Function at 0x18000e098
Capabilities:
Check mutex on windows
Create pipe
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x40
mov rbp, rcx
lea rcx, [0x180023a88]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x180023da0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.18000de4c
mov r8, qword [0x180023bf0]
mov r13d, 1
xor ecx, ecx
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x180023bf8], rax
test rax, rax
je 0x18000e7bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x18000e7bf
mov rcx, qword [0x180023a50]
lea r8d, [r13 + 0x17]
xor edx, edx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x180023c08], rax
test rax, rax
je 0x18000e1ab
lea rcx, [0x180023d60]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180023d50]
lea rcx, [0x180023d20]
mov qword [0x180023d58], r11
mov qword [0x180023d50], r11
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180023d00]
xor edi, edi
lea esi, [rbx + 3]
mov qword [0x180023d08], r11
mov qword [0x180023d00], r11
lea rcx, [0x180022aa8]
mov rcx, qword [rdi + rcx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [0x180023c08]
mov qword [rdi + rcx], rax
add rdi, 8
sub rsi, r13
jne 0x18000e173
mov dword [0x180023c10], 3
mov dword [0x180023c14], r13d
jmp 0x18000e1b0
mov ebx, 8
test ebx, ebx
jne 0x18000e7c1
lea r9, [0x18000b15c]
lea r8, [0x18000b214]
lea edx, [rbx + 0x58]
lea rcx, [0x180023b60]
call fcn.180014574
mov ebx, eax
test eax, eax
jne 0x18000e7c1
mov rcx, qword [0x180023c38]
test rcx, rcx
je 0x18000e227
lea r8d, [rax + 0x5c]
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_StrRChrA]
mov rdi, rax
test rax, rax
je 0x18000e204
add rdi, r13
jmp 0x18000e20b
mov rdi, qword [0x180023c38]
mov rcx, rdi
call qword [sym.imp.ntdll.dll__strupr]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, rdi
mov edx, eax
call fcn.180018044
mov dword [0x180023a64], eax
mov esi, 2
cmp eax, 0x922df04
je 0x18000e3ce
cmp eax, 0x3d75a3ff
je 0x18000e3ad
cmp eax, 0x662d9d39
je 0x18000e2ba
cmp eax, 0x74fc6984
je 0x18000e417
cmp eax, 0xc84f40f0
je 0x18000e284
cmp eax, 0xdcfc6e80
je 0x18000e273
and dword [0x180023a64], ebx
jmp 0x18000e417
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18000b398
jmp 0x18000e417
lea rcx, [0x180025065]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18000e3c1
mov r9d, r13d
lea r8, [0x1800230e8]
mov edx, r13d
lea rcx, [0x1800230d0]
call fcn.18000b2d0
mov ebx, eax
jmp 0x18000e417
lea rbx, [0x180025756]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x18000e2ee
lea rbx, [0x180025796]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x18000e412
lea rdx, [0x180025be4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180025bf0]
mov rcx, rdi
mov qword [0x180023b40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 3
mov qword [0x180023b48], rax
mov rax, qword [0x180023b60]
mov qword [0x180022cc8], rbx
mov qword [0x180022e28], rbx
mov qword [0x180022f88], rbx
or dword [rax + 0x34], r13d
lea r8, [0x180023060]
lea rcx, [0x180023000]
mov edx, r9d
mov qword [0x180022fb0], rbx
call fcn.18000b2d0
lea rcx, [0x180023048]
mov ebx, eax
mov rax, qword [0x180022fa8]
mov r8, rdi
mov qword [0x180023b20], rax
mov rax, qword [0x180022ce8]
mov edx, r13d
mov qword [0x180023b28], rax
mov rax, qword [0x180022e48]
mov qword [0x180023b30], rax
mov rax, qword [0x180022fd0]
mov qword [0x180023b38], rax
call fcn.1800103d4
jmp 0x18000e417
lea rcx, [0x1800257e4]
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000e417
mov rcx, rax
call fcn.18000578c
jmp 0x18000e2b3
lea rcx, [0x18002509e]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x18000e412
lea rcx, [0x18002586c]
call fcn.1800171e8
mov r11, qword [0x180023b60]
mov edx, 0xd
or dword [r11 + 0x34], r13d
mov r9d, edx
lea r8, [0x180022e50]
lea rcx, [0x180022cf0]
jmp 0x18000e2ae
mov ebx, 0x7e
test ebx, ebx
jne 0x18000e7c1
lea rax, [0x180023c78]
lea rcx, [0x180023c88]
mov qword [0x180023c80], rax
mov qword [0x180023c78], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r11d, dword [0x180023a64]
cmp r11d, 0x74fc6984
je 0x18000e4b9
mov dword [0x180022284], r13d
cmp r11d, 0x34486263
je 0x18000e46a
cmp r11d, 0xf3ad5a3b
jne 0x18000e48b
mov edx, 0xa
lea r8, [0x180022750]
lea rcx, [0x180022840]
mov r9d, edx
call fcn.18001598c
mov ebx, eax
test eax, eax
jne 0x18000e4a5
lea r8, [0x180022958]
lea rcx, [0x180022988]
mov r9d, esi
mov edx, esi
call fcn.18001598c
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call fcn.180014af4
mov r11d, dword [0x180023a64]
cmp r11d, 0xc84f40f0
je 0x18000e5a0
cmp r11d, 0x3d75a3ff
je 0x18000e5a0
cmp r11d, 0x662d9d39
je 0x18000e5a0
xor ebx, ebx
test rbp, rbp
jne 0x18000e55e
mov rcx, qword [0x180023c30]
lea rdx, [0x180023c40]
call fcn.18001142c
mov ebx, eax
test eax, eax
jne 0x18000e573
mov rcx, qword [0x180023c40]
call fcn.1800105cc
mov rdi, rax
test rax, rax
je 0x18000e573
mov rcx, qword [0x180023c40]
lea r8, [0x180023ccc]
lea rdx, [0x180023cc0]
call fcn.180011730
mov ebx, eax
test eax, eax
jne 0x18000e54a
lea r8, [0x180023cc8]
lea rdx, [0x180023cb8]
mov rcx, rdi
call fcn.180011730
mov rcx, qword [0x180023a50]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18000e573
lea rcx, [0x180023cb8]
mov r8d, 0x18
mov rdx, rbp
call sub.ntdll.dll_memcpy
and qword [0x180023a40], 0
lea rax, [0x18000b64c]
mov qword [0x180023a48], rax
test ebx, ebx
jne 0x18000e7c1
call fcn.18001688c
mov ebx, eax
test eax, eax
jne 0x18000e7c1
call fcn.180003fe0
mov rcx, qword [0x180023a50]
xor edx, edx
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
mov qword [0x180023b18], rax
test rax, rax
je 0x18000e7c1
and dword [rax + 4], 0
mov dword [rax], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x18000da38]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, qword [0x180023b18]
mov ecx, dword [rsi + 4]
mov qword [rdi + rcx*8 + 8], rax
mov eax, dword [rsi + 4]
cmp qword [rdi + rax*8 + 8], 0
je 0x18000e7c1
inc eax
mov dword [rsi + 4], eax
mov eax, dword [0x180023a64]
cmp eax, 0x74fc6984
jne 0x18000e779
lea r9, [0x180015048]
lea r8, [0x180015048]
lea rcx, [0x180023cb0]
mov edx, 0x4a18
call fcn.180014574
mov ebx, eax
test eax, eax
jne 0x18000e65c
mov rax, qword [0x180023cb0]
or dword [rax + 0x34], r13d
test ebx, ebx
jne 0x18000e7c1
mov rcx, qword [0x180023ad0]
mov edx, r13d
call fcn.180004af4
test rax, rax
je 0x18000e69e
mov rcx, qword [0x180023ad8]
xor edx, edx
call fcn.180004af4
test rax, rax
je 0x18000e69e
mov rcx, qword [0x180023b00]
xor edx, edx
call fcn.180004af4
test rax, rax
jne 0x18000e6a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, section..bss
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x18000e6cf
lea r8, [0x180023568]
lea rcx, [0x180023550]
mov r9d, r13d
mov edx, r13d
call fcn.18000b2d0
mov rsi, qword [0x180023b18]
mov rcx, qword [0x180023b70]
lea rax, [0x180023c60]
mov ebp, dword [rsi + 4]
mov qword [rsp + 0x38], rax
mov eax, 0x100
xor ebx, ebx
lea r9d, [rax - 1]
mov edx, 0x40000003
and dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], eax
lea r8d, [rbx + 4]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000e75c
lea rax, [rsp + 0x70]
lea r8, [0x18000bc98]
mov r9, rdi
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18000e749
mov qword [rsi + rbp*8 + 8], rax
jmp 0x18000e764
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000e764
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x18000e7c1
mov rdi, qword [0x180023b18]
mov eax, dword [0x180023a64]
add dword [rdi + 4], r13d
test eax, eax
je 0x18000e7bf
lea rax, [rsp + 0x68]
lea r8, [0x180004e98]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [0x180023b18]
mov ecx, dword [rdi + 4]
mov qword [rdx + rcx*8 + 8], rax
mov eax, dword [rdi + 4]
cmp qword [rdx + rax*8 + 8], 0
je 0x18000e7c1
inc eax
mov dword [rdi + 4], eax
xor ebx, ebx
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r13
pop rdi
pop rsi
ret