Function at 0x1800403ac
Capabilities:
Check os version
Create thread

Disassembly:
jmp 0x1800635b0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2c8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x6e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2e8]
mov rax, qword [0x18010e1a8]
xor rax, rbp
mov qword [rbp + 0x268], rax
lea rcx, [0x1801210ff]
call fcn.180042508
mov qword [rbp + 8], 0
mov rcx, qword [rbp + 0x290]
call fcn.180041072
mov dword [rbp + 0x264], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [rbp + 0x264]
cmp ecx, eax
jne 0x180063677
mov rax, qword [rbp + 0x2c0]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x2b8]
mov dword [rsp + 0x20], eax
mov r9, qword [rbp + 0x2b0]
mov r8, qword [rbp + 0x2a8]
mov rdx, qword [rbp + 0x2a0]
mov rcx, qword [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
jmp 0x180063814
mov r8d, 0x114
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.180041bee
mov dword [rbp + 0x30], 0x114
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp + 0x34], 6
jb 0x1800637b4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.180040582
test eax, eax
jne 0x1800636ca
mov rcx, qword [rbp + 0x290]
call fcn.180040582
test eax, eax
je 0x1800636ca
jmp 0x1800637b2
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlCreateUserThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x168], rax
cmp qword [rbp + 0x168], 0
jne 0x180063713
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateRemoteThreadEx___:_GetProcAddress__RtlCreateUserThread___failed______d__n
call fcn.18004197d
xor eax, eax
jmp 0x180063814
lea rax, [rbp + 0x188]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rax, [rbp + 0x188]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x2b0]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x2a8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x290]
call qword [rbp + 0x168]
cmp qword [rbp + 8], 0
jne 0x180063799
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateRemoteThreadEx___:_RtlCreateUserThread___failed______d__n
call fcn.18004197d
xor eax, eax
jmp 0x180063814
cmp qword [rbp + 0x2c0], 0
je 0x1800637b2
mov rax, qword [rbp + 0x2c0]
mov ecx, dword [rbp + 0x190]
mov dword [rax], ecx
jmp 0x180063810
mov rax, qword [rbp + 0x2c0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x2a8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x180063810
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateRemoteThreadEx___:_CreateRemoteThread___failed______d__n
call fcn.18004197d
xor eax, eax
jmp 0x180063814
mov rax, qword [rbp + 8]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x1800d3e10]
call fcn.180041edc
mov rax, rdi
mov rcx, qword [rbp + 0x268]
xor rcx, rbp
call fcn.18004118a
lea rsp, [rbp + 0x278]
pop rdi
pop rbp
ret