Function at 0x14001ef50
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
sub rsp, 0xa8
lea r8, str.D7FB3612_3E61_4B58_972C_83FF8C77E8EE
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [0x140072a20], rax
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], 0
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001efb4
jmp 0x14001f375
mov r8d, 0x104
mov rdx, qword [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14001efd5
jmp 0x14001f375
lea rdx, [0x14003e99c]
mov rcx, qword [rsp + 0x20]
call fcn.140023770
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x14001eff8
jmp 0x14001f421
mov rax, qword [rsp + 0x60]
add rax, 2
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x38], 0
lea r8, str.654BFB77_6041_4A1F_8FA9_2EDC607ECF00
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14001f03a
jmp 0x14001f375
call fcn.140002350
test eax, eax
jne 0x14001f04d
jmp 0x14001f375
call fcn.140004b90
test eax, eax
jne 0x14001f060
jmp 0x14001f375
cmp dword [0x140066360], 0
jne 0x14001f07c
call fcn.140019240
test eax, eax
jne 0x14001f07c
jmp 0x14001f375
call fcn.140005d70
test eax, eax
jne 0x14001f08f
jmp 0x14001f375
call fcn.140023b70
test eax, eax
jne 0x14001f0a2
jmp 0x14001f375
call fcn.140009c50
test eax, eax
jne 0x14001f0b5
jmp 0x14001f375
call fcn.140004ff0
test eax, eax
jne 0x14001f0c8
jmp 0x14001f375
mov dword [rsp + 0x28], 0
cmp dword [0x140066360], 0
jne 0x14001f126
mov qword [rsp + 0x68], 0
call fcn.14000ccc0
cmp eax, 1
jne 0x14001f11a
lea r8, str.2523EFAC_9FBD_4039_9CCC_06B89B988E80
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x14001f112
jmp 0x14001f421
mov dword [rsp + 0x28], 1
lea rcx, str.2523EFAC_9FBD_4039_9CCC_06B89B988E80
call fcn.14001fbe0
mov dword [rsp + 0x30], 0
cmp dword [0x140066360], 0
jne 0x14001f17b
call fcn.14000cde0
cmp eax, 1
jne 0x14001f16f
lea r8, str.E1594BED_5477_472E_8061_D98657553F44
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x14001f167
jmp 0x14001f421
mov dword [rsp + 0x30], 1
lea rcx, str.E1594BED_5477_472E_8061_D98657553F44
call fcn.14001fbe0
mov dword [rsp + 0x58], 0
cmp dword [0x140066360], 0
jne 0x14001f1d0
call fcn.14000cf00
cmp eax, 1
jne 0x14001f1c4
lea r8, str.D01813F0_4B7D_4297_BFB3_CFFAD4466EF1
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x14001f1bc
jmp 0x14001f421
mov dword [rsp + 0x58], 1
lea rcx, str.D01813F0_4B7D_4297_BFB3_CFFAD4466EF1
call fcn.14001fbe0
lea rcx, str.D01813F0_4B7D_4297_BFB3_CFFAD4466EF1
call fcn.14001fbe0
cmp dword [0x140066360], 0
jne 0x14001f2ef
cmp dword [0x140066270], 1
jne 0x14001f2ef
cmp dword [0x1400659b8], 0
jne 0x14001f2ef
cmp dword [rsp + 0x28], 0
jne 0x14001f218
cmp dword [rsp + 0x30], 0
jne 0x14001f218
cmp dword [rsp + 0x58], 0
je 0x14001f253
mov dword [rsp + 0x80], 0
cmp dword [rsp + 0x80], 5
jge 0x14001f253
call fcn.1400155c0
test eax, eax
jne 0x14001f253
mov ecx, 0x3e8
call qword [0x140071ea8]
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
jmp 0x14001f223
cmp dword [0x140066274], 1
jne 0x14001f2ef
mov qword [rsp + 0x88], 0
call fcn.14000a4f0
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
je 0x14001f2ef
mov dword [rsp + 0x90], 0
mov rcx, qword [rsp + 0x88]
call qword [0x140071eb8]
cmp eax, 0xffffffff
je 0x14001f2e1
mov rcx, qword [rsp + 0x88]
call qword [0x140071e90]
test eax, eax
jne 0x14001f2dd
mov eax, dword [rsp + 0x90]
inc eax
mov dword [rsp + 0x90], eax
cmp dword [rsp + 0x90], 0xa
jl 0x14001f2d0
jmp 0x14001f2e1
mov ecx, 0x3e8
call qword [0x140071ea8]
jmp 0x14001f2df
jmp 0x14001f2e1
jmp 0x14001f28f
mov rcx, qword [rsp + 0x88]
call qword [0x140071dc0]
cmp dword [0x140066270], 1
jne 0x14001f30e
mov edx, 0xffffffff
mov rcx, qword [0x140070048]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x14001f375
cmp dword [0x1400659b8], 0
je 0x14001f324
mov dword [rsp + 0x94], 1
jmp 0x14001f32f
mov dword [rsp + 0x94], 2
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x2c], eax
mov rax, qword [0x140070048]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov ecx, dword [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [0x140070048]
call qword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.1400023f0
call fcn.140004c80
call fcn.1400050a0
call fcn.140009cb0
cmp dword [0x140066360], 0
jne 0x14001f3a3
call fcn.1400192b0
test eax, eax
jne 0x14001f3a3
xor ecx, ecx
call qword [0x140071de0]
call fcn.140023e70
cmp qword [0x140070048], 0
je 0x14001f3bf
mov rcx, qword [0x140070048]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x38], 0
je 0x14001f3d2
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x38], 0
mov qword [0x140070048], 0
cmp qword [0x140072a20], 0
je 0x14001f3fd
mov rcx, qword [0x140072a20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x20], 0
je 0x14001f410
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x1400659b8], 0
jne 0x14001f421
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0xa8
ret