Function at 0x180011b14
Capabilities:
Check mutex on windows
Check os version
Create pipe
Create thread
Get explorer pid
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rbp, rcx
lea rcx, [0x18003a090]
xor r14d, r14d
mov dword [rax + 0x10], r14d
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x180039b48]
lea r11, [0x18003a080]
mov dword [0x18003a0bc], r14d
mov ebx, 0xa0
mov qword [0x18003a088], r11
mov qword [0x18003a080], r11
mov r8, rbx
xor edx, edx
mov dword [0x18003a0b8], r14d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r12d, [r14 + 8]
lea r15d, [r14 + 1]
mov qword [0x180039fb0], rax
cmp rax, r14
je 0x180011bee
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov rcx, qword [0x180039fb0]
add rcx, 0x70
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x18003d270]
xor edx, edx
call fcn.18001855c
mov rcx, qword [0x180039fb0]
mov ebx, r14d
mov qword [rcx + 0x40], rax
lea rax, [0x180038670]
mov dword [rcx + 0x48], 0x4eb7d2ca
mov qword [rcx + 0x50], rax
lea rax, [0x18003e153]
mov dword [rcx + 0x60], r15d
mov qword [rcx], rax
jmp 0x180011bf1
mov ebx, r12d
cmp ebx, r14d
jne 0x1800125ff
mov r8, qword [0x180039cb0]
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x180039cb8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x180039cb8]
cmp rcx, r14
je 0x180011c41
cmp eax, 0xb7
jne 0x180011c3e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x180039cb8], r14
jmp 0x1800125fc
mov eax, r14d
cmp eax, r14d
jne 0x1800125fc
mov rcx, qword [0x180039b48]
xor edx, edx
mov ebx, r14d
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13d, 3
mov qword [0x180039cd8], rax
cmp rax, r14
je 0x180011d1a
lea rcx, [0x18003a040]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x18003a030]
lea rcx, [0x18003a000]
mov qword [0x18003a038], r11
mov qword [0x18003a030], r11
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180039fe0]
mov qword [0x180039fe8], r11
mov qword [0x180039fe0], r11
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x180011cd9
cmp qword [0x180039da8], r14
jne 0x180011cd9
call fcn.180019e7c
mov qword [0x180039da8], rax
mov dword [0x180039cd4], r15d
mov rdi, r14
mov rsi, r13
lea rcx, [0x1800386a0]
mov rcx, qword [rdi + rcx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [0x180039cd8]
mov qword [rdi + rcx], rax
add rdi, r12
sub rsi, r15
jne 0x180011ce6
mov dword [0x180039ce0], r13d
mov dword [0x180039cd0], r15d
jmp 0x180011d1d
mov ebx, r12d
cmp ebx, r14d
jne 0x1800125ff
mov ebx, dword [0x180039b20]
mov rcx, qword [0x180039b48]
mov edi, 0x3c6ef35f
xor edx, edx
imul ebx, ebx, 0x19660d
add ebx, edi
mov dword [0x180039b20], ebx
shr ebx, 1
and ebx, 0xf
add ebx, 4
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r11, rax
mov qword [0x18003a068], rax
cmp rax, r14
je 0x180011e0b
mov r8d, r14d
cmp ebx, r14d
jbe 0x180011de1
mov r9d, dword [0x180039b20]
mov rcx, rax
mov r8d, ebx
mov r10d, ebx
imul r9d, r9d, 0x19660d
mov eax, 0x51eb851f
add r9d, edi
mov dword [0x180039b20], r9d
shr r9d, 1
mul r9d
shr edx, 3
imul edx, edx, 0x19
sub r9d, edx
add r9b, 0x41
mov byte [rcx], r9b
mov r9d, dword [0x180039b20]
imul r9d, r9d, 0x19660d
add r9d, edi
mov dword [0x180039b20], r9d
test r9b, 2
je 0x180011dd9
add byte [rcx], 0x20
mov r9d, dword [0x180039b20]
add rcx, r15
sub r10, r15
jne 0x180011d85
mov eax, r8d
lea r9, [0x18000ec98]
lea rcx, [0x180039c60]
lea r8, [0x18000edd4]
mov edx, 0x70
mov byte [rax + r11], r14b
call fcn.18001fe60
mov ebx, eax
jmp 0x180011e0e
mov ebx, r12d
cmp ebx, r14d
jne 0x1800125ff
lea rdx, [rsp + 0xf8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov r11d, dword [rsp + 0xf8]
cmp r11d, r14d
je 0x180011e63
mov rcx, qword [0x180039b48]
mov r8, r11
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x180039b88], rax
cmp rax, r14
je 0x180011e63
lea rdx, [rsp + 0xf8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor edx, edx
xor ecx, ecx
call fcn.180018fb8
mov ecx, r14d
mov edi, 0x1545f149
cmp eax, 0x57
mov eax, dword [0x180039c68]
mov esi, 0x5afb7e2a
sete cl
mov r12d, 0x4e1dcf8f
mov r13d, 0xbb272c80
add ecx, r15d
mov dword [0x18003a070], ecx
cmp eax, 0x7a4ab374
je 0x180011ea5
cmp eax, esi
jne 0x180011f09
mov rcx, qword [0x180039ce8]
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x80]
mov r9d, 0x30
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwQueryInformationProcess]
mov r8d, r14d
mov ecx, 0x400
cmp eax, r14d
cmovge r8d, dword [rsp + 0xa8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, r14
jne 0x180011efa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x180011f37
jmp 0x180011f03
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x180039c68]
cmp eax, r13d
je 0x180011f37
cmp eax, r12d
je 0x180011f37
cmp eax, edi
je 0x180011f37
lea r9, [0x18000f134]
xor r8d, r8d
mov edx, r15d
mov rcx, rbp
call fcn.18001e1a8
mov ebx, eax
cmp eax, r14d
jne 0x1800125ff
mov qword [rsp + 0x40], r14
cmp qword [0x180039dc8], r14
jne 0x180011fb5
mov eax, dword [0x180039d14]
mov rcx, qword [0x180039cf8]
lea r8, [rsp + 0x108]
xor eax, 0x92403214
lea rdx, [rsp + 0x58]
xor r9d, r9d
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], eax
call fcn.180019ce8
cmp eax, r14d
je 0x180011fb5
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r11, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov edx, dword [rsp + 0x108]
mov r8d, r11d
mov rcx, rbx
xor r9d, r9d
mov dword [0x180039d54], r11d
call fcn.18002b210
mov qword [0x180039dc8], rbx
lea rcx, [rsp + 0x40]
call fcn.1800064f0
mov rbx, qword [rsp + 0x40]
cmp rbx, r14
jne 0x180012003
mov eax, dword [0x180039d14]
mov rcx, qword [0x180039cf8]
lea r8, [rsp + 0x70]
xor eax, 0xa44ac3bb
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000
mov dword [rsp + 0x20], eax
call fcn.180019ce8
cmp eax, r14d
je 0x18001201d
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.180005e18
mov rcx, qword [0x180039b48]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x180039c68]
mov ebx, r14d
cmp eax, 0x79405f4
je 0x1800120f8
cmp eax, edi
je 0x1800120e1
cmp eax, 0x18836a74
je 0x1800120af
cmp eax, r12d
je 0x180012087
cmp eax, esi
je 0x180012080
cmp eax, 0x7a4ab374
je 0x180012080
cmp eax, 0xaf9402f0
je 0x18001206f
cmp eax, r13d
je 0x180012068
mov dword [0x180039c68], r14d
jmp 0x180012133
call fcn.1800082d4
jmp 0x1800120e6
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18000ef64
jmp 0x180012133
call fcn.18000a83c
jmp 0x1800120e6
lea rcx, [0x18003d726]
mov ebx, 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, r14
je 0x1800120e8
lea rdx, [0x18003d1f2]
mov rcx, rax
call fcn.1800080cc
jmp 0x1800120e6
call qword [sym.imp.USER32.dll_GetShellWindow]
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [rsp + 0x48]
cmp edx, r14d
je 0x1800120da
lea rcx, [0x180039de0]
call fcn.18001dab8
jmp 0x180012131
mov ebx, 2
jmp 0x180012133
call fcn.1800090f8
mov ebx, eax
cmp ebx, r14d
jne 0x1800125ff
call fcn.180005d88
jmp 0x180012133
lea rax, [rsp + 0x74]
lea r8, [0x180008d14]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r14
je 0x18001212b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180012133
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
jne 0x1800125ff
call fcn.18000511c
mov rcx, qword [0x180039b48]
xor edx, edx
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov qword [0x180039c00], rax
cmp rax, r14
je 0x1800125ff
mov dword [rax + 4], r14d
mov dword [rax], r14d
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea r8, [0x18001171c]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [0x180039c00]
mov ecx, dword [rdi + 4]
mov qword [rdx + rcx*8 + 8], rax
mov eax, dword [rdi + 4]
cmp qword [rdx + rax*8 + 8], r14
je 0x1800125ff
inc eax
cmp dword [0x180039c68], 0x79405f4
mov dword [rdi + 4], eax
jne 0x18001245f
lea r8, [0x180039c78]
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea r9, [0x18001e60c]
lea r8, [0x18001e5f4]
lea rcx, [0x180039e28]
mov edx, 0x4a30
call fcn.18001fe60
mov ebx, eax
cmp eax, r14d
jne 0x180012206
mov rax, qword [0x180039e28]
or dword [rax + 0x34], 3
cmp ebx, r14d
jne 0x1800125ff
lea rax, [0x18001f62c]
lea rcx, [0x180039ea8]
mov qword [0x180039ea8], rax
lea rax, [0x18001f678]
mov qword [0x180039ec0], rax
call fcn.18001fa34
lea rax, [0x18001f3c8]
mov qword [0x180039e60], rax
lea rax, [0x18001f2e8]
lea r10, [0x18001f394]
lea rcx, [0x180039e40]
mov qword [0x180039e50], rax
mov qword [0x180039e48], r10
call fcn.18001fa34
lea rax, [0x18001fdec]
lea r10, [0x18001fd7c]
mov qword [0x180039f88], rax
lea rax, [0x18001fe10]
mov qword [0x180039f70], r10
mov qword [0x180039f78], rax
mov dword [0x180039f90], r15d
lea rcx, [0x180039f68]
call fcn.18001fa34
lea r10, [0x18001f3ec]
lea rcx, [0x180039e78]
mov qword [0x180039e88], r10
mov dword [0x180039ea0], r15d
call fcn.18001fa34
mov ebx, r14d
mov dword [0x180039ef8], r14d
cmp dword [0x180039f60], r14d
je 0x180012341
cmp qword [0x180039ee0], r14
jne 0x180012341
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x180039ee0], rax
cmp rax, r14
je 0x180012339
lea rax, [0x180039ee8]
lea r9, [0x180039ee0]
lea r8, [0x18001f7ec]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180039ef0], rax
cmp rax, r14
jne 0x180012341
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
jne 0x1800125ff
test byte [0x180038644], 4
je 0x180012368
mov dword [0x180039e38], r15d
mov dword [0x180039ed0], r15d
mov dword [0x180039e68], r15d
lea rcx, section..bss
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r14
je 0x180012393
lea r8, [0x1800391b0]
lea rcx, [0x180039198]
mov r9d, r15d
mov edx, r15d
call fcn.18000ee9c
mov rsi, qword [0x180039c00]
mov rcx, qword [0x180039c70]
lea rax, [0x180039d38]
mov ebp, dword [rsi + 4]
mov qword [rsp + 0x38], rax
mov eax, 0x100
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], eax
lea r9d, [rax - 1]
mov edx, 0x40000003
mov r8d, 4
mov ebx, r14d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180012425
lea rax, [rsp + 0x60]
lea r8, [0x18000f978]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r14
je 0x180012412
mov qword [rsi + rbp*8 + 8], rax
jmp 0x18001242d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001242d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
jne 0x1800125ff
mov rax, qword [0x180039c00]
add dword [rax + 4], r15d
cmp dword [0x180039b7c], r14d
je 0x180012553
lea rcx, [0x180039b78]
call fcn.180002458
jmp 0x180012553
cmp qword [0x180039d00], r14
je 0x180012553
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0x68]
lea rcx, [0x18003d1d3]
call fcn.180004e24
cmp eax, r14d
jne 0x180012553
cmp dword [rsp + 0x100], 4
jbe 0x180012553
mov rcx, qword [0x180039d00]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov rbp, qword [rsp + 0x68]
mov r8d, dword [0x180039d10]
mov edx, dword [rsp + 0x100]
mov rcx, rbp
xor r9d, r9d
mov r13, rax
call fcn.18002b25c
mov r11d, dword [rsp + 0x100]
mov rcx, r13
lea r12, [rbp + 4]
mov byte [r11 + rbp - 1], r14b
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
mov rsi, rax
cmp rax, r14
je 0x1800124ef
mov byte [rax], r14b
mov edx, 0x20
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrChrA]
mov rdi, rax
cmp rax, r14
je 0x18001250b
mov byte [rax], r14b
add rdi, r15
mov rdx, r13
mov rcx, r12
call fcn.180019a5c
cmp eax, r14d
jne 0x180012525
mov r12, rdi
cmp rdi, r14
je 0x180012539
jmp 0x1800124ef
xor r9d, r9d
mov rdx, rbp
mov ecx, 0x125
lea r8d, [r9 + 4]
call fcn.18000fc1c
cmp rsi, r14
je 0x180012541
mov byte [rsi], 0x2e
mov rcx, qword [0x180039b48]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x180039c68]
cmp eax, r14d
je 0x1800125fc
cmp eax, 0x79405f4
jne 0x1800125b4
mov rcx, qword [0x180039b48]
xor edx, edx
lea r8d, [rdx + 0x43]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x180039db0], rax
cmp rax, r14
je 0x1800125b4
movzx r9d, byte [0x180039cf1]
movzx r8d, byte [0x180039cf0]
lea rcx, [0x18003d155]
mov qword [rsp + 0x20], rcx
lea rdx, [0x18003d11e]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdi, qword [0x180039c00]
lea rax, [rsp + 0x4c]
lea r8, [0x180006c4c]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [0x180039c00]
mov ecx, dword [rdi + 4]
mov qword [rdx + rcx*8 + 8], rax
mov eax, dword [rdi + 4]
cmp qword [rdx + rax*8 + 8], r14
je 0x1800125ff
inc eax
mov dword [rdi + 4], eax
mov ebx, r14d
mov eax, ebx
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret