Function at 0x1800113c8
Capabilities:
Check mutex on windows
Check os version
Create pipe
Create thread
Get explorer pid
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rbp, rcx
lea rcx, [0x180030bf0]
xor r14d, r14d
mov dword [rax + 0x10], r14d
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x1800307d8]
lea r11, [0x180030be0]
mov dword [0x180030c1c], r14d
mov ebx, 0xa0
mov qword [0x180030be8], r11
mov qword [0x180030be0], r11
mov r8, rbx
xor edx, edx
mov dword [0x180030c18], r14d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r12d, [r14 + 8]
cmp rax, r14
mov qword [0x180030b00], rax
je 0x180011476
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov rcx, qword [0x180030b00]
add rcx, 0x70
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [0x180030b00]
lea r11, [0x1800341d3]
mov qword [rax], r11
mov ebx, r14d
jmp 0x180011479
mov ebx, r12d
cmp ebx, r14d
jne 0x180011d94
mov r8, qword [0x180030940]
mov r15d, 1
xor ecx, ecx
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x180030948], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x180030948]
cmp rcx, r14
je 0x1800114cf
cmp eax, 0xb7
jne 0x1800114cc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x180030948], r14
jmp 0x180011d91
mov eax, r14d
cmp eax, r14d
jne 0x180011d91
mov rcx, qword [0x1800307d8]
xor edx, edx
mov ebx, r14d
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r14
mov qword [0x1800309a8], rax
je 0x1800115a8
lea rcx, [0x180030ba0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180030b90]
lea rcx, [0x180030b60]
mov qword [0x180030b98], r11
mov qword [0x180030b90], r11
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x180030b40]
mov qword [0x180030b48], r11
mov qword [0x180030b40], r11
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x180011561
cmp qword [0x180030a68], r14
jne 0x180011561
call fcn.180018f98
mov qword [0x180030a68], rax
mov r13d, 3
mov dword [0x1800309a0], r15d
mov rdi, r14
mov rsi, r13
lea rcx, [0x18002f608]
mov rcx, qword [rdi + rcx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [0x1800309a8]
mov qword [rdi + rcx], rax
add rdi, r12
sub rsi, r15
jne 0x180011574
mov dword [0x1800309a4], r13d
mov dword [0x18003095c], r15d
jmp 0x1800115ab
mov ebx, r12d
cmp ebx, r14d
jne 0x180011d94
mov ebx, dword [0x1800307b0]
mov rcx, qword [0x1800307d8]
mov edi, 0x3c6ef35f
xor edx, edx
imul ebx, ebx, 0x19660d
add ebx, edi
mov dword [0x1800307b0], ebx
shr ebx, 1
and ebx, 0xf
add ebx, 4
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r14
mov r11, rax
mov qword [0x180030bc8], rax
je 0x180011706
cmp ebx, r14d
mov r8d, r14d
jbe 0x18001166f
mov r9d, dword [0x1800307b0]
mov rcx, rax
mov r8d, ebx
mov r10d, ebx
imul r9d, r9d, 0x19660d
mov eax, 0x51eb851f
add r9d, edi
mov dword [0x1800307b0], r9d
shr r9d, 1
mul r9d
shr edx, 3
imul edx, edx, 0x19
sub r9d, edx
add r9b, 0x41
mov byte [rcx], r9b
mov r9d, dword [0x1800307b0]
imul r9d, r9d, 0x19660d
add r9d, edi
test r9b, 2
mov dword [0x1800307b0], r9d
je 0x180011667
add byte [rcx], 0x20
mov r9d, dword [0x1800307b0]
add rcx, r15
sub r10, r15
jne 0x180011613
mov rcx, qword [0x1800307d8]
mov eax, r8d
xor edx, edx
mov r8d, 0x1058
mov ebx, r14d
mov byte [rax + r11], r14b
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r14
mov rdi, rax
je 0x1800116fc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [rdi + 0x48]
lea rax, [rdi + 0x58]
mov qword [rdi + 0x50], r11
mov rcx, rax
mov edx, 0x100
mov qword [r11], r11
mov qword [rax + 8], rcx
mov qword [rax], rcx
add rcx, 0x10
add rax, 0x10
sub rdx, r15
jne 0x1800116b6
lea rax, [0x18000e91c]
mov dword [rdi + 0x34], r14d
mov dword [rdi + 0x2c], r14d
mov qword [rdi + 0x38], rax
lea rax, [0x18000e840]
mov dword [rdi + 0x28], r14d
mov qword [rdi + 0x40], rax
mov dword [rdi + 0x30], 0x70
mov qword [0x1800308f0], rdi
jmp 0x180011709
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180011709
mov ebx, r12d
cmp ebx, r14d
jne 0x180011d94
lea rdx, [rsp + 0xf8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov r11d, dword [rsp + 0xf8]
cmp r11d, r14d
je 0x18001175e
mov rcx, qword [0x1800307d8]
mov r8, r11
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r14
mov qword [0x180030818], rax
je 0x18001175e
lea rdx, [rsp + 0xf8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [0x1800308f8]
mov dword [0x180030bd0], r15d
mov edi, 0x1545f149
cmp eax, 0x7a4ab374
mov esi, 0x5afb7e2a
mov r12d, 0x4e1dcf8f
mov r13d, 0xbb272c80
je 0x18001178c
cmp eax, esi
jne 0x1800117f0
mov rcx, qword [0x1800309c8]
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x80]
mov r9d, 0x30
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwQueryInformationProcess]
mov r8d, r14d
mov ecx, 0x400
cmp eax, r14d
cmovge r8d, dword [rsp + 0xa8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, r14
jne 0x1800117e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x18001181e
jmp 0x1800117ea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1800308f8]
cmp eax, r13d
je 0x18001181e
cmp eax, r12d
je 0x18001181e
cmp eax, edi
je 0x18001181e
lea r9, [0x18000ec7c]
xor r8d, r8d
mov edx, r15d
mov rcx, rbp
call fcn.18001ce04
cmp eax, r14d
mov ebx, eax
jne 0x180011d94
cmp qword [0x180030a88], r14
mov qword [rsp + 0x40], r14
jne 0x18001189c
mov eax, dword [0x1800309f8]
mov rcx, qword [0x1800309e0]
lea r8, [rsp + 0x108]
xor eax, 0x92403214
lea rdx, [rsp + 0x58]
xor r9d, r9d
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], eax
call fcn.180018e04
cmp eax, r14d
je 0x18001189c
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r11, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov edx, dword [rsp + 0x108]
mov r8d, r11d
mov rcx, rbx
xor r9d, r9d
mov dword [0x180030a90], r11d
call fcn.180023e40
mov qword [0x180030a88], rbx
lea rcx, [rsp + 0x40]
call fcn.18000602c
mov rbx, qword [rsp + 0x40]
cmp rbx, r14
jne 0x1800118ea
mov eax, dword [0x1800309f8]
mov rcx, qword [0x1800309e0]
lea r8, [rsp + 0x70]
xor eax, 0xa44ac3bb
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000
mov dword [rsp + 0x20], eax
call fcn.180018e04
cmp eax, r14d
je 0x180011904
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.180005a7c
mov rcx, qword [0x1800307d8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x1800308f8]
mov ebx, r14d
cmp eax, 0x79405f4
je 0x1800119df
cmp eax, edi
je 0x1800119c8
cmp eax, 0x18836a74
je 0x180011996
cmp eax, r12d
je 0x18001196e
cmp eax, esi
je 0x180011967
cmp eax, 0x7a4ab374
je 0x180011967
cmp eax, 0xaf9402f0
je 0x180011956
cmp eax, r13d
je 0x18001194f
mov dword [0x1800308f8], r14d
jmp 0x180011a1a
call fcn.180007e10
jmp 0x1800119cd
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18000eaac
jmp 0x180011a1a
call fcn.18000a4e4
jmp 0x1800119cd
lea rcx, [0x180033886]
mov ebx, 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, r14
je 0x1800119cf
lea rdx, [0x180033209]
mov rcx, rax
call fcn.180007c08
jmp 0x1800119cd
call qword [sym.imp.USER32.dll_GetShellWindow]
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [rsp + 0x48]
cmp edx, r14d
je 0x1800119c1
lea rcx, [0x180030aa8]
call fcn.18001c714
jmp 0x180011a18
mov ebx, 2
jmp 0x180011a1a
call fcn.180008c28
mov ebx, eax
cmp ebx, r14d
jne 0x180011d94
call fcn.1800059ec
jmp 0x180011a1a
lea rax, [rsp + 0x74]
lea r8, [0x180008850]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r14
je 0x180011a12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180011a1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
jne 0x180011d94
call fcn.180004d88
mov rcx, qword [0x1800307d8]
xor edx, edx
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r14
mov rdi, rax
mov qword [0x180030890], rax
je 0x180011d94
mov dword [rax + 4], r14d
mov dword [rax], r14d
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea r8, [0x180010fd0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [0x180030890]
mov ecx, dword [rdi + 4]
mov qword [rdx + rcx*8 + 8], rax
mov eax, dword [rdi + 4]
cmp qword [rdx + rax*8 + 8], r14
je 0x180011d94
add eax, r15d
cmp dword [0x1800308f8], 0x79405f4
mov dword [rdi + 4], eax
jne 0x180011bf4
lea r8, [0x180030908]
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea r11, [0x180030968]
lea r9, [0x180030960]
mov qword [rsp + 0x28], r11
lea r8, [0x180012c20]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r14
mov qword [0x180030960], rax
jne 0x180011af8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, section..bss
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r14
je 0x180011b23
lea r8, [0x1800300e8]
lea rcx, [0x1800300d0]
mov r9d, r15d
mov edx, r15d
call fcn.18000e9e4
mov rsi, qword [0x180030890]
mov rcx, qword [0x180030900]
lea rax, [0x180030a00]
mov ebp, dword [rsi + 4]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r14d
mov edx, 0x40000003
mov r9d, 0xff
mov r8d, 4
mov dword [rsp + 0x28], 0x100
mov ebx, r14d
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x180011bba
lea rax, [rsp + 0x60]
lea r8, [0x18000f2f0]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r14
je 0x180011ba7
mov qword [rsi + rbp*8 + 8], rax
jmp 0x180011bc2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180011bc2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r14d
jne 0x180011d94
mov rax, qword [0x180030890]
add dword [rax + 4], r15d
cmp dword [0x18003080c], r14d
je 0x180011ce7
lea rcx, [0x180030808]
call fcn.180002454
jmp 0x180011ce7
cmp qword [0x1800309e8], r14
je 0x180011ce7
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0x68]
lea rcx, [0x1800331ea]
call fcn.180004c0c
cmp eax, r14d
jne 0x180011ce7
cmp dword [rsp + 0x100], 4
jbe 0x180011ce7
mov rcx, qword [0x1800309e8]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov rbp, qword [rsp + 0x68]
mov r8d, dword [0x1800309dc]
mov edx, dword [rsp + 0x100]
mov rcx, rbp
xor r9d, r9d
mov r13, rax
call fcn.180023e84
mov r11d, dword [rsp + 0x100]
mov rcx, r13
lea r12, [rbp + 4]
mov byte [r11 + rbp - 1], r14b
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
cmp rax, r14
mov rsi, rax
je 0x180011c84
mov byte [rax], r14b
mov dx, 0x20
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrChrA]
cmp rax, r14
mov rdi, rax
je 0x180011c9f
mov byte [rax], r14b
add rdi, r15
mov rdx, r13
mov rcx, r12
call fcn.180018b64
cmp eax, r14d
jne 0x180011cb9
cmp rdi, r14
mov r12, rdi
je 0x180011ccd
jmp 0x180011c84
xor r9d, r9d
mov rdx, rbp
mov ecx, 0x125
lea r8d, [r9 + 4]
call fcn.18000f594
cmp rsi, r14
je 0x180011cd5
mov byte [rsi], 0x2e
mov rcx, qword [0x1800307d8]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x1800308f8]
cmp eax, r14d
je 0x180011d91
cmp eax, 0x79405f4
jne 0x180011d48
mov rcx, qword [0x1800307d8]
xor edx, edx
lea r8d, [rdx + 0x51]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r14
mov qword [0x180030a70], rax
je 0x180011d48
movzx r9d, byte [0x1800309d5]
movzx r8d, byte [0x1800309d4]
lea rcx, [0x180033168]
mov qword [rsp + 0x20], rcx
lea rdx, [0x18003311e]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdi, qword [0x180030890]
lea rax, [rsp + 0x4c]
lea r8, [0x180006760]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [0x180030890]
mov ecx, dword [rdi + 4]
mov qword [rdx + rcx*8 + 8], rax
mov eax, dword [rdi + 4]
cmp qword [rdx + rax*8 + 8], r14
je 0x180011d94
add eax, r15d
mov dword [rdi + 4], eax
mov ebx, r14d
mov eax, ebx
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret