Function at 0x140001230
Capabilities:
Check mutex on windows

Disassembly:
push r13
push r15
sub rsp, 0x68
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r13b, r13b
mov byte [rsp + 0x30], dl
mov r15d, ecx
test ecx, ecx
je 0x140001529
mov qword [rsp + 0x58], r12
call fcn.140001030
mov r12, rax
test rax, rax
jne 0x14000127f
lea rdx, str.Failed_to_find_thread__u
lea ecx, [rax + 3]
call fcn.140005ca0
jmp 0x140001524
mov qword [rsp + 0x88], rbx
lea rcx, [0x1400225c0]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0x60], rdi
xor dil, dil
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CsrGetProcessId
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov r8d, eax
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140001319
lea r8, [rsp + 0x38]
mov edx, 0xa
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140001319
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov rcx, qword [rsp + 0x38]
test eax, eax
setne dil
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000132a
lea rdx, str.Failed_to_open_CSRSSs_token
mov ecx, 3
call fcn.140005ca0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test dil, dil
jne 0x140001349
lea rdx, str.Failed_to_impersonate_SYSTEM.__This_may_break_IPC_if_youre_not_already_running_as_SYSTEM.
mov ecx, 2
call fcn.140005ca0
lea r8, str.GlobalGMMut
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
xor edx, edx
lea r8, str.GlobalGMReq
mov rdi, rax
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventW]
lea r8, str.GlobalGMDone
xor edx, edx
mov ecx, 0x100000
mov r14, rax
call qword [sym.imp.KERNEL32.dll_OpenEventW]
xor edx, edx
lea r8, str.GlobalGMSec
mov rbp, rax
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rsi, rax
test rdi, rdi
je 0x1400014a4
test r14, r14
je 0x1400014a4
test rbp, rbp
je 0x1400014a4
test rax, rax
je 0x1400014a4
xor r9d, r9d
mov qword [rsp + 0x20], 0x1000
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
jne 0x1400013f8
lea rdx, str.Failed_to_map_IPC_section.
lea ecx, [rax + 3]
jmp 0x1400014c5
mov edx, 0x3e8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140001429
lea rdx, str.Failed_to_acquire_mutex.
mov ecx, 3
call fcn.140005ca0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x1400014ca
mov qword [rbx], r12
mov edx, 0x10
mov rcx, rbx
mov dword [rbx + 8], 0xc0000001
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, 0x3e8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbx + 8]
test eax, eax
jns 0x140001476
mov r8d, dword [rbx + 8]
lea rdx, str.Bless_IPC_failed_with_NTSTATUS_0x_08x.
mov ecx, 3
call fcn.140005ca0
jmp 0x140001490
mov r9, r12
lea rdx, str.Thread__u__KTHREAD__p__has_been_blessed_by_GodFault
mov r8d, r15d
mov ecx, 1
call fcn.140005ca0
mov r13b, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x1400014ca
cmp byte [rsp + 0x30], 0
je 0x1400014b9
lea rdx, str.Server_does_not_appear_to_be_running.
mov ecx, 3
jmp 0x1400014c5
lea rdx, str.Server_does_not_appear_to_be_running.__Attempting_to_install_it...
mov ecx, 2
call fcn.140005ca0
mov rbx, qword [rsp + 0x88]
test rdi, rdi
je 0x1400014e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x60]
test r14, r14
je 0x1400014f3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x50]
test rbp, rbp
je 0x140001506
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x90]
test rsi, rsi
je 0x14000151c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x98]
mov r12, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
movzx eax, r13b
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140006770
add rsp, 0x68
pop r15
pop r13
ret