Function at 0x18003f3ac
Capabilities:
Check os version
Create thread

Disassembly:
jmp 0x180062510
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2c8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x6e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2e8]
mov rax, qword [0x1801091a8]
xor rax, rbp
mov qword [rbp + 0x268], rax
lea rcx, [0x18011c0ff]
call fcn.1800414cc
mov qword [rbp + 8], 0
mov rcx, qword [rbp + 0x290]
call fcn.180040059
mov dword [rbp + 0x264], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [rbp + 0x264]
cmp ecx, eax
jne 0x1800625d7
mov rax, qword [rbp + 0x2c0]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x2b8]
mov dword [rsp + 0x20], eax
mov r9, qword [rbp + 0x2b0]
mov r8, qword [rbp + 0x2a8]
mov rdx, qword [rbp + 0x2a0]
mov rcx, qword [rbp + 0x298]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
jmp 0x180062774
mov r8d, 0x114
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.180040bc1
mov dword [rbp + 0x30], 0x114
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp + 0x34], 6
jb 0x180062714
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.18003f582
test eax, eax
jne 0x18006262a
mov rcx, qword [rbp + 0x290]
call fcn.18003f582
test eax, eax
je 0x18006262a
jmp 0x180062712
lea rcx, [0x1800cf668]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlCreateUserThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x168], rax
cmp qword [rbp + 0x168], 0
jne 0x180062673
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateRemoteThreadEx___:_GetProcAddress__RtlCreateUserThread___failed______d__n
call fcn.180040950
xor eax, eax
jmp 0x180062774
lea rax, [rbp + 0x188]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rax, [rbp + 0x188]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x2b0]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x2a8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x290]
call qword [rbp + 0x168]
cmp qword [rbp + 8], 0
jne 0x1800626f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateRemoteThreadEx___:_RtlCreateUserThread___failed______d__n
call fcn.180040950
xor eax, eax
jmp 0x180062774
cmp qword [rbp + 0x2c0], 0
je 0x180062712
mov rax, qword [rbp + 0x2c0]
mov ecx, dword [rbp + 0x190]
mov dword [rax], ecx
jmp 0x180062770
mov rax, qword [rbp + 0x2c0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x2a8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x180062770
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateRemoteThreadEx___:_CreateRemoteThread___failed______d__n
call fcn.180040950
xor eax, eax
jmp 0x180062774
mov rax, qword [rbp + 8]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x1800d0e10]
call fcn.180040eaa
mov rax, rdi
mov rcx, qword [rbp + 0x268]
xor rcx, rbp
call fcn.18004016c
lea rsp, [rbp + 0x278]
pop rdi
pop rbp
ret