Function at 0x180029bd0
Capabilities:
Check os version
Create thread
Enumerate process modules
Resume thread
Terminate thread

Disassembly:
mov r11, rsp
push rdi
push r12
sub rsp, 0x8c8
mov rax, qword [0x18007f130]
xor rax, rsp
mov qword [rsp + 0x890], rax
mov rax, qword [rsp + 0x900]
mov qword [r11 + 0x10], rbx
mov rbx, qword [rsp + 0x910]
mov qword [r11 - 0x28], r13
mov r13, rcx
mov qword [r11 - 0x38], r15
lea rcx, [rsp + 0x64]
xor edx, edx
mov r8d, 0x118
mov qword [rsp + 0x40], rbx
mov r15, r9
mov qword [rsp + 0x58], rax
call fcn.180035fe0
lea rcx, [rsp + 0x60]
xor r12d, r12d
xor edi, edi
mov dword [rsp + 0x60], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180029d4a
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rdx, [rsp + 0x4c]
mov dword [rsp + 0x4c], edi
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x180029d4a
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x50]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x180029d4a
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x4c], eax
je 0x180029d4a
mov eax, dword [rsp + 0x64]
cmp eax, 6
jb 0x180029d4a
cmp eax, 6
jne 0x180029d4a
mov eax, dword [rsp + 0x68]
test eax, eax
jne 0x180029d09
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [0x18006d148]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov r11, rax
mov rdx, rax
mov eax, 0x3d80
cmp ax, word [rdx]
je 0x180029cf8
inc ecx
inc rdx
cmp ecx, 0x300
jb 0x180029ce4
jmp 0x180029d4a
mov eax, ecx
mov ecx, dword [rcx + r11 + 2]
add rcx, rax
lea r12, [rcx + r11 + 7]
jmp 0x180029d40
cmp eax, 1
jne 0x180029d4a
lea rcx, str.KernelBase.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x180029d4a
lea rdx, str.KernelBaseGetGlobalData
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180029d4a
call rax
test rax, rax
je 0x180029d4a
lea r12, [rax + 0x5c]
test r12, r12
je 0x180029d4a
mov byte [r12], 1
mov qword [rsp + 0x8c0], rbp
lea rdx, [rsp + 0x48]
mov rcx, r13
mov qword [rsp + 0x8b8], rsi
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x8a8], r14
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x180029e7a
cmp dword [rsp + 0x48], edi
je 0x180029e7a
mov rcx, r13
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rcx, [rsp + 0x454]
xor edx, edx
mov r8d, 0x434
mov dword [rsp + 0x450], edi
mov r14d, eax
call fcn.180035fe0
xor esi, esi
mov edx, r14d
mov ecx, 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rbx, 0xffffffffffffffff
je 0x180029e5f
test rbx, rbx
je 0x180029e5f
lea rdx, [rsp + 0x450]
mov rcx, rbx
mov dword [rsp + 0x450], 0x438
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x180029e4e
nop word [rax + rax]
lea rdx, str.Syswow64
lea rcx, [rsp + 0x680]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180029e33
lea rdx, str.ntdll.dll
lea rcx, [rsp + 0x480]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x180029e49
lea rdx, [rsp + 0x450]
mov rcx, rbx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x180029e00
jmp 0x180029e4e
mov ebp, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
jne 0x180029f16
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x64
jl 0x180029db2
mov rbx, qword [rsp + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcessId]
test rdi, rdi
je 0x180029e93
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rbx
mov r9, r15
xor r8d, r8d
xor edx, edx
mov rcx, r13
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, rax
mov r15, qword [rsp + 0x8a0]
mov r14, qword [rsp + 0x8a8]
mov r13, qword [rsp + 0x8b0]
mov rsi, qword [rsp + 0x8b8]
mov rbp, qword [rsp + 0x8c0]
mov rbx, qword [rsp + 0x8e8]
test r12, r12
je 0x180029ef8
mov byte [r12], 0
mov rax, rdi
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.1800340f0
add rsp, 0x8c8
pop r12
pop rdi
ret
mov rbx, qword [rsp + 0x478]
lea rcx, str.C:WindowsSyswow64_ntdll.dll
call fcn.180029b20
test eax, eax
je 0x18002a022
lea r9d, [rbx + rax]
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rbx
xor r8d, r8d
xor edx, edx
mov rcx, r13
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, rax
test rax, rax
je 0x180029e7a
lea rcx, [rsp + 0x180]
xor edx, edx
mov r8d, 0x2cc
call fcn.180035fe0
lea rdx, [rsp + 0x180]
mov rcx, rdi
mov dword [rsp + 0x180], 0x100001
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x180029e7a
mov edx, dword [rsp + 0x244]
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x58]
mov r9d, 4
mov rcx, r13
add edx, 4
mov dword [rsp + 0x238], r15d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180029e7a
cmp qword [rsp + 0x40], 4
jne 0x180029e7a
lea rdx, [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
test eax, eax
je 0x180029e7a
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x18002a010
jmp 0x180029ebe
mov rbx, qword [rsp + 0x40]
jmp 0x180029e7a