Function at 0x18000fad4
Capabilities:
Check mutex on windows
Check os version
Create pipe
Create thread
Get session user name
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r13, rcx
lea rcx, [0x180029a10]
xor r14d, r14d
mov dword [rax + 0x10], r14d
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180029a00]
mov qword [0x180029a08], r11
mov qword [0x180029a00], r11
mov dword [0x180029a3c], r14d
lea rcx, [0x1800299c0]
mov dword [0x180029a38], r14d
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r8, qword [0x1800297c0]
lea r15d, [r14 + 1]
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp rax, r14
mov qword [0x1800297c8], rax
je 0x180010348
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180010348
mov rcx, qword [0x180029890]
mov eax, r14d
cmp rcx, r14
je 0x18000fbba
mov r8w, 0x5c
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_StrRChrA]
cmp rax, r14
mov rbx, rax
je 0x18000fb91
add rbx, r15
jmp 0x18000fb98
mov rbx, qword [0x180029890]
mov rcx, rbx
call qword [sym.imp.ntdll.dll__strupr]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, rbx
mov edx, eax
call fcn.18001d7e4
xor eax, dword [0x1800298b8]
mov dword [0x180029764], eax
call fcn.18000f670
mov rcx, qword [0x180029648]
xor edx, edx
mov ebx, r14d
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r14
mov qword [0x180029868], rax
je 0x18000fc8d
lea rcx, [0x180029980]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180029970]
lea rcx, [0x180029940]
mov qword [0x180029978], r11
mov qword [0x180029970], r11
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180029930]
mov qword [0x180029938], r11
mov qword [0x180029930], r11
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x18000fc4e
cmp qword [0x180029928], r14
jne 0x18000fc4e
call fcn.1800167ec
mov qword [0x180029928], rax
mov ebp, 3
mov rdi, r14
mov rsi, rbp
lea rcx, [0x180028078]
mov rcx, qword [rdi + rcx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [0x180029868]
mov qword [rdi + rcx], rax
add rdi, 8
sub rsi, r15
jne 0x18000fc59
mov dword [0x180029870], ebp
mov dword [0x180029864], r15d
jmp 0x18000fc92
mov ebx, 8
cmp ebx, r14d
jne 0x18001034b
mov rcx, qword [0x180029648]
xor edx, edx
mov r8d, 0x1058
mov ebx, r14d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r14
mov rdi, rax
je 0x18000fd21
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [rdi + 0x48]
lea rax, [rdi + 0x58]
mov qword [rdi + 0x50], r11
mov rcx, rax
mov edx, 0x100
mov qword [r11], r11
mov qword [rax + 8], rcx
mov qword [rax], rcx
add rcx, 0x10
add rax, 0x10
sub rdx, r15
jne 0x18000fcdb
lea rax, [0x18000cc20]
mov dword [rdi + 0x34], r14d
mov dword [rdi + 0x2c], r14d
mov qword [rdi + 0x38], rax
lea rax, [0x18000cb44]
mov dword [rdi + 0x28], r14d
mov qword [rdi + 0x40], rax
mov dword [rdi + 0x30], 0x68
mov qword [0x180029768], rdi
jmp 0x18000fd29
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
jne 0x18001034b
lea rdx, [rsp + 0xb8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov r11d, dword [rsp + 0xb8]
cmp r11d, r14d
je 0x18000fd7e
mov rcx, qword [0x180029648]
mov r8, r11
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r14
mov qword [0x180029690], rax
je 0x18000fd7e
lea rdx, [rsp + 0xb8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [0x180029764]
mov ebx, r14d
cmp eax, 0xe7e4e0f
je 0x18000ff79
cmp eax, 0x1acd607f
je 0x18000ff62
cmp eax, 0xa67e490b
je 0x18000fe08
cmp eax, 0xb4afbdb6
je 0x18000fdfe
cmp eax, 0xdba0ff8b
je 0x18000fdf4
cmp eax, 0xeff78370
je 0x18000fdc5
mov dword [0x180029764], r14d
jmp 0x18000ff85
lea rcx, [0x18002c7fe]
mov ebx, 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, r14
je 0x18000ff69
lea rdx, [0x18002c1dd]
mov rcx, rax
call fcn.180006074
jmp 0x18000ff67
call fcn.180009208
jmp 0x18000ff67
call fcn.180006c70
jmp 0x18000ff67
lea rax, [rsp + 0x58]
lea r8, [rsp + 0x58]
lea rdx, [0x18002d090]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
lea rcx, [0x18002c6e0]
xor r9d, r9d
mov dword [rsp + 0x28], r15d
mov ebp, r14d
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], r14d
call fcn.180012da4
cmp eax, r14d
mov ebx, 2
je 0x18000fecd
mov rdi, qword [rsp + 0x58]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rdi + 0x28]
mov r12, rdi
call fcn.180012a94
cmp eax, r14d
jne 0x18000fe9e
mov rcx, qword [rsp + 0x50]
lea rdx, [0x18002d044]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
cmp rax, r14
jne 0x18000fe9e
lea rdx, [0x18002d044]
lea rcx, [rdi + 0x28]
mov r9d, ebx
mov r8d, 0x30
call fcn.180012bf8
mov rcx, qword [r12]
mov rax, qword [r12 + 8]
mov rdi, qword [rdi]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rcx, qword [0x180029648]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r11, [rsp + 0x58]
cmp rdi, r11
jne 0x18000fe53
cmp byte [0x180029878], 6
jne 0x18000ff5e
cmp byte [0x180029879], bl
jb 0x18000ff5e
lea r8, [rsp + 0x48]
lea rdx, [0x18002c764]
mov rcx, 0xffffffff80000001
mov dword [rsp + 0xc0], r14d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp eax, r14d
jne 0x18000ff43
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0xc0]
lea rdx, [0x18002c89a]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [0x180028c58]
lea rcx, [0x180028c40]
mov r9d, r15d
mov edx, r15d
call fcn.18000ccdc
mov ebp, eax
mov ebx, ebp
jmp 0x18000ff85
call fcn.18000624c
mov ebx, eax
cmp ebx, r14d
jne 0x18001034b
call fcn.180004df0
jmp 0x18000ff85
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18000cda4
cmp ebx, r14d
jne 0x18001034b
mov eax, dword [0x180029764]
cmp eax, 0x1acd607f
je 0x18001007c
cmp eax, 0xeff78370
je 0x18001007c
cmp eax, 0xb4afbdb6
je 0x18001007c
cmp r13, r14
mov ebx, r14d
jne 0x180010039
mov rcx, qword [0x180029888]
lea rdx, [0x180029898]
xor r8d, r8d
call fcn.1800152c0
cmp eax, r14d
mov ebx, eax
jne 0x18001004e
mov rcx, qword [0x180029898]
call fcn.180014444
cmp rax, r14
mov rdi, rax
je 0x18001004e
mov rcx, qword [0x180029898]
lea r8, [0x18002982c]
lea rdx, [0x180029820]
call fcn.180012b90
cmp eax, r14d
mov ebx, eax
jne 0x180010025
lea r8, [0x180029828]
lea rdx, [0x180029818]
mov rcx, rdi
call fcn.180012b90
mov rcx, qword [0x180029648]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18001004e
lea rcx, [0x180029818]
mov r8d, 0x18
mov rdx, r13
call sub.ntdll.dll_memcpy
cmp ebx, r14d
lea rax, [0x18000cf70]
mov qword [0x180029638], r14
mov qword [0x180029640], rax
jne 0x18001034b
call fcn.1800124b8
cmp eax, r14d
mov ebx, eax
jne 0x18001034b
call fcn.180003f44
mov rcx, qword [0x180029648]
xor edx, edx
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r14
mov rdi, rax
mov qword [0x180029718], rax
je 0x18001034b
mov dword [rax + 4], r14d
mov dword [rax], r14d
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
lea r8, [0x18000f21c]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [0x180029718]
mov ecx, dword [rdi + 4]
mov qword [rdx + rcx*8 + 8], rax
mov eax, dword [rdi + 4]
cmp qword [rdx + rax*8 + 8], r14
je 0x18001034b
add eax, r15d
mov dword [rdi + 4], eax
mov eax, dword [0x180029764]
cmp eax, 0xa67e490b
jne 0x180010296
lea r8, [0x180029780]
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea r11, [0x1800297e0]
lea r9, [0x1800297d8]
mov qword [rsp + 0x28], r11
lea r8, [0x1800114d4]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r14
mov qword [0x1800297d8], rax
jne 0x180010155
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1800296b0]
mov r8d, r15d
xor edx, edx
call fcn.18000491c
cmp rax, r14
je 0x180010197
mov rcx, qword [0x1800296b8]
xor r8d, r8d
xor edx, edx
call fcn.18000491c
cmp rax, r14
je 0x180010197
mov rcx, qword [0x1800296e0]
xor r8d, r8d
xor edx, edx
call fcn.18000491c
cmp rax, r14
jne 0x18001019d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, section..bss
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r14
je 0x1800101c8
lea r8, [0x180029090]
lea rcx, [0x180029078]
mov r9d, r15d
mov edx, r15d
call fcn.18000ccdc
mov rsi, qword [0x180029718]
mov rcx, qword [0x180029778]
lea rax, [0x1800298c0]
mov ebp, dword [rsi + 4]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r14d
mov edx, 0x40000003
mov r9d, 0xff
mov r8d, 4
mov dword [rsp + 0x28], 0x100
mov ebx, r14d
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x18001025f
lea rax, [rsp + 0x44]
lea r8, [0x18000d5d0]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r14
je 0x18001024c
mov qword [rsi + rbp*8 + 8], rax
jmp 0x180010267
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180010267
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
jne 0x18001034b
mov rax, qword [0x180029718]
add dword [rax + 4], r15d
cmp dword [0x18002967c], r14d
je 0x180010290
lea rcx, [0x180029678]
call fcn.180002394
mov eax, dword [0x180029764]
cmp eax, r14d
je 0x180010348
cmp eax, 0xa67e490b
jne 0x1800102fc
mov rcx, qword [0x180029648]
xor edx, edx
lea r8d, [rdx + 0x43]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x180029770], rax
mov rax, qword [0x180029770]
cmp rax, r14
je 0x1800102fc
movzx r9d, byte [0x180029879]
movzx r8d, byte [0x180029878]
mov rcx, qword [0x180029770]
lea rax, [0x18002c13f]
lea rdx, [0x18002c108]
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdi, qword [0x180029718]
lea rax, [rsp + 0xc8]
lea r8, [0x1800050a8]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [0x180029718]
mov ecx, dword [rdi + 4]
mov qword [rdx + rcx*8 + 8], rax
mov eax, dword [rdi + 4]
cmp qword [rdx + rax*8 + 8], r14
je 0x18001034b
add eax, r15d
mov dword [rdi + 4], eax
mov ebx, r14d
mov eax, ebx
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret