Function at 0x18003ca70
Capabilities:
Check os version
Create thread
Enumerate process modules
Resume thread
Terminate thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x940
mov rax, qword [0x180084090]
xor rax, rsp
mov qword [rsp + 0x930], rax
mov dword [rsp + 0x70], 0
lea rdi, [rsp + 0x74]
xor eax, eax
mov ecx, 0x118
rep stosb byte [rdi], al
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x1a8], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x198], 0
mov qword [rsp + 0x1b0], 0
mov dword [rsp + 0x1a4], 0
xor eax, eax
mov word [rsp + 0x1a0], ax
mov dword [rsp + 0x70], 0x11c
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x18003cb24
jmp 0x18003cd04
mov rcx, qword [rsp + 0x950]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rsp + 0x1bc], eax
mov dword [rsp + 0x1c0], 0
lea rdx, [rsp + 0x1c0]
mov ecx, dword [rsp + 0x1bc]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x18003cb62
jmp 0x18003cd04
mov dword [rsp + 0x1b8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x1b8]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x18003cb8c
jmp 0x18003cd04
mov eax, dword [rsp + 0x1b8]
cmp dword [rsp + 0x1c0], eax
jne 0x18003cba1
jmp 0x18003cd04
cmp dword [rsp + 0x74], 6
jae 0x18003cbad
jmp 0x18003cd04
cmp dword [rsp + 0x74], 6
jne 0x18003cc82
cmp dword [rsp + 0x78], 0
jne 0x18003cc82
lea rcx, [0x180070d78]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x1c8], rax
lea rdx, [0x180070d88]
mov rcx, qword [rsp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x1a8], rax
mov dword [rsp + 0x1a4], 0
jmp 0x18003cc13
mov eax, dword [rsp + 0x1a4]
add eax, 1
mov dword [rsp + 0x1a4], eax
cmp dword [rsp + 0x1a4], 0x300
jae 0x18003cc80
mov ecx, dword [rsp + 0x1a4]
mov rax, qword [rsp + 0x1a8]
movzx eax, word [rax + rcx]
mov word [rsp + 0x1a0], ax
movzx eax, word [rsp + 0x1a0]
cmp eax, 0x3d80
jne 0x18003cc7e
mov eax, dword [rsp + 0x1a4]
mov rdx, qword [rsp + 0x1a8]
add rdx, rax
mov ecx, dword [rsp + 0x1a4]
mov rax, qword [rsp + 0x1a8]
mov eax, dword [rax + rcx + 2]
lea rax, [rdx + rax + 7]
mov qword [rsp + 0x198], rax
jmp 0x18003cc80
jmp 0x18003cc02
jmp 0x18003ccfa
cmp dword [rsp + 0x74], 6
jne 0x18003ccfa
cmp dword [rsp + 0x78], 1
jne 0x18003ccfa
lea rcx, str.KernelBase.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x1d0], rax
cmp qword [rsp + 0x1d0], 0
jne 0x18003ccb2
jmp 0x18003cd04
lea rdx, str.KernelBaseGetGlobalData
mov rcx, qword [rsp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x18003ccd6
jmp 0x18003cd04
call qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x18003cce9
jmp 0x18003cd04
mov rax, qword [rsp + 0x48]
add rax, 0x5c
mov qword [rsp + 0x198], rax
xor eax, eax
test eax, eax
jne 0x18003cb08
cmp qword [rsp + 0x198], 0
je 0x18003cd1a
mov rax, qword [rsp + 0x198]
mov byte [rax], 1
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x190], 0
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x950]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x18003d062
cmp dword [rsp + 0x190], 0
je 0x18003d062
mov dword [rsp + 0x624], 0
mov rcx, qword [rsp + 0x950]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rsp + 0x620], eax
mov dword [rsp + 0x1e0], 0
lea rdi, [rsp + 0x1e4]
xor eax, eax
mov ecx, 0x434
rep stosb byte [rdi], al
mov dword [rsp + 0x628], 0
jmp 0x18003cdb3
mov eax, dword [rsp + 0x628]
add eax, 1
mov dword [rsp + 0x628], eax
cmp dword [rsp + 0x628], 0x64
jge 0x18003ceb8
mov qword [rsp + 0x630], 0
mov edx, dword [rsp + 0x620]
mov ecx, 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x630], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x638], eax
cmp qword [rsp + 0x630], 0xffffffffffffffff
je 0x18003ce9c
cmp qword [rsp + 0x630], 0
je 0x18003ce9c
mov dword [rsp + 0x1e0], 0x438
lea rdx, [rsp + 0x1e0]
mov rcx, qword [rsp + 0x630]
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x18003ce8e
lea rdx, str.Syswow64
lea rcx, [rsp + 0x410]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x18003ce75
lea rdx, [0x180070df0]
lea rcx, [rsp + 0x210]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x18003ce75
mov dword [rsp + 0x624], 1
jmp 0x18003ce8e
lea rdx, [rsp + 0x1e0]
mov rcx, qword [rsp + 0x630]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x18003ce35
mov rcx, qword [rsp + 0x630]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x624], 0
je 0x18003cea8
jmp 0x18003ceb8
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18003cda2
cmp dword [rsp + 0x624], 0
je 0x18003d062
mov qword [rsp + 0x640], 0
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x640], rax
lea rcx, [0x180070e08]
call fcn.18003c980
mov dword [rsp + 0x63c], eax
cmp dword [rsp + 0x63c], 0
je 0x18003d062
mov ecx, dword [rsp + 0x63c]
mov eax, dword [rsp + 0x640]
add eax, ecx
mov dword [rsp + 0x648], eax
mov ecx, dword [rsp + 0x978]
or ecx, 4
mov r9d, dword [rsp + 0x648]
mov rax, qword [rsp + 0x980]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov rax, qword [rsp + 0x970]
mov qword [rsp + 0x20], rax
mov r8, qword [rsp + 0x960]
mov rdx, qword [rsp + 0x958]
mov rcx, qword [rsp + 0x950]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x1b0], rax
cmp qword [rsp + 0x1b0], 0
je 0x18003d062
lea rdi, [rsp + 0x650]
xor eax, eax
mov ecx, 0x2cc
rep stosb byte [rdi], al
mov dword [rsp + 0x650], 0x100001
lea rdx, [rsp + 0x650]
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x18003d062
mov eax, dword [rsp + 0x968]
mov dword [rsp + 0x708], eax
mov qword [rsp + 0x920], 0
mov eax, dword [rsp + 0x714]
add eax, 4
mov edx, eax
lea rax, [rsp + 0x920]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x970]
mov rcx, qword [rsp + 0x950]
call fcn.180008db0
test eax, eax
je 0x18003d062
cmp qword [rsp + 0x920], 4
jne 0x18003d062
lea rdx, [rsp + 0x650]
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
test eax, eax
je 0x18003d062
mov dword [rsp + 0x928], 0
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [rsp + 0x928], eax
cmp dword [rsp + 0x928], 0
ja 0x18003d03b
mov dword [rsp + 0x58], 1
cmp dword [rsp + 0x58], 0
jne 0x18003d0f0
mov rcx, qword [rsp + 0x950]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rsp + 0x92c], eax
cmp qword [rsp + 0x1b0], 0
je 0x18003d09d
xor edx, edx
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rax, qword [rsp + 0x980]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x978]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x970]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x968]
mov r8, qword [rsp + 0x960]
mov rdx, qword [rsp + 0x958]
mov rcx, qword [rsp + 0x950]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x1b0], rax
cmp qword [rsp + 0x198], 0
je 0x18003d106
mov rax, qword [rsp + 0x198]
mov byte [rax], 0
mov rax, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x930]
xor rcx, rsp
call fcn.18004f770
add rsp, 0x940
pop rdi
ret