Function at 0x1800130fc
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Create pipe
Create thread
Get explorer pid
Get session user name
Terminate process

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xa0
mov rbp, rcx
lea rcx, [0x180053c70]
xor r13d, r13d
or ebx, 0xffffffff
mov dword [rax + 0x10], r13d
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x180052eb0]
lea r11, [0x180053c60]
mov dword [0x180053c9c], r13d
mov qword [0x180053c68], r11
mov qword [0x180053c60], r11
lea edi, [rbx + 0x5d]
xor edx, edx
mov r8, rdi
mov dword [0x180053c98], r13d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov qword [0x180053c50], rax
je 0x180013af2
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov rcx, qword [0x180053c50]
add rcx, 0x30
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r8, qword [0x180053048]
lea r14d, [rbx + 2]
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp rax, r13
mov qword [0x180053050], rax
je 0x180013aef
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180013aef
mov rcx, qword [0x180052eb0]
lea r12d, [r13 + 0x18]
xor edx, edx
mov r8, r12
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov qword [0x180053070], rax
je 0x180013296
lea rcx, [0x180053c20]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180053c10]
lea rcx, [0x180053be0]
mov qword [0x180053c18], r11
mov qword [0x180053c10], r11
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180053bd0]
mov qword [0x180053bd8], r11
mov qword [0x180053bd0], r11
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x180013253
cmp qword [0x180053140], r13
jne 0x180013253
call fcn.18001b1b4
mov qword [0x180053140], rax
mov rdi, r13
mov esi, 3
lea rcx, [0x180051ab0]
mov rcx, qword [rdi + rcx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r11, rax
mov rax, qword [0x180053070]
mov qword [rdi + rax], r11
add rdi, 8
sub rsi, r14
jne 0x18001325b
mov dword [0x18005306c], 3
mov dword [0x180053068], r14d
jmp 0x18001329b
mov ebx, 8
cmp ebx, r13d
jne 0x180013af2
mov ebx, dword [0x180052e00]
mov rcx, qword [0x180052eb0]
mov edi, 0x3c6ef35f
xor edx, edx
imul ebx, ebx, 0x19660d
add ebx, edi
mov dword [0x180052e00], ebx
shr ebx, 1
and ebx, 0xf
add ebx, 4
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov r11, rax
mov qword [0x180053c48], rax
je 0x180013389
cmp ebx, r13d
mov r8d, r13d
jbe 0x18001335f
mov r9d, dword [0x180052e00]
mov rcx, rax
mov r8d, ebx
mov r10d, ebx
imul r9d, r9d, 0x19660d
mov eax, 0x51eb851f
add r9d, edi
mov dword [0x180052e00], r9d
shr r9d, 1
mul r9d
shr edx, 3
imul edx, edx, 0x19
sub r9d, edx
add r9b, 0x41
mov byte [rcx], r9b
mov r9d, dword [0x180052e00]
imul r9d, r9d, 0x19660d
add r9d, edi
test r9b, 2
mov dword [0x180052e00], r9d
je 0x180013357
add byte [rcx], 0x20
mov r9d, dword [0x180052e00]
add rcx, r14
sub r10, r14
jne 0x180013303
mov eax, r8d
lea r9, [0x18001033c]
lea rcx, [0x180052ff0]
lea r8, [0x180010478]
mov edx, 0x70
mov byte [rax + r11], r13b
call fcn.18001dd9c
mov ebx, eax
jmp 0x18001338e
mov ebx, 8
cmp ebx, r13d
jne 0x180013af2
lea rdx, [rsp + 0xe8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov r11d, dword [rsp + 0xe8]
cmp r11d, r13d
je 0x1800133e3
mov rcx, qword [0x180052eb0]
mov r8, r11
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov qword [0x180052f00], rax
je 0x1800133e3
lea rdx, [rsp + 0xe8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [0x180052fe4]
cmp eax, 0x8bdbae2c
je 0x1800134d6
cmp eax, 0x7ee14d23
je 0x1800134d6
cmp eax, 0x25b973e5
je 0x1800134d6
cmp rbp, r13
je 0x180013421
lea rcx, [0x180053148]
mov r8, r12
mov rdx, rbp
call sub.ntdll.dll_memcpy
lea rax, [0x1800107c8]
lea rcx, [0x18005786e]
mov qword [0x180053bb8], r13
mov qword [0x180053bc0], rax
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, r13
mov qword [0x1800530b0], rax
je 0x1800134b8
lea rcx, [0x18005701d]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebp, r13d
lea rsi, [0x180051908]
mov qword [0x1800530b8], rax
mov r8d, dword [rsi]
mov r12, qword [0x1800530b0]
xor r9d, r9d
xor r8d, dword [0x18005308c]
xor edx, edx
mov rcx, r12
mov rdi, r13
call fcn.18001a59c
cmp rax, r13
je 0x18001349b
mov edi, dword [rax]
add rdi, r12
cmp rdi, r13
mov qword [rsi], rdi
je 0x1800134b1
add ebp, r14d
add rsi, 8
cmp ebp, 5
jb 0x180013470
jmp 0x1800134bd
mov ebx, 0x7f
jmp 0x1800134bd
mov ebx, 0x7e
cmp ebx, r13d
jne 0x180013af2
call fcn.18001c3f4
cmp eax, r13d
mov ebx, eax
jne 0x180013af2
cmp qword [0x180052f80], r13
mov qword [rsp + 0x40], r13
jne 0x18001352b
mov eax, dword [0x18005308c]
mov rcx, qword [0x180053090]
lea r8, [rsp + 0x48]
xor eax, 0xa2bcb0b8
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], eax
call fcn.180040d60
mov rcx, qword [0x180052f80]
cmp eax, r13d
cmovne rcx, qword [rsp + 0x50]
mov qword [0x180052f80], rcx
lea rcx, [rsp + 0x40]
call fcn.1800067ac
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
jne 0x180013579
mov eax, dword [0x18005308c]
mov rcx, qword [0x180053090]
lea r8, [rsp + 0x5c]
xor eax, 0x94b64117
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000
mov dword [rsp + 0x20], eax
call fcn.180040d60
cmp eax, r13d
je 0x180013592
mov rcx, qword [rsp + 0x40]
call fcn.180006310
mov r8, qword [rsp + 0x40]
mov rcx, qword [0x180052eb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x180052fe4]
mov ebx, r13d
mov r12d, 0x37688758
cmp eax, 0x25b973e5
je 0x180013735
cmp eax, 0x287fe8d8
je 0x180013657
cmp eax, r12d
je 0x18001364b
mov ecx, 0x4ab631d8
cmp eax, ecx
je 0x180013641
cmp eax, 0x6a07fc86
je 0x18001363b
cmp eax, 0x7ee14d23
je 0x18001360c
cmp eax, 0x8bdbae2c
je 0x180013602
cmp eax, 0x9f68805c
je 0x1800135f1
mov dword [0x180052fe4], r13d
jmp 0x18001374a
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800105fc
jmp 0x18001374a
call fcn.180008040
jmp 0x18001373a
lea rcx, [0x180057836]
mov ebx, 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, r13
je 0x18001373c
lea rdx, [0x1800571e3]
mov rcx, rax
call fcn.180007ce4
jmp 0x18001373a
mov dword [0x180052fe4], ecx
call fcn.18000b710
jmp 0x18001373a
call fcn.1800089f4
mov ebx, eax
jmp 0x18001374a
call qword [sym.imp.USER32.dll_GetShellWindow]
lea rdx, [rsp + 0xf0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [rsp + 0xf0]
cmp edx, r13d
je 0x18001368a
lea rcx, [0x180053148]
call fcn.18001be88
mov ebx, eax
jmp 0x18001368f
mov ebx, 2
cmp ebx, 5
jne 0x18001374a
mov rcx, qword [0x180053078]
lea rax, [rsp + 0x60]
lea r9d, [rbx + 0x2b]
lea r8, [rsp + 0x68]
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwQueryInformationProcess]
mov esi, r13d
mov ecx, 0x1f0fff
cmp eax, r13d
cmovge esi, dword [rsp + 0x90]
xor edx, edx
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, r13
mov rdi, rax
je 0x180013724
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtSuspendProcess]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, r13d
mov ebx, eax
jne 0x180013719
mov ecx, esi
call fcn.18003f6b0
mov rcx, rdi
neg eax
sbb ebx, ebx
not ebx
and ebx, 5
call qword [sym.imp.ntdll.dll_NtResumeProcess]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001372c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.180008db4
mov ebx, eax
cmp ebx, r13d
jne 0x180013af2
call fcn.180006280
cmp ebx, r13d
jne 0x180013af2
call fcn.1800050d4
mov rcx, qword [0x180052eb0]
xor edx, edx
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov rdi, rax
mov qword [0x180052f90], rax
je 0x180013af2
mov dword [rax + 4], r13d
mov dword [rax], r13d
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x28], rax
lea r8, [0x180012d04]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [0x180052f90]
mov r11, rax
mov eax, dword [rdi + 4]
mov qword [rcx + rax*8 + 8], r11
mov eax, dword [rdi + 4]
cmp qword [rcx + rax*8 + 8], r13
je 0x180013af2
add eax, r14d
mov dword [rdi + 4], eax
mov eax, dword [0x180052fe4]
cmp eax, r12d
jne 0x180013a3c
lea r8, [0x180053008]
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea r9, [0x18001ccd8]
lea r8, [0x18001ccc0]
lea rcx, [0x180053190]
mov edx, 0x4a30
call fcn.18001dd9c
cmp eax, r13d
mov ebx, eax
jne 0x180013823
mov rax, qword [0x180053190]
or dword [rax + 0x34], 3
cmp ebx, r13d
jne 0x180013af2
lea rax, [0x18001d9c8]
lea rcx, [0x180053250]
mov qword [0x180053250], rax
lea rax, [0x18001da14]
mov qword [0x180053268], rax
call fcn.18001d648
lea rax, [0x18001dd28]
mov qword [0x1800532a8], rax
lea rax, [0x18001dd4c]
lea r10, [0x18001dcb8]
mov qword [0x180053298], rax
mov qword [0x180053290], r10
mov dword [0x1800532b0], r14d
lea rcx, [0x180053288]
call fcn.18001d648
lea r10, [0x18001d71c]
lea rcx, [0x180053220]
mov qword [0x180053230], r10
mov dword [0x180053248], r14d
call fcn.18001d648
cmp dword [0x18005321b], r13d
mov ebx, r13d
mov dword [0x1800531b4], r13d
je 0x180013928
cmp qword [0x1800531a0], r13
jne 0x180013928
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
cmp rax, r13
mov qword [0x1800531a0], rax
je 0x180013920
lea rax, [0x1800531a8]
lea r9, [0x1800531a0]
lea r8, [0x18001d414]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r13
mov qword [0x1800531ac], rax
jne 0x180013928
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r13d
jne 0x180013af2
test byte [0x180052574], 4
je 0x180013948
mov dword [0x1800530dc], r14d
mov dword [0x180053278], r14d
lea rcx, section..bss
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r13
je 0x180013973
lea r8, [0x180052620]
lea rcx, [0x180052608]
mov r9d, r14d
mov edx, r14d
call fcn.180010534
mov rsi, qword [0x180052f90]
mov rcx, qword [0x180053000]
lea rax, [0x1800530c0]
mov ebp, dword [rsi + 4]
mov qword [rsp + 0x38], rax
mov eax, pe_nt_image_headers64
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], eax
lea r9d, [rax - 1]
mov edx, 0x40000003
mov r8d, 4
mov ebx, r13d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x180013a05
lea rax, [rsp + 0x58]
lea r8, [0x180010ff4]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r13
je 0x1800139f2
mov qword [rsi + rbp*8 + 8], rax
jmp 0x180013a0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180013a0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r13d
jne 0x180013af2
mov rax, qword [0x180052f90]
add dword [rax + 4], r14d
cmp dword [0x180052eec], r13d
je 0x180013a36
lea rcx, [0x180052ee8]
call fcn.180002558
mov eax, dword [0x180052fe4]
cmp eax, r13d
je 0x180013aef
cmp eax, r12d
jne 0x180013aa0
mov rcx, qword [0x180052eb0]
xor edx, edx
lea r8d, [rdx + 0x43]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x180052ff8], rax
mov rax, qword [0x180052ff8]
cmp rax, r13
je 0x180013aa0
movzx r9d, byte [0x180053085]
movzx r8d, byte [0x180053084]
mov rcx, qword [0x180052ff8]
lea rax, [0x180057135]
lea rdx, [0x1800570fe]
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdi, qword [0x180052f90]
lea rax, [rsp + 0xf8]
lea r8, [0x180006e20]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [0x180052f90]
mov r11, rax
mov eax, dword [rdi + 4]
mov qword [rcx + rax*8 + 8], r11
mov eax, dword [rdi + 4]
cmp qword [rcx + rax*8 + 8], r13
je 0x180013af2
add eax, r14d
mov dword [rdi + 4], eax
mov ebx, r13d
mov eax, ebx
add rsp, 0xa0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret