Function at 0x180011bfc
Capabilities:
Check mutex on windows
Check os version
Create pipe
Create thread
Get explorer pid
Get session user name

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov rbp, rcx
lea rcx, [0x180026b10]
xor r13d, r13d
or ebx, 0xffffffff
mov dword [rax + 0x10], r13d
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x1800266d0]
lea r11, [0x180026b00]
mov dword [0x180026b3c], r13d
mov qword [0x180026b08], r11
mov qword [0x180026b00], r11
lea edi, [rbx + 0x5d]
xor edx, edx
mov r8, rdi
mov dword [0x180026b38], r13d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov qword [0x180026ae8], rax
je 0x1800125b1
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov rcx, qword [0x180026ae8]
add rcx, 0x30
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1800291f2]
xor edx, edx
call fcn.180016a14
mov rcx, qword [0x180026ae8]
mov r8, qword [0x180026838]
mov qword [rcx + 0x1c], rax
mov dword [rcx + 0x24], 0xdbebc690
lea r14d, [rbx + 2]
xor ecx, ecx
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp rax, r13
mov qword [0x180026840], rax
je 0x1800125ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1800125ae
cmp qword [0x180026770], r13
mov qword [rsp + 0x58], r13
jne 0x180011d39
mov eax, dword [0x1800268a0]
mov rcx, qword [0x180026878]
lea r8, [rsp + 0x40]
xor eax, 0xa2bcb0b8
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], eax
call fcn.18001b0d0
mov rcx, qword [0x180026770]
cmp eax, r13d
cmovne rcx, qword [rsp + 0x60]
mov qword [0x180026770], rcx
lea rcx, [rsp + 0x58]
call fcn.180006650
mov rcx, qword [rsp + 0x58]
cmp rcx, r13
jne 0x180011d87
mov eax, dword [0x1800268a0]
mov rcx, qword [0x180026878]
lea r8, [rsp + 0x44]
xor eax, 0x94b64117
lea rdx, [rsp + 0x58]
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000
mov dword [rsp + 0x20], eax
call fcn.18001b0d0
cmp eax, r13d
je 0x180011da0
mov rcx, qword [rsp + 0x58]
call fcn.180006254
mov r8, qword [rsp + 0x58]
mov rcx, qword [0x1800266d0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x1800266d0]
xor edx, edx
mov ebx, r13d
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12d, 3
cmp rax, r13
mov qword [0x180026858], rax
je 0x180011e6d
lea rcx, [0x180026ac0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180026ab0]
lea rcx, [0x180026a80]
mov qword [0x180026ab8], r11
mov qword [0x180026ab0], r11
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180026a70]
mov qword [0x180026a78], r11
mov qword [0x180026a70], r11
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x180011e2f
cmp qword [0x180026910], r13
jne 0x180011e2f
call fcn.180017cf4
mov qword [0x180026910], rax
mov rdi, r13
mov rsi, r12
lea rcx, [0x1800255f8]
mov rcx, qword [rdi + rcx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r11, rax
mov rax, qword [0x180026858]
mov qword [rdi + rax], r11
add rdi, 8
sub rsi, r14
jne 0x180011e35
mov dword [0x180026860], r12d
mov dword [0x180026854], r14d
jmp 0x180011e72
mov ebx, 8
cmp ebx, r13d
jne 0x1800125b1
lea r9, [0x18000f0e4]
lea r8, [0x18000f1c0]
lea rcx, [0x1800267e0]
mov edx, 0x68
call fcn.1800137a8
cmp eax, r13d
mov ebx, eax
jne 0x1800125b1
lea rdx, [rsp + 0xb8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov r11d, dword [rsp + 0xb8]
cmp r11d, r13d
je 0x180011ef1
mov rcx, qword [0x1800266d0]
mov r8, r11
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov qword [0x180026700], rax
je 0x180011ef1
lea rdx, [rsp + 0xb8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [0x1800267d4]
cmp eax, 0x8bdbae2c
je 0x180011fc3
cmp eax, 0x7ee14d23
je 0x180011fc3
cmp rbp, r13
je 0x180011f27
lea rcx, [0x180026a18]
mov r8d, 0x18
mov rdx, rbp
call sub.ntdll.dll_memcpy
lea rax, [0x18000f50c]
lea rcx, [0x1800298ce]
mov qword [0x180026a60], r13
mov qword [0x180026a68], rax
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, r13
mov r12, rax
je 0x180011f9f
mov ebp, r13d
lea rsi, [0x1800255d0]
mov r8d, dword [0x1800268a0]
xor r9d, r9d
xor edx, edx
xor r8d, dword [rsi]
mov rcx, r12
mov rdi, r13
call fcn.1800172dc
cmp rax, r13
je 0x180011f82
mov edi, dword [rax]
add rdi, r12
cmp rdi, r13
mov qword [rsi], rdi
je 0x180011f98
add ebp, r14d
add rsi, 8
cmp ebp, 5
jb 0x180011f5e
jmp 0x180011fa4
mov ebx, 0x7f
jmp 0x180011fa4
mov ebx, 0x7e
cmp ebx, r13d
jne 0x1800125b1
call fcn.18001a0a4
cmp eax, r13d
mov ebx, eax
jne 0x1800125b1
mov eax, dword [0x1800267d4]
cmp eax, 0x25b973e5
mov ebx, r13d
mov r12d, 0x37688758
je 0x1800120c8
cmp eax, 0x287fe8d8
je 0x18001208d
cmp eax, r12d
je 0x180012081
mov ecx, 0x4ab631d8
cmp eax, ecx
je 0x18001207a
cmp eax, 0x6a07fc86
je 0x180012074
cmp eax, 0x7ee14d23
je 0x180012048
cmp eax, 0x8bdbae2c
je 0x18001203c
cmp eax, 0x9f68805c
je 0x18001202b
cmp eax, 0xaa0249d5
je 0x18001220b
mov dword [0x1800267d4], r13d
jmp 0x18001220b
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18000f340
jmp 0x18001220b
call fcn.180007f80
mov ebx, eax
jmp 0x1800121fd
lea rcx, [0x18002987e]
mov ebx, 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, r13
je 0x1800121fd
lea rdx, [0x1800291db]
mov rcx, rax
call fcn.180007da8
jmp 0x180012041
mov dword [0x1800267d4], ecx
call fcn.18000b2e8
jmp 0x180012041
call fcn.180008888
mov ebx, eax
jmp 0x18001220b
call qword [sym.imp.USER32.dll_GetShellWindow]
lea rdx, [rsp + 0xc0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [rsp + 0xc0]
cmp edx, r13d
je 0x1800120be
lea rcx, [0x180026a18]
call fcn.180019b50
jmp 0x180012086
mov ebx, 2
jmp 0x18001220b
lea rbx, [0x1800297a6]
mov dword [0x180025610], 0xa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r13
mov rdi, rax
jne 0x18001210c
lea rbx, [0x18002983e]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r13
mov rdi, rax
jne 0x18001210c
mov ebx, 0x7e
jmp 0x1800121fd
lea rdx, [0x180029fc5]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180029fd1]
mov rcx, rdi
mov qword [0x1800267a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp byte [0x180026868], 6
mov qword [0x1800267b0], rax
mov qword [0x180025b10], rbx
mov qword [0x180025b38], rbx
mov qword [0x180025b60], rbx
mov qword [0x180025b88], rbx
jne 0x180012183
mov ebx, 2
cmp byte [0x180026869], bl
jb 0x180012183
lea rax, [0x180025c30]
lea ecx, [rbx + 1]
btr dword [rax], 9
add rax, 0x18
sub rcx, r14
jne 0x180012176
mov rax, qword [0x1800267e0]
mov r9d, 3
lea r8, [0x180025c20]
or dword [rax + 0x34], r14d
lea rcx, [0x180025bb0]
mov edx, r9d
call fcn.18000f27c
lea rdx, [0x180025bb0]
lea rcx, [0x1800155d4]
mov r8d, 3
mov ebx, eax
call fcn.180015620
mov rax, qword [0x180025b30]
mov r11, qword [0x180025b80]
mov qword [0x180026790], rax
mov rax, qword [0x180025b58]
mov qword [0x180026788], r11
mov qword [0x180026798], rax
mov rax, qword [0x180025ba8]
mov qword [0x1800267a0], rax
cmp ebx, r13d
jne 0x1800125b1
call fcn.1800061a4
cmp ebx, r13d
jne 0x1800125b1
call fcn.180005038
mov rcx, qword [0x1800266d0]
xor edx, edx
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov rdi, rax
mov qword [0x180026780], rax
je 0x1800125b1
mov dword [rax + 4], r13d
mov dword [rax], r13d
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
lea r8, [0x180011804]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [0x180026780]
mov ecx, dword [rdi + 4]
mov qword [rdx + rcx*8 + 8], rax
mov eax, dword [rdi + 4]
cmp qword [rdx + rax*8 + 8], r13
je 0x1800125b1
add eax, r14d
mov dword [rdi + 4], eax
mov eax, dword [0x1800267d4]
cmp eax, r12d
jne 0x1800124df
lea r8, [0x1800267f8]
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea r9, [0x180017f10]
lea r8, [0x180017ef8]
lea rcx, [0x180026918]
mov edx, 0x4a30
call fcn.1800137a8
cmp eax, r13d
mov ebx, eax
jne 0x1800122e1
mov rax, qword [0x180026918]
or dword [rax + 0x34], 3
cmp ebx, r13d
jne 0x1800125b1
lea rax, [0x180018f80]
lea rcx, [0x1800269b0]
mov qword [0x1800269b0], rax
lea rax, [0x180018fc8]
mov qword [0x1800269c8], rax
call fcn.180018cd4
lea r10, [0x180018fec]
mov qword [0x1800269f8], r10
lea rcx, [0x1800269e8]
mov dword [0x180026a10], r14d
call fcn.180018cd4
cmp dword [0x1800269ab], r13d
mov ebx, r13d
mov dword [0x180026944], r13d
je 0x1800123a9
cmp qword [0x180026930], r13
jne 0x1800123a9
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
cmp rax, r13
mov qword [0x180026930], rax
je 0x1800123a1
lea rax, [0x180026938]
lea r9, [0x180026930]
lea r8, [0x180018aa4]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r13
mov qword [0x18002693c], rax
jne 0x1800123a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r13d
jne 0x1800125b1
test byte [0x180025ff4], 4
je 0x1800123c9
mov dword [0x180026928], r14d
mov dword [0x1800269d8], r14d
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.180005cec
lea rcx, section..bss
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r13
je 0x18001242b
lea r8, [0x1800260a8]
lea rcx, [0x180026090]
mov r9d, r14d
mov edx, r14d
call fcn.18000f27c
mov rsi, qword [0x180026780]
mov rcx, qword [0x1800267f0]
lea rax, [0x1800268a8]
mov ebp, dword [rsi + 4]
mov qword [rsp + 0x38], rax
mov eax, 0x100
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], eax
lea r9d, [rax - 1]
mov edx, 0x40000003
mov r8d, 4
mov ebx, r13d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x1800124bd
lea rax, [rsp + 0x48]
lea r8, [0x18000fb6c]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r13
je 0x1800124aa
mov qword [rsi + rbp*8 + 8], rax
jmp 0x1800124c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800124c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r13d
jne 0x1800125b1
mov rax, qword [0x180026780]
add dword [rax + 4], r14d
mov eax, dword [0x1800267d4]
cmp eax, r13d
je 0x1800125ae
cmp eax, r12d
jne 0x180012545
mov rcx, qword [0x1800266d0]
xor edx, edx
lea r8d, [rdx + 0x43]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x1800267e8], rax
mov rax, qword [0x1800267e8]
cmp rax, r13
je 0x180012562
movzx r9d, byte [0x180026869]
movzx r8d, byte [0x180026868]
mov rcx, qword [0x1800267e8]
lea rax, [0x18002912e]
lea rdx, [0x1800290f7]
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x180012562
lea rcx, [0x18002994a]
call fcn.18001a9ac
lea rcx, [0x18000ef60]
xor r8d, r8d
xor edx, edx
call fcn.180015620
mov rdi, qword [0x180026780]
lea rax, [rsp + 0xc8]
lea r8, [0x180006c7c]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [0x180026780]
mov ecx, dword [rdi + 4]
mov qword [rdx + rcx*8 + 8], rax
mov eax, dword [rdi + 4]
cmp qword [rdx + rax*8 + 8], r13
je 0x1800125b1
add eax, r14d
mov dword [rdi + 4], eax
mov ebx, r13d
mov eax, ebx
add rsp, 0x70
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret