbp + 0x2150]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14013cf9d
mov qword [rsp + 0x32d0], rsi
call fcn.14013ab00
lea rcx, [0x140462cb8]
mov r9, rdi
inc r9
cmp byte [rcx + r9], 0
jne 0x14013d043
shr r9, 1
lea r8, [rbp + 0x2058]
call fcn.14013dd90
lea rcx, [0x140462dbc]
mov r9, rdi
inc r9
cmp byte [rcx + r9], 0
jne 0x14013d066
shr r9, 1
lea r8, [rbp + 0x2040]
call fcn.14013dd90
nop
call fcn.14013bb10
call fcn.14013ab00
lea rcx, [rbp + 0x2058]
call fcn.14013dad0
lea rcx, [rbp + 0x2040]
mov ebx, eax
call fcn.14013dad0
mov esi, eax
call fcn.14013bb10
call fcn.14013ab00
test ebx, ebx
je 0x14013d0e5
xor ecx, ecx
lea r8, [0x1402996a0]
mov r9d, 0x1030
test esi, esi
je 0x14013d0d6
lea rdx, [0x1402996b0]
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14013d080
lea rdx, [0x140299770]
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14013d080
test esi, esi
je 0x14013d10a
mov r9d, 0x1030
lea r8, [0x1402996a0]
lea rdx, [0x140299810]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14013d080
call fcn.14013bb10
call fcn.14013ab00
call fcn.14013ab00
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, 0x12c
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, 0xfffffed4
sub ecx, ebx
movsxd rcx, ecx
add rax, rcx
mov rdx, rax
shr rdx, 0x20
mov ecx, edx
xor ecx, eax
sub ecx, edx
cmp ecx, 0x64
jg 0x14013d3cb
call fcn.14013bb10
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rsi, rax
mov ebx, 0xa
nop dword [rax]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x1f4
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Beep]
sub rbx, 1
jne 0x14013d170
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, esi
cmp eax, 0x2710
jl 0x14013d400
call fcn.14013ab00
nop dword [rax]
inc rdi
cmp byte [r14 + rdi], 0
jne 0x14013d1b0
shr rdi, 1
lea r8, [rbp + 0x20e0]
mov r9d, edi
mov rcx, r14
call fcn.14013dd90
lea rdx, [rbp + 0x20e0]
lea rcx, [rsp + 0x50]
call fcn.14013d710
mov rdx, rax
lea rcx, [rbp + 0x2150]
mov r8d, 0x1052
call fcn.14014f740
mov r8d, 0x1052
lea rdx, [rbp + 0x2150]
lea rcx, [rbp + 0xfe0]
call fcn.14014f740
call fcn.14013bb10
call fcn.14013ab00
call fcn.14013bb10
mov r8d, 0x83670
lea rdx, [0x140315a90]
lea rcx, [rbp + 0x10f6]
call fcn.14013dbc0
test eax, eax
je 0x14013d23f
call fcn.14013ab00
call fcn.14013bb10
call fcn.14013bb10
mov r8d, 0x210c0
lea rdx, [0x1403a6d00]
lea rcx, [rbp + 0x11fa]
call fcn.14013dbc0
test eax, eax
je 0x14013d26b
call fcn.14013ab00
call fcn.14013ab00
call fcn.14013bb10
mov r8d, 0x59aa5
lea rdx, [0x1402bbbe0]
lea rcx, [rbp + 0x1402]
call fcn.14013dbc0
test eax, eax
je 0x14013d297
call fcn.14013ab00
call fcn.14013bb10
call fcn.14013bb10
mov r8d, 0xd400
lea rdx, [0x140399500]
lea rcx, [rbp + 0x12fe]
call fcn.14013dbc0
test eax, eax
je 0x14013d2c3
call fcn.14013ab00
call fcn.14013ab00
call fcn.14013ab00
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x2150], xmm0
mov qword [rbp + 0x21b0], rax
movups xmmword [rbp + 0x2160], xmm0
mov qword [rbp + 0xfc0], rax
movups xmmword [rbp + 0x2170], xmm0
movups xmmword [rbp + 0x2180], xmm0
movups xmmword [rbp + 0x2190], xmm0
movups xmmword [rbp + 0x21a0], xmm0
movups xmmword [rbp + 0xfb0], xmm0
call fcn.14013bb10
call fcn.14013ab00
lea rax, [rbp + 0xfb0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10f6]
lea rax, [rbp + 0x2150]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14013d38d
call fcn.14013bb10
mov rcx, qword [rbp + 0xfb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xfb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14013ab00
call fcn.14013ab00
call fcn.14013bb10
lea r8, [0x1402998a0]
lea rdx, [rbp + 0x2070]
lea rcx, [rbp + 0xfa8]
call fcn.140156ff4
test eax, eax
jne 0x14013d3cb
mov rcx, qword [rbp + 0xfa8]
test rcx, rcx
je 0x14013d3cb
call fcn.140156c78
call fcn.14013ab00
mov rsi, qword [rsp + 0x32d0]
mov rcx, qword [rbp + 0x31b0]
xor rcx, rsp
call fcn.14013f360
lea r11, [rsp + 0x32c0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14013beb0
call fcn.14013beb0
call fcn.14013bec0
call fcn.14013dd40
call fcn.14013bec0
call fcn.14013beb0
call fcn.14013bec0
call fcn.14013dce0
call fcn.14013beb0
call fcn.14013bec0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]