Function at 0x180001080
Capabilities:
Allocate or change rwx memory
Enumerate threads
Extract resource via kernel32 functions
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x540
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x538], rax
mov esi, ecx
lea rcx, str.version.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
jne 0x1800010da
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Error:_Could_not_get_module_handle.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea r8, [0x180003318]
mov edx, 0x65
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x180001113
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Error:_Could_not_find_resource.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test eax, eax
jne 0x180001141
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Error:_Could_not_determine_resource_size.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x180001171
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Error:_Could_not_load_resource.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r9d, esi
mov dword [rsp + 0x80], 0x10000b
lea r8, [0x180003410]
mov dword [rsp + 0x30], 0x1c
mov edx, 0xa
lea rcx, [rsp + 0x520]
xor ebx, ebx
call fcn.180001010
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x180001353
mov r9d, 0x3000
mov qword [rsp + 0x568], r15
mov r8, rbp
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x180001359
mov r9, rbp
mov qword [rsp + 0x20], rbx
mov r8, rdi
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000135f
xor edx, edx
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180001365
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x18000136b
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
je 0x18000134d
cmp dword [rsp + 0x3c], esi
jne 0x180001273
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
jne 0x18000128e
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180001253
test rbx, rbx
je 0x18000134d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x180001371
mov r9d, 0x40
lea r8, [0x180003418]
lea rdx, str.Getting_thread_context.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x180001377
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x148], r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x18000137d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x180001383
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x568]
mov rcx, qword [rsp + 0x538]
xor rcx, rsp
call fcn.1800015f0
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.180001070
int3
call fcn.180001070
int3
call fcn.180001070
int3
call fcn.180001070
int3
call fcn.180001070
int3
call fcn.180001070
int3
call fcn.180001070
int3
call fcn.180001070
int3
call fcn.180001070
int3
call fcn.180001070
int3