Function at 0x1800112c0
Capabilities:
Check mutex on windows
Check os version
Create pipe
Create thread
Get explorer pid
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rbp, rcx
lea rcx, [0x180038010]
xor r14d, r14d
mov dword [rax + 0x10], r14d
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x180037ae8]
lea r11, [0x180038000]
mov dword [0x18003803c], r14d
mov ebx, 0xa0
mov qword [0x180038008], r11
mov qword [0x180038000], r11
mov r8, rbx
xor edx, edx
mov dword [0x180038038], r14d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r12d, [r14 + 8]
mov qword [0x180037f28], rax
cmp rax, r14
je 0x18001136e
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov rcx, qword [0x180037f28]
add rcx, 0x70
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [0x180037f28]
lea r11, [0x18003c0c0]
mov qword [rax], r11
mov ebx, r14d
jmp 0x180011371
mov ebx, r12d
cmp ebx, r14d
jne 0x180011d71
mov r8, qword [0x180037c50]
mov r15d, 1
xor ecx, ecx
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x180037c58], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x180037c58]
cmp rcx, r14
je 0x1800113c7
cmp eax, 0xb7
jne 0x1800113c4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x180037c58], r14
jmp 0x180011d6e
mov eax, r14d
cmp eax, r14d
jne 0x180011d6e
mov rcx, qword [0x180037ae8]
xor edx, edx
mov ebx, r14d
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13d, 3
mov qword [0x180037c78], rax
cmp rax, r14
je 0x1800114a0
lea rcx, [0x180037fc0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180037fb0]
lea rcx, [0x180037f80]
mov qword [0x180037fb8], r11
mov qword [0x180037fb0], r11
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180037f60]
mov qword [0x180037f68], r11
mov qword [0x180037f60], r11
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x18001145f
cmp qword [0x180037d38], r14
jne 0x18001145f
call fcn.180018b80
mov qword [0x180037d38], rax
mov dword [0x180037c70], r15d
mov rdi, r14
mov rsi, r13
lea rcx, [0x180036690]
mov rcx, qword [rdi + rcx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [0x180037c78]
mov qword [rdi + rcx], rax
add rdi, r12
sub rsi, r15
jne 0x18001146c
mov dword [0x180037c74], r13d
mov dword [0x180037c6c], r15d
jmp 0x1800114a3
mov ebx, r12d
cmp ebx, r14d
jne 0x180011d71
mov ebx, dword [0x180037ac0]
mov rcx, qword [0x180037ae8]
mov edi, 0x3c6ef35f
xor edx, edx
imul ebx, ebx, 0x19660d
add ebx, edi
mov dword [0x180037ac0], ebx
shr ebx, 1
and ebx, 0xf
add ebx, 4
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r11, rax
mov qword [0x180037fe8], rax
cmp rax, r14
je 0x180011591
mov r8d, r14d
cmp ebx, r14d
jbe 0x180011567
mov r9d, dword [0x180037ac0]
mov rcx, rax
mov r8d, ebx
mov r10d, ebx
imul r9d, r9d, 0x19660d
mov eax, 0x51eb851f
add r9d, edi
mov dword [0x180037ac0], r9d
shr r9d, 1
mul r9d
shr edx, 3
imul edx, edx, 0x19
sub r9d, edx
add r9b, 0x41
mov byte [rcx], r9b
mov r9d, dword [0x180037ac0]
imul r9d, r9d, 0x19660d
add r9d, edi
mov dword [0x180037ac0], r9d
test r9b, 2
je 0x18001155f
add byte [rcx], 0x20
mov r9d, dword [0x180037ac0]
add rcx, r15
sub r10, r15
jne 0x18001150b
mov eax, r8d
lea r9, [0x18000e444]
lea rcx, [0x180037c00]
lea r8, [0x18000e580]
mov edx, 0x70
mov byte [rax + r11], r14b
call fcn.18001d940
mov ebx, eax
jmp 0x180011594
mov ebx, r12d
cmp ebx, r14d
jne 0x180011d71
lea rdx, [rsp + 0xf8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov r11d, dword [rsp + 0xf8]
cmp r11d, r14d
je 0x1800115e9
mov rcx, qword [0x180037ae8]
mov r8, r11
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x180037b20], rax
cmp rax, r14
je 0x1800115e9
lea rdx, [rsp + 0xf8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [0x180037bfc]
mov dword [0x180037ff0], r15d
mov edi, 0x1545f149
mov esi, 0x5afb7e2a
mov r12d, 0x4e1dcf8f
mov r13d, 0xbb272c80
cmp eax, 0x7a4ab374
je 0x180011617
cmp eax, esi
jne 0x18001167b
mov rcx, qword [0x180037c80]
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x80]
mov r9d, 0x30
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwQueryInformationProcess]
mov r8d, r14d
mov ecx, 0x400
cmp eax, r14d
cmovge r8d, dword [rsp + 0xa8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, r14
jne 0x18001166c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1800116a9
jmp 0x180011675
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x180037bfc]
cmp eax, r13d
je 0x1800116a9
cmp eax, r12d
je 0x1800116a9
cmp eax, edi
je 0x1800116a9
lea r9, [0x18000e8e0]
xor r8d, r8d
mov edx, r15d
mov rcx, rbp
call fcn.18001bc88
mov ebx, eax
cmp eax, r14d
jne 0x180011d71
mov qword [rsp + 0x40], r14
cmp qword [0x180037d48], r14
jne 0x180011727
mov eax, dword [0x180037cb0]
mov rcx, qword [0x180037c98]
lea r8, [rsp + 0x108]
xor eax, 0x92403214
lea rdx, [rsp + 0x58]
xor r9d, r9d
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], eax
call fcn.1800189ec
cmp eax, r14d
je 0x180011727
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r11, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov edx, dword [rsp + 0x108]
mov r8d, r11d
mov rcx, rbx
xor r9d, r9d
mov dword [0x180037d50], r11d
call fcn.180028cf0
mov qword [0x180037d48], rbx
lea rcx, [rsp + 0x40]
call fcn.180005d74
mov rbx, qword [rsp + 0x40]
cmp rbx, r14
jne 0x180011775
mov eax, dword [0x180037cb0]
mov rcx, qword [0x180037c98]
lea r8, [rsp + 0x70]
xor eax, 0xa44ac3bb
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000
mov dword [rsp + 0x20], eax
call fcn.1800189ec
cmp eax, r14d
je 0x18001178f
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.180005828
mov rcx, qword [0x180037ae8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x180037bfc]
mov ebx, r14d
cmp eax, 0x79405f4
je 0x18001186a
cmp eax, edi
je 0x180011853
cmp eax, 0x18836a74
je 0x180011821
cmp eax, r12d
je 0x1800117f9
cmp eax, esi
je 0x1800117f2
cmp eax, 0x7a4ab374
je 0x1800117f2
cmp eax, 0xaf9402f0
je 0x1800117e1
cmp eax, r13d
je 0x1800117da
mov dword [0x180037bfc], r14d
jmp 0x1800118a5
call fcn.1800079b8
jmp 0x180011858
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18000e710
jmp 0x1800118a5
call fcn.180009f20
jmp 0x180011858
lea rcx, [0x18003b79e]
mov ebx, 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, r14
je 0x18001185a
lea rdx, [0x18003b1cd]
mov rcx, rax
call fcn.1800077b0
jmp 0x180011858
call qword [sym.imp.USER32.dll_GetShellWindow]
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [rsp + 0x48]
cmp edx, r14d
je 0x18001184c
lea rcx, [0x180037d60]
call fcn.18001b598
jmp 0x1800118a3
mov ebx, 2
jmp 0x1800118a5
call fcn.1800087dc
mov ebx, eax
cmp ebx, r14d
jne 0x180011d71
call fcn.180005798
jmp 0x1800118a5
lea rax, [rsp + 0x74]
lea r8, [0x1800083f8]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r14
je 0x18001189d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800118a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
jne 0x180011d71
call fcn.180004db4
mov rcx, qword [0x180037ae8]
xor edx, edx
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov qword [0x180037ba0], rax
cmp rax, r14
je 0x180011d71
mov dword [rax + 4], r14d
mov dword [rax], r14d
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea r8, [0x180010ec8]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [0x180037ba0]
mov ecx, dword [rdi + 4]
mov qword [rdx + rcx*8 + 8], rax
mov eax, dword [rdi + 4]
cmp qword [rdx + rax*8 + 8], r14
je 0x180011d71
inc eax
cmp dword [0x180037bfc], 0x79405f4
mov dword [rdi + 4], eax
jne 0x180011bd1
lea r8, [0x180037c10]
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea r9, [0x18001c0ec]
lea r8, [0x18001c0d4]
lea rcx, [0x180037da8]
mov edx, 0x4a30
call fcn.18001d940
mov ebx, eax
cmp eax, r14d
jne 0x180011978
mov rax, qword [0x180037da8]
or dword [rax + 0x34], 3
cmp ebx, r14d
jne 0x180011d71
lea rax, [0x18001d10c]
lea rcx, [0x180037e20]
mov qword [0x180037e20], rax
lea rax, [0x18001d158]
mov qword [0x180037e38], rax
call fcn.18001d514
lea rax, [0x18001cea8]
mov qword [0x180037dd8], rax
lea rax, [0x18001cdc8]
lea r10, [0x18001ce74]
lea rcx, [0x180037db8]
mov qword [0x180037dc8], rax
mov qword [0x180037dc0], r10
call fcn.18001d514
lea rax, [0x18001d8cc]
lea r10, [0x18001d85c]
mov qword [0x180037e78], rax
lea rax, [0x18001d8f0]
mov qword [0x180037e60], r10
mov qword [0x180037e68], rax
mov dword [0x180037e80], r15d
lea rcx, [0x180037e58]
call fcn.18001d514
lea r10, [0x18001cecc]
lea rcx, [0x180037df0]
mov qword [0x180037e00], r10
mov dword [0x180037e18], r15d
call fcn.18001d514
mov ebx, r14d
mov dword [0x180037ea8], r14d
cmp dword [0x180037f10], r14d
je 0x180011ab3
cmp qword [0x180037e90], r14
jne 0x180011ab3
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x180037e90], rax
cmp rax, r14
je 0x180011aab
lea rax, [0x180037e98]
lea r9, [0x180037e90]
lea r8, [0x18001d2cc]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180037ea0], rax
cmp rax, r14
jne 0x180011ab3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
jne 0x180011d71
test byte [0x180036634], 4
je 0x180011ada
mov dword [0x180037d54], r15d
mov dword [0x180037e48], r15d
mov dword [0x180037de0], r15d
lea rcx, section..bss
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r14
je 0x180011b05
lea r8, [0x180037188]
lea rcx, [0x180037170]
mov r9d, r15d
mov edx, r15d
call fcn.18000e648
mov rsi, qword [0x180037ba0]
mov rcx, qword [0x180037c08]
lea rax, [0x180037cd0]
mov ebp, dword [rsi + 4]
mov qword [rsp + 0x38], rax
mov eax, 0x100
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], eax
lea r9d, [rax - 1]
mov edx, 0x40000003
mov r8d, 4
mov ebx, r14d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180011b97
lea rax, [rsp + 0x60]
lea r8, [0x18000f124]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r14
je 0x180011b84
mov qword [rsi + rbp*8 + 8], rax
jmp 0x180011b9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180011b9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
jne 0x180011d71
mov rax, qword [0x180037ba0]
add dword [rax + 4], r15d
cmp dword [0x180037b14], r14d
je 0x180011cc5
lea rcx, [0x180037b10]
call fcn.1800024b0
jmp 0x180011cc5
cmp qword [0x180037ca0], r14
je 0x180011cc5
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0x68]
lea rcx, [0x18003b1ae]
call fcn.180004c38
cmp eax, r14d
jne 0x180011cc5
cmp dword [rsp + 0x100], 4
jbe 0x180011cc5
mov rcx, qword [0x180037ca0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov rbp, qword [rsp + 0x68]
mov r8d, dword [0x180037c94]
mov edx, dword [rsp + 0x100]
mov rcx, rbp
xor r9d, r9d
mov r13, rax
call fcn.180028d3c
mov r11d, dword [rsp + 0x100]
mov rcx, r13
lea r12, [rbp + 4]
mov byte [r11 + rbp - 1], r14b
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
mov rsi, rax
cmp rax, r14
je 0x180011c61
mov byte [rax], r14b
mov edx, 0x20
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrChrA]
mov rdi, rax
cmp rax, r14
je 0x180011c7d
mov byte [rax], r14b
add rdi, r15
mov rdx, r13
mov rcx, r12
call fcn.1800183ac
cmp eax, r14d
jne 0x180011c97
mov r12, rdi
cmp rdi, r14
je 0x180011cab
jmp 0x180011c61
xor r9d, r9d
mov rdx, rbp
mov ecx, 0x125
lea r8d, [r9 + 4]
call fcn.18000f3c8
cmp rsi, r14
je 0x180011cb3
mov byte [rsi], 0x2e
mov rcx, qword [0x180037ae8]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x180037bfc]
cmp eax, r14d
je 0x180011d6e
cmp eax, 0x79405f4
jne 0x180011d26
mov rcx, qword [0x180037ae8]
xor edx, edx
lea r8d, [rdx + 0x43]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x180037d40], rax
cmp rax, r14
je 0x180011d26
movzx r9d, byte [0x180037c8d]
movzx r8d, byte [0x180037c8c]
lea rcx, [0x18003b130]
mov qword [rsp + 0x20], rcx
lea rdx, [0x18003b0f9]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdi, qword [0x180037ba0]
lea rax, [rsp + 0x4c]
lea r8, [0x1800064f0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [0x180037ba0]
mov ecx, dword [rdi + 4]
mov qword [rdx + rcx*8 + 8], rax
mov eax, dword [rdi + 4]
cmp qword [rdx + rax*8 + 8], r14
je 0x180011d71
inc eax
mov dword [rdi + 4], eax
mov ebx, r14d
mov eax, ebx
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret