Function at 0x1800560f0
Capabilities:
Check os version
Create pipe
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov r15, r9
mov r12, r8
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x180056129
mov eax, 0xc00000ef
jmp 0x1800567c1
mov r14d, dword [rsp + 0x100]
lea eax, [r14 - 1]
cmp eax, 0xfffffff
ja 0x1800567bc
cmp byte [rsp + 0x110], 0
jne 0x18005616e
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x20], rax
call fcn.1800567e0
jmp 0x1800567c1
mov esi, dword [rsp + 0x108]
lea eax, [rsi - 1]
cmp eax, 0xfe
ja 0x1800567b5
mov eax, edi
and eax, 2
je 0x180056193
cmp esi, 0x10
ja 0x1800567b5
lea r9, [0x18004e220]
xor ecx, ecx
test eax, eax
cmovne r9, rcx
or edx, 8
mov r8d, 0x1600
mov rcx, rbx
call fcn.18004f400
test eax, eax
js 0x1800567c1
mov r8d, edi
mov edx, dword [rsp + 0xf8]
mov rcx, rbx
call fcn.18004ebb0
mov edi, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x1800561e6
mov rcx, rbx
call fcn.18004f4b0
mov eax, edi
jmp 0x1800567c1
mov rax, qword [rsp + 0xf0]
test rax, rax
jne 0x1800561fb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
mov qword [rbx + 0xa0], rax
lea rcx, [rbx + 0x90]
lea rax, [rbx + 0x80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbx + 0x70]
mov r8, qword [rbx + 0xa0]
mov rdx, r15
mov rcx, r12
call fcn.180055af0
mov edi, eax
mov dword [rsp + 0x40], eax
xor r12d, r12d
test eax, eax
js 0x180056588
mov eax, dword [rbx + 0xe0]
add eax, 0x10
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov r9d, esi
mov edx, 0x40080003
lea r8d, [r12 + 6]
mov rcx, qword [rbx + 0x98]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rbx + 0xa8], rax
cmp rax, 0xffffffffffffffff
jne 0x1800562a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbx + 0xa8], r12
movzx edi, ax
or edi, 0xe8f00000
mov dword [rsp + 0x40], edi
jmp 0x180056588
mov byte [rbx + 0xe4], 1
mov rax, qword [rsp + 0x118]
mov qword [rbx + 0x128], rax
mov rax, qword [rsp + 0x120]
mov qword [rbx + 0x130], rax
mov rax, qword [rsp + 0x128]
mov qword [rbx + 0x138], rax
mov dword [rbx + 0x1f4], esi
mov dword [rbx + 0x204], r12d
mov dword [rbx + 0x1f8], r12d
mov dword [rbx + 0xe0], r14d
mov dword [rbx + 0x200], r12d
mov dword [rbx + 0x1fc], r12d
mov eax, dword [rbx + 0x1f4]
lea rcx, [rax + rax*8]
shl rcx, 3
lea rdi, [rbx + 0x280]
xor eax, eax
rep stosb byte [rdi], al
lea rcx, [rbx + 0x100]
mov byte [rsp + 0x20], al
lea r9d, [rax + 1]
xor r8d, r8d
mov edx, 0x1f0003
call qword [0x18009b4d0]
mov edi, eax
test eax, eax
js 0x180056584
mov qword [rbx + 0x120], r12
mov qword [rbx + 0x108], r12
mov dword [rbx + 0x110], r12d
mov qword [rbx + 0x118], r12
mov dword [rbx + 0xf8], r12d
lea eax, [r14 + 0x10]
cmp byte [0x18009b380], r12b
je 0x18005639e
mov ecx, 0xb9b
lea r14, str.ptportpipe.c
mov qword [rsp + 0x28], r14
mov word [rsp + 0x20], cx
xor r9d, r9d
mov r8d, 0x50545250
mov edx, eax
lea rcx, [0x18009cc40]
call fcn.18004b960
jmp 0x1800563b7
mov r8d, eax
xor edx, edx
mov rcx, qword [0x18009ccf0]
call qword [0x18009b430]
lea r14, str.ptportpipe.c
mov qword [rbx + 0xf0], rax
test rax, rax
jne 0x1800563d1
mov edi, 0xc000009a
mov dword [rsp + 0x40], edi
jmp 0x18005658f
lea rcx, [rbx + 0x160]
lea r8, str.ProcessingMsgSrw
xor edx, edx
call fcn.180055750
mov edi, eax
test eax, eax
jns 0x1800563f5
mov dword [rsp + 0x40], eax
jmp 0x18005658f
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x148], rax
test rax, rax
jne 0x18005642b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0xe8f00000
mov dword [rsp + 0x40], edi
jmp 0x18005658f
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x150], rax
test rax, rax
je 0x180056413
xor r9d, r9d
mov edx, 1
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x158], rax
test rax, rax
je 0x180056413
lea rsi, [rbx + 0x170]
test rsi, rsi
jne 0x18005647b
mov edi, 0xc00000f1
jmp 0x1800564c3
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rbx
lea r8, [0x180057ff0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi], rax
test rax, rax
jne 0x1800564b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0xe8f00000
jmp 0x1800564c3
mov eax, dword [rsp + 0x44]
mov qword [rsp + 0x50], rax
mov edi, r12d
mov dword [rsp + 0x40], edi
test edi, edi
js 0x18005658f
mov rax, qword [rbx + 0x150]
mov qword [rsp + 0x58], rax
mov rax, qword [rsi]
mov qword [rsp + 0x60], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
lea rcx, [rsp + 0x58]
call fcn.18005e090
test eax, eax
jne 0x180056508
mov edi, r12d
mov dword [rsp + 0x40], r12d
jmp 0x18005658f
cmp eax, 1
jne 0x18005657c
mov r15, qword [rsi]
test r15, r15
jne 0x18005651c
mov eax, 0xc00000ef
jmp 0x18005657c
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [0x18009b4e8]
mov esi, eax
mov dword [rsp + 0x48], eax
test eax, eax
js 0x180056578
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 5
jne 0x18005654a
mov edi, r12d
mov dword [rsp + 0x40], r12d
jmp 0x180056576
mov qword [rsp + 0x20], r12
mov r9d, 0x30
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, r15
call qword [0x18009b3c8]
mov esi, eax
mov dword [rsp + 0x48], eax
test eax, eax
cmovns edi, dword [rsp + 0x68]
mov dword [rsp + 0x40], edi
mov eax, esi
test esi, esi
jns 0x18005658f
mov edi, eax
mov dword [rsp + 0x40], eax
jmp 0x18005658f
mov dword [rsp + 0x40], eax
lea r14, str.ptportpipe.c
test edi, edi
jns 0x1800567b1
lea rsi, [rbx + 0x78]
cmp qword [rsi], 0
je 0x1800565f5
test rsi, rsi
je 0x1800565eb
mov r8, qword [rsi]
test r8, r8
je 0x1800565eb
cmp byte [0x18009b380], 0
je 0x1800565d9
mov r9d, 0xc07
mov qword [rsp + 0x20], r14
mov r8d, 0x50545250
mov rdx, rsi
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x1800565e8
xor edx, edx
mov rcx, qword [0x18009ccf0]
call qword [0x18009b440]
mov qword [rsi], r12
xor eax, eax
mov qword [rbx + 0x70], rax
mov qword [rbx + 0x78], rax
lea rsi, [rbx + 0x88]
cmp qword [rsi], 0
je 0x18005665c
test rsi, rsi
je 0x18005664c
mov r8, qword [rsi]
test r8, r8
je 0x18005664c
cmp byte [0x18009b380], 0
je 0x18005663a
mov r9d, 0xc0c
mov qword [rsp + 0x20], r14
mov r8d, 0x50545250
mov rdx, rsi
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x180056649
xor edx, edx
mov rcx, qword [0x18009ccf0]
call qword [0x18009b440]
mov qword [rsi], r12
xor eax, eax
mov qword [rbx + 0x80], rax
mov qword [rbx + 0x88], rax
lea rsi, [rbx + 0x98]
cmp qword [rsi], 0
je 0x1800566c3
test rsi, rsi
je 0x1800566b3
mov r8, qword [rsi]
test r8, r8
je 0x1800566b3
cmp byte [0x18009b380], 0
je 0x1800566a1
mov r9d, 0xc11
mov qword [rsp + 0x20], r14
mov r8d, 0x50545250
mov rdx, rsi
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x1800566b0
xor edx, edx
mov rcx, qword [0x18009ccf0]
call qword [0x18009b440]
mov qword [rsi], r12
xor eax, eax
mov qword [rbx + 0x90], rax
mov qword [rbx + 0x98], rax
lea rsi, [rbx + 0xf0]
cmp qword [rsi], 0
je 0x18005671a
test rsi, rsi
je 0x18005671a
mov r8, qword [rsi]
test r8, r8
je 0x18005671a
cmp byte [0x18009b380], 0
je 0x180056708
mov r9d, 0xc18
mov qword [rsp + 0x20], r14
mov r8d, 0x50545250
mov rdx, rsi
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x180056717
xor edx, edx
mov rcx, qword [0x18009ccf0]
call qword [0x18009b440]
mov qword [rsi], r12
mov rcx, qword [rbx + 0xa8]
test rcx, rcx
je 0x180056733
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xa8], r12
lea rcx, [rbx + 0x160]
cmp qword [rcx], 0
je 0x180056745
call fcn.180055a50
mov rcx, qword [rbx + 0x148]
test rcx, rcx
je 0x18005675e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x148], r12
mov rcx, qword [rbx + 0x150]
test rcx, rcx
je 0x180056777
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x150], r12
mov rcx, qword [rbx + 0x158]
test rcx, rcx
je 0x180056790
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x158], r12
mov rcx, qword [rbx + 0x100]
test rcx, rcx
je 0x1800567a9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x100], r12
mov rcx, rbx
call fcn.18004f050
mov eax, edi
jmp 0x1800567c1
mov eax, 0xc00000f6
jmp 0x1800567c1
mov eax, 0xc00000f5
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret