Function at 0x18001120c
Capabilities:
Allocate thread local storage
Check mutex on windows
Check os version
Create pipe
Create thread
Get explorer pid
Get session user name

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov rbp, rcx
lea rcx, [0x18002fbb0]
xor r13d, r13d
mov dword [rax + 0x10], r13d
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x18002f7f8]
lea r11, [0x18002fba0]
mov dword [0x18002fbdc], r13d
lea ebx, [r13 + 0x6e]
mov qword [0x18002fba8], r11
mov qword [0x18002fba0], r11
mov r8, rbx
xor edx, edx
mov dword [0x18002fbd8], r13d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov qword [0x18002faf8], rax
je 0x1800112ad
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov rcx, qword [0x18002faf8]
add rcx, 0x42
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [0x18002faf8]
lea r11, [0x1800331e0]
mov qword [rax], r11
mov ebx, r13d
jmp 0x1800112b2
mov ebx, 8
cmp ebx, r13d
jne 0x180011b6d
mov r8, qword [0x18002f958]
mov r14d, 1
xor ecx, ecx
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp rax, r13
mov qword [0x18002f960], rax
je 0x180011b6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180011b6a
mov rcx, qword [0x18002f7f8]
lea r8d, [r14 + 0x17]
xor edx, edx
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov qword [0x18002fa08], rax
je 0x1800113be
lea rcx, [0x18002fb60]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x18002fb50]
lea rcx, [0x18002fb20]
mov qword [0x18002fb58], r11
mov qword [0x18002fb50], r11
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [0x18002fb00]
mov qword [0x18002fb08], r11
mov qword [0x18002fb00], r11
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x18001137d
cmp qword [0x18002fac8], r13
jne 0x18001137d
call fcn.180018060
mov qword [0x18002fac8], rax
mov r12d, 3
mov rdi, r13
mov rsi, r12
lea rcx, [0x18002e1a8]
mov rcx, qword [rdi + rcx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [0x18002fa08]
mov qword [rdi + rcx], rax
add rdi, 8
sub rsi, r14
jne 0x180011389
mov dword [0x18002fa04], r12d
mov dword [0x18002fa00], r14d
jmp 0x1800113c3
mov ebx, 8
cmp ebx, r13d
jne 0x180011b6d
mov ebx, dword [0x18002f7d0]
mov rcx, qword [0x18002f7f8]
mov edi, 0x3c6ef35f
xor edx, edx
imul ebx, ebx, 0x19660d
add ebx, edi
mov dword [0x18002f7d0], ebx
shr ebx, 1
and ebx, 0xf
add ebx, 4
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov r11, rax
mov qword [0x18002fb98], rax
je 0x18001151e
cmp ebx, r13d
mov r8d, r13d
jbe 0x180011487
mov r9d, dword [0x18002f7d0]
mov rcx, rax
mov r8d, ebx
mov r10d, ebx
imul r9d, r9d, 0x19660d
mov eax, 0x51eb851f
add r9d, edi
mov dword [0x18002f7d0], r9d
shr r9d, 1
mul r9d
shr edx, 3
imul edx, edx, 0x19
sub r9d, edx
add r9b, 0x41
mov byte [rcx], r9b
mov r9d, dword [0x18002f7d0]
imul r9d, r9d, 0x19660d
add r9d, edi
test r9b, 2
mov dword [0x18002f7d0], r9d
je 0x18001147f
add byte [rcx], 0x20
mov r9d, dword [0x18002f7d0]
add rcx, r14
sub r10, r14
jne 0x18001142b
mov rcx, qword [0x18002f7f8]
mov eax, r8d
xor edx, edx
mov r8d, 0x1058
mov ebx, r13d
mov byte [rax + r11], r13b
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov rdi, rax
je 0x180011514
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r11, [rdi + 0x48]
lea rax, [rdi + 0x58]
mov qword [rdi + 0x50], r11
mov rcx, rax
mov edx, 0x100
mov qword [r11], r11
mov qword [rax + 8], rcx
mov qword [rax], rcx
add rcx, 0x10
add rax, 0x10
sub rdx, r14
jne 0x1800114ce
lea rax, [0x18000e80c]
mov dword [rdi + 0x34], r13d
mov dword [rdi + 0x2c], r13d
mov qword [rdi + 0x38], rax
lea rax, [0x18000e730]
mov dword [rdi + 0x28], r13d
mov qword [rdi + 0x40], rax
mov dword [rdi + 0x30], 0x70
mov qword [0x18002f910], rdi
jmp 0x180011523
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180011523
mov ebx, 8
cmp ebx, r13d
jne 0x180011b6d
lea rdx, [rsp + 0xa8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov r11d, dword [rsp + 0xa8]
cmp r11d, r13d
je 0x180011578
mov rcx, qword [0x18002f7f8]
mov r8, r11
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov qword [0x18002f840], rax
je 0x180011578
lea rdx, [rsp + 0xa8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [0x18002f90c]
cmp eax, 0x50949b49
je 0x18001166e
cmp eax, 0xa5ae7846
je 0x18001166e
cmp eax, 0xfef64680
je 0x18001166e
cmp rbp, r13
je 0x1800115b9
lea rcx, [0x18002f9b0]
mov r8d, 0x18
mov rdx, rbp
call sub.ntdll.dll_memcpy
lea rax, [0x18000eb58]
lea rcx, [0x180032906]
mov qword [0x18002fb88], r13
mov qword [0x18002fb90], rax
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, r13
mov qword [0x18002fa48], rax
je 0x180011650
lea rcx, [0x18003201d]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebp, r13d
lea rsi, [0x18002e180]
mov qword [0x18002fa50], rax
mov r8d, dword [0x18002fa58]
mov r12, qword [0x18002fa48]
xor r9d, r9d
xor r8d, dword [rsi]
xor edx, edx
mov rcx, r12
mov rdi, r13
call fcn.180017710
cmp rax, r13
je 0x180011633
mov edi, dword [rax]
add rdi, r12
cmp rdi, r13
mov qword [rsi], rdi
je 0x180011649
add ebp, r14d
add rsi, 8
cmp ebp, 5
jb 0x180011608
jmp 0x180011655
mov ebx, 0x7f
jmp 0x180011655
mov ebx, 0x7e
cmp ebx, r13d
jne 0x180011b6d
call fcn.180013bac
cmp eax, r13d
mov ebx, eax
jne 0x180011b6d
cmp qword [0x18002fae8], r13
mov qword [rsp + 0x50], r13
jne 0x1800116c3
mov eax, dword [0x18002fa58]
mov rcx, qword [0x18002fa28]
lea r8, [rsp + 0x40]
xor eax, 0x79f385dd
lea rdx, [rsp + 0x58]
xor r9d, r9d
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], eax
call fcn.1800224c0
mov rcx, qword [0x18002fae8]
cmp eax, r13d
cmovne rcx, qword [rsp + 0x58]
mov qword [0x18002fae8], rcx
lea rcx, [rsp + 0x50]
call fcn.180005968
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
jne 0x180011711
mov eax, dword [0x18002fa58]
mov rcx, qword [0x18002fa28]
lea r8, [rsp + 0x44]
xor eax, 0x4ff97472
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000
mov dword [rsp + 0x20], eax
call fcn.1800224c0
cmp eax, r13d
je 0x18001172a
mov rcx, qword [rsp + 0x50]
call fcn.180005428
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x18002f7f8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x18002f90c]
mov ebx, r13d
mov r12d, 0xec27b23d
cmp eax, 0x4427b539
je 0x1800118e0
cmp eax, 0x50949b49
je 0x1800118c9
mov ecx, 0x91f904bd
cmp eax, ecx
je 0x1800117e4
cmp eax, 0xa5ae7846
je 0x18001189a
cmp eax, 0xb148c9e3
je 0x1800117de
cmp eax, r12d
je 0x1800117d2
cmp eax, 0xf330ddbd
je 0x180011797
cmp eax, 0xfef64680
je 0x18001178d
mov dword [0x18002f90c], r13d
jmp 0x1800118ec
call fcn.180008054
jmp 0x1800118ce
call qword [sym.imp.USER32.dll_GetShellWindow]
lea rdx, [rsp + 0xb0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [rsp + 0xb0]
cmp edx, r13d
je 0x1800117c8
lea rcx, [0x18002f9b0]
call fcn.180013640
jmp 0x1800117d7
mov ebx, 2
jmp 0x1800118ec
call fcn.180007c94
mov ebx, eax
jmp 0x1800118ec
mov dword [0x18002f90c], ecx
lea rcx, [0x1800328a4]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r13
je 0x1800118c2
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x18002f8f0], eax
je 0x1800118d0
cmp byte [0x18002fa1c], 6
ja 0x180011859
lea rcx, [0x180032a42]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180032a4a]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180032bdf]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180032b52]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180032956]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180032bd8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180032934]
call fcn.180021da8
mov r11, qword [0x18002f910]
mov edx, 0xe
or dword [r11 + 0x34], r14d
lea r8, [0x18002eaa0]
lea rcx, [0x18002e950]
mov r9d, edx
call fcn.18000e8c8
jmp 0x1800118ce
lea rcx, [0x1800328ce]
mov ebx, 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, r13
je 0x1800118d0
lea rdx, [0x180032208]
mov rcx, rax
call fcn.180006f84
jmp 0x1800118ce
mov ebx, 0x7e
jmp 0x1800118d0
call fcn.1800072e0
mov ebx, eax
cmp ebx, r13d
jne 0x180011b6d
call fcn.180005398
jmp 0x1800118ec
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18000e990
cmp ebx, r13d
jne 0x180011b6d
call fcn.180004734
mov rcx, qword [0x18002f7f8]
xor edx, edx
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov rdi, rax
mov qword [0x18002f8b8], rax
je 0x180011b6d
mov dword [rax + 4], r13d
mov dword [rax], r13d
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
lea r8, [0x180010e14]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [0x18002f8b8]
mov ecx, dword [rdi + 4]
mov qword [rdx + rcx*8 + 8], rax
mov eax, dword [rdi + 4]
cmp qword [rdx + rax*8 + 8], r13
je 0x180011b6d
add eax, r14d
mov dword [rdi + 4], eax
mov eax, dword [0x18002f90c]
cmp eax, r12d
jne 0x180011ac5
lea r8, [0x18002f920]
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea r11, [0x18002f978]
lea r9, [0x18002f970]
mov qword [rsp + 0x28], r11
lea r8, [0x1800129bc]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r13
mov qword [0x18002f970], rax
jne 0x1800119cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, section..bss
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r13
je 0x1800119f7
lea r8, [0x18002f198]
lea rcx, [0x18002f180]
mov r9d, r14d
mov edx, r14d
call fcn.18000e8c8
mov rsi, qword [0x18002f8b8]
mov rcx, qword [0x18002f918]
lea rax, [0x18002fa60]
mov ebp, dword [rsi + 4]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r13d
mov edx, 0x40000003
mov r9d, 0xff
mov r8d, 4
mov dword [rsp + 0x28], 0x100
mov ebx, r13d
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x180011a8e
lea rax, [rsp + 0x48]
lea r8, [0x18000f1cc]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r13
je 0x180011a7b
mov qword [rsi + rbp*8 + 8], rax
jmp 0x180011a96
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180011a96
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, r13d
jne 0x180011b6d
mov rax, qword [0x18002f8b8]
add dword [rax + 4], r14d
cmp dword [0x18002f834], r13d
je 0x180011abf
lea rcx, [0x18002f830]
call fcn.1800024d8
mov eax, dword [0x18002f90c]
cmp eax, r13d
je 0x180011b6a
cmp eax, r12d
jne 0x180011b1e
mov rcx, qword [0x18002f7f8]
xor edx, edx
lea r8d, [rdx + 0x51]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r13
mov qword [0x18002fad0], rax
je 0x180011b1e
movzx r9d, byte [0x18002fa1d]
movzx r8d, byte [0x18002fa1c]
lea rcx, [0x18003215f]
mov qword [rsp + 0x20], rcx
lea rdx, [0x180032115]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdi, qword [0x18002f8b8]
lea rax, [rsp + 0xb8]
lea r8, [0x180005fc0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [0x18002f8b8]
mov ecx, dword [rdi + 4]
mov qword [rdx + rcx*8 + 8], rax
mov eax, dword [rdi + 4]
cmp qword [rdx + rax*8 + 8], r13
je 0x180011b6d
add eax, r14d
mov dword [rdi + 4], eax
mov ebx, r13d
mov eax, ebx
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret