Function at 0x180011938
Capabilities:
Check mutex on windows
Check os version
Create pipe
Create thread
Get explorer pid
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rbp, rcx
lea rcx, [0x180036c30]
xor r14d, r14d
mov dword [rax + 0x10], r14d
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x180036838]
lea r11, [0x180036c20]
mov dword [0x180036c5c], r14d
mov ebx, 0xa0
mov qword [0x180036c28], r11
mov qword [0x180036c20], r11
mov r8, rbx
xor edx, edx
mov dword [0x180036c58], r14d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r12d, [r14 + 8]
cmp rax, r14
mov qword [0x180036b58], rax
je 0x1800119e6
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov rcx, qword [0x180036b58]
add rcx, 0x70
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [0x180036b58]
lea r11, [0x18003a1f2]
mov qword [rax], r11
mov ebx, r14d
jmp 0x1800119e9
mov ebx, r12d
cmp ebx, r14d
jne 0x180012351
mov r8, qword [0x1800369a0]
mov r15d, 1
xor ecx, ecx
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x1800369a8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1800369a8]
cmp rcx, r14
je 0x180011a3f
cmp eax, 0xb7
jne 0x180011a3c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1800369a8], r14
jmp 0x18001234e
mov eax, r14d
cmp eax, r14d
jne 0x18001234e
mov rcx, qword [0x180036838]
xor edx, edx
mov ebx, r14d
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r14
mov qword [0x180036a08], rax
je 0x180011b18
lea rcx, [0x180036be0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180036bd0]
lea rcx, [0x180036ba0]
mov qword [0x180036bd8], r11
mov qword [0x180036bd0], r11
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180036b80]
mov qword [0x180036b88], r11
mov qword [0x180036b80], r11
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x180011ad1
cmp qword [0x180036ac0], r14
jne 0x180011ad1
call fcn.18001936c
mov qword [0x180036ac0], rax
mov r13d, 3
mov dword [0x180036a00], r15d
mov rdi, r14
mov rsi, r13
lea rcx, [0x180035668]
mov rcx, qword [rdi + rcx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [0x180036a08]
mov qword [rdi + rcx], rax
add rdi, r12
sub rsi, r15
jne 0x180011ae4
mov dword [0x180036a04], r13d
mov dword [0x1800369bc], r15d
jmp 0x180011b1b
mov ebx, r12d
cmp ebx, r14d
jne 0x180012351
mov ebx, dword [0x180036810]
mov rcx, qword [0x180036838]
mov edi, 0x3c6ef35f
xor edx, edx
imul ebx, ebx, 0x19660d
add ebx, edi
mov dword [0x180036810], ebx
shr ebx, 1
and ebx, 0xf
add ebx, 4
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r14
mov r11, rax
mov qword [0x180036c08], rax
je 0x180011c76
cmp ebx, r14d
mov r9d, r14d
jbe 0x180011bdf
mov r8d, dword [0x180036810]
mov rcx, rax
mov r9d, ebx
mov r10d, ebx
imul r8d, r8d, 0x19660d
mov eax, 0x51eb851f
add r8d, edi
mov dword [0x180036810], r8d
shr r8d, 1
mul r8d
shr edx, 3
imul edx, edx, 0x19
sub r8d, edx
add r8b, 0x41
mov byte [rcx], r8b
mov r8d, dword [0x180036810]
imul r8d, r8d, 0x19660d
add r8d, edi
test r8b, 2
mov dword [0x180036810], r8d
je 0x180011bd7
add byte [rcx], 0x20
mov r8d, dword [0x180036810]
add rcx, r15
sub r10, r15
jne 0x180011b83
mov rcx, qword [0x180036838]
mov eax, r9d
xor edx, edx
mov r8d, 0x1058
mov ebx, r14d
mov byte [rax + r11], r14b
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r14
mov rdi, rax
je 0x180011c6c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [rdi + 0x48]
lea rax, [rdi + 0x58]
mov qword [rdi + 0x50], r11
mov rcx, rax
mov edx, 0x100
mov qword [r11], r11
mov qword [rax + 8], rcx
mov qword [rax], rcx
add rcx, 0x10
add rax, 0x10
sub rdx, r15
jne 0x180011c26
lea rax, [0x18000ec24]
mov dword [rdi + 0x34], r14d
mov dword [rdi + 0x2c], r14d
mov qword [rdi + 0x38], rax
lea rax, [0x18000eae8]
mov dword [rdi + 0x28], r14d
mov qword [rdi + 0x40], rax
mov dword [rdi + 0x30], 0x70
mov qword [0x180036950], rdi
jmp 0x180011c79
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180011c79
mov ebx, r12d
cmp ebx, r14d
jne 0x180012351
lea rdx, [rsp + 0x108]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov r11d, dword [rsp + 0x108]
cmp r11d, r14d
je 0x180011cce
mov rcx, qword [0x180036838]
mov r8, r11
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r14
mov qword [0x180036878], rax
je 0x180011cce
lea rdx, [rsp + 0x108]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [0x180036958]
mov dword [0x180036c10], r15d
mov edi, 0x1541f349
cmp eax, 0x7a4eb174
mov esi, 0x5aff7c2a
mov r12d, 0x4e19cd8f
mov r13d, 0xbb232e80
je 0x180011cfc
cmp eax, esi
jne 0x180011d67
mov rcx, qword [0x180036a20]
lea rax, [rsp + 0x80]
lea r8, [rsp + 0x88]
mov r9d, 0x30
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwQueryInformationProcess]
mov r8d, r14d
mov ecx, 0x400
cmp eax, r14d
cmovge r8d, dword [rsp + 0xb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, r14
jne 0x180011d58
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x180011ddf
jmp 0x180011d61
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x180036958]
cmp eax, 0x79007f4
jne 0x180011db1
mov dword [rsp + 0x118], r14d
call qword [sym.imp.USER32.dll_GetShellWindow]
lea rdx, [rsp + 0x118]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r11d, dword [rsp + 0x118]
mov eax, dword [0x180036958]
cmp r11d, r14d
je 0x180011db1
cmp r11d, dword [0x180036a28]
cmovne eax, r14d
mov dword [0x180036958], eax
cmp eax, r13d
je 0x180011ddf
cmp eax, r12d
je 0x180011ddf
cmp eax, edi
je 0x180011ddf
lea r9, [0x18000ef84]
xor r8d, r8d
mov edx, r15d
mov rcx, rbp
call fcn.18001d1f4
cmp eax, r14d
mov ebx, eax
jne 0x180012351
cmp qword [0x180036ae0], r14
mov qword [rsp + 0x40], r14
jne 0x180011e58
mov r9d, dword [0x180036a50]
mov rcx, qword [0x180036a38]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x58]
xor r9d, 0x92443014
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 0x100
call fcn.1800191ec
cmp eax, r14d
je 0x180011e58
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r11, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x58]
mov edx, dword [rsp + 0x50]
mov r8d, r11d
mov rcx, rbx
xor r9d, r9d
mov dword [0x180036ae8], r11d
call fcn.180028828
mov qword [0x180036ae0], rbx
lea rcx, [rsp + 0x40]
call fcn.18000620c
mov rbx, qword [rsp + 0x40]
cmp rbx, r14
jne 0x180011ea7
mov r9d, dword [0x180036a50]
mov rcx, qword [0x180036a38]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
xor r9d, 0xa44ec1bb
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 0x2000
call fcn.1800191ec
cmp eax, r14d
je 0x180011ec1
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.180005c5c
mov rcx, qword [0x180036838]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x180036958]
mov ebx, r14d
cmp eax, 0x79007f4
je 0x180011f9c
cmp eax, edi
je 0x180011f85
cmp eax, 0x18876874
je 0x180011f53
cmp eax, r12d
je 0x180011f2b
cmp eax, esi
je 0x180011f24
cmp eax, 0x7a4eb174
je 0x180011f24
cmp eax, 0xaf9000f0
je 0x180011f13
cmp eax, r13d
je 0x180011f0c
mov dword [0x180036958], r14d
jmp 0x180011fd7
call fcn.180008068
jmp 0x180011f8a
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18000edb4
jmp 0x180011fd7
call fcn.18000a78c
jmp 0x180011f8a
lea rcx, [0x180039856]
mov ebx, 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, r14
je 0x180011f8c
lea rdx, [0x180039228]
mov rcx, rax
call fcn.180007e5c
jmp 0x180011f8a
call qword [sym.imp.USER32.dll_GetShellWindow]
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [rsp + 0x48]
cmp edx, r14d
je 0x180011f7e
lea rcx, [0x180036b00]
call fcn.18001cb04
jmp 0x180011fd5
mov ebx, 2
jmp 0x180011fd7
call fcn.180008ecc
mov ebx, eax
cmp ebx, r14d
jne 0x180012351
call fcn.180005bcc
jmp 0x180011fd7
lea rax, [rsp + 0x78]
lea r8, [0x180008af4]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r14
je 0x180011fcf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180011fd7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
jne 0x180012351
call fcn.180004f68
mov rcx, qword [0x180036838]
xor edx, edx
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r14
mov rdi, rax
mov qword [0x1800368f0], rax
je 0x180012351
mov dword [rax + 4], r14d
mov dword [rax], r14d
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea r8, [0x180011540]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [0x1800368f0]
mov ecx, dword [rdi + 4]
mov qword [rdx + rcx*8 + 8], rax
mov eax, dword [rdi + 4]
cmp qword [rdx + rax*8 + 8], r14
je 0x180012351
add eax, r15d
cmp dword [0x180036958], 0x79007f4
mov dword [rdi + 4], eax
jne 0x1800121b1
lea r8, [0x180036968]
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea r11, [0x1800369c8]
lea r9, [0x1800369c0]
mov qword [rsp + 0x28], r11
lea r8, [0x18001302c]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r14
mov qword [0x1800369c0], rax
jne 0x1800120b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, section..bss
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r14
je 0x1800120e0
lea r8, [0x180036148]
lea rcx, [0x180036130]
mov r9d, r15d
mov edx, r15d
call fcn.18000ecec
mov rsi, qword [0x1800368f0]
mov rcx, qword [0x180036960]
lea rax, [0x180036a58]
mov ebp, dword [rsi + 4]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r14d
mov edx, 0x40000003
mov r9d, 0xff
mov r8d, 4
mov dword [rsp + 0x28], 0x100
mov ebx, r14d
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x180012177
lea rax, [rsp + 0x54]
lea r8, [0x18000f7b4]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r14
je 0x180012164
mov qword [rsi + rbp*8 + 8], rax
jmp 0x18001217f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001217f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
jne 0x180012351
mov rax, qword [0x1800368f0]
add dword [rax + 4], r15d
cmp dword [0x18003686c], r14d
je 0x1800122a4
lea rcx, [0x180036868]
call fcn.180002634
jmp 0x1800122a4
cmp qword [0x180036a40], r14
je 0x1800122a4
lea r8, [rsp + 0x110]
lea rdx, [rsp + 0x68]
lea rcx, [0x180039209]
call fcn.180004dec
cmp eax, r14d
jne 0x1800122a4
cmp dword [rsp + 0x110], 4
jbe 0x1800122a4
mov rcx, qword [0x180036a40]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov rbp, qword [rsp + 0x68]
mov r8d, dword [0x180036a34]
mov edx, dword [rsp + 0x110]
mov rcx, rbp
xor r9d, r9d
mov r13, rax
call fcn.18002886c
mov r11d, dword [rsp + 0x110]
mov rcx, r13
lea r12, [rbp + 4]
mov byte [r11 + rbp - 1], r14b
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
cmp rax, r14
mov rsi, rax
je 0x180012241
mov byte [rax], r14b
mov dx, 0x20
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrChrA]
cmp rax, r14
mov rdi, rax
je 0x18001225c
mov byte [rax], r14b
add rdi, r15
mov rdx, r13
mov rcx, r12
call fcn.180018f4c
cmp eax, r14d
jne 0x180012276
cmp rdi, r14
mov r12, rdi
je 0x18001228a
jmp 0x180012241
xor r9d, r9d
mov rdx, rbp
mov ecx, 0x125
lea r8d, [r9 + 4]
call fcn.18000fa58
cmp rsi, r14
je 0x180012292
mov byte [rsi], 0x2e
mov rcx, qword [0x180036838]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x180036958]
cmp eax, r14d
je 0x18001234e
cmp eax, 0x79007f4
jne 0x180012305
mov rcx, qword [0x180036838]
xor edx, edx
lea r8d, [rdx + 0x70]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r14
mov qword [0x180036ac8], rax
je 0x180012305
movzx r9d, byte [0x180036a2d]
movzx r8d, byte [0x180036a2c]
lea rcx, [0x180039187]
mov qword [rsp + 0x20], rcx
lea rdx, [0x18003911e]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdi, qword [0x1800368f0]
lea rax, [rsp + 0x4c]
lea r8, [0x180006940]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [0x1800368f0]
mov ecx, dword [rdi + 4]
mov qword [rdx + rcx*8 + 8], rax
mov eax, dword [rdi + 4]
cmp qword [rdx + rax*8 + 8], r14
je 0x180012351
add eax, r15d
mov dword [rdi + 4], eax
mov ebx, r14d
mov eax, ebx
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret