Function at 0x180006780
Capabilities:
Check os version
Create thread
Terminate thread

Disassembly:
push rbx
sub rsp, 0x1d0
mov ebx, dword [0x18000f520]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, str.USER32.dll
mov qword [0x18000f580], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
jne 0x1800067c6
xor eax, eax
add rsp, 0x1d0
pop rbx
ret
lea rcx, [0x18000f580]
xor edx, edx
mov r8d, 0xc8
call sub.ntdll.dll_memset
lea rcx, [rsp + 0xb0]
mov dword [0x18000f588], ebx
mov dword [rsp + 0xb0], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
test eax, eax
je 0x180006a47
cmp dword [rsp + 0xb4], 5
jne 0x180006834
cmp dword [rsp + 0xb8], 1
jb 0x180006834
cmp byte [rsp + 0x1ca], 1
mov dword [0x18000f58c], ebx
je 0x1800068b3
add dword [0x18000f58c], 2
jmp 0x1800068b3
lea rcx, [0x1800110a7]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800068b3
movsxd rcx, dword [rax + 0x3c]
movzx edx, word [rcx + rax + 0x40]
movzx eax, word [rcx + rax + 0x42]
cmp edx, 6
jne 0x1800068a0
test eax, eax
jne 0x180006869
mov dword [0x18000f58c], 4
jmp 0x1800068b3
cmp eax, 1
jne 0x18000687a
mov dword [0x18000f58c], 6
jmp 0x1800068b3
cmp eax, 2
jne 0x18000688b
mov dword [0x18000f58c], 8
jmp 0x1800068b3
cmp eax, 3
jne 0x1800067bb
mov dword [0x18000f58c], 0xa
jmp 0x1800068b3
cmp edx, 0xa
jne 0x1800067bb
mov dword [0x18000f58c], 0xc
add dword [0x18000f58c], 1
mov dword [0x18000f590], 1
mov eax, dword [0x18000f58c]
lea rdx, [0x180000000]
mov eax, dword [rdx + rax*4 + 0xf098]
mov dword [0x18000f598], eax
mov eax, dword [0x18000f58c]
mov eax, dword [rdx + rax*4 + 0xf0d0]
mov dword [0x18000f5b8], eax
mov eax, dword [0x18000f58c]
mov eax, dword [rdx + rax*4 + 0xf108]
mov dword [0x18000f5bc], eax
mov eax, dword [0x18000f58c]
mov eax, dword [rdx + rax*4 + 0xf140]
mov dword [0x18000f5c0], eax
call fcn.180005c40
mov dword [0x18000f598], eax
call fcn.1800059f0
mov dword [0x18000f59c], eax
mov eax, dword [0x18000f598]
test eax, eax
je 0x1800067bb
mov eax, dword [0x18000f59c]
test eax, eax
je 0x1800067bb
mov eax, dword [0x18000f58c]
cmp eax, 0xc
jne 0x180006978
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180006978
mov eax, dword [0x18000f5b8]
add rax, 0x10
mov dword [0x18000f5b8], eax
jmp 0x1800069a5
mov eax, dword [0x18000f58c]
cmp eax, 0xd
jne 0x1800069a5
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800069a5
mov eax, dword [0x18000f5b8]
sub rax, 8
mov dword [0x18000f5b8], eax
mov eax, dword [0x18000f590]
mov edx, 0x42
mov ecx, 0x2a
test eax, eax
cmovne ecx, edx
mov edx, 0x58
mov dword [0x18000f594], ecx
mov eax, dword [0x18000f590]
mov ecx, 0x34
test eax, eax
cmovne ecx, edx
mov edx, 0x40
mov dword [0x18000f5a0], ecx
mov eax, dword [0x18000f590]
mov ecx, 0x24
test eax, eax
cmovne ecx, edx
mov dword [0x18000f5a8], ecx
mov eax, dword [0x18000f5a8]
add rax, 8
mov dword [0x18000f5ac], eax
mov eax, dword [0x18000f590]
test eax, eax
je 0x180006a1c
mov ecx, dword [0x18000f5ac]
add rcx, 0x18
jmp 0x180006a26
mov ecx, dword [0x18000f5ac]
add rcx, 0x20
mov dword [0x18000f5b0], ecx
mov eax, dword [0x18000f590]
mov edx, 0xa0
test eax, eax
mov ecx, 0x5c
cmovne ecx, edx
mov dword [0x18000f5b4], ecx
mov rax, qword [0x18000f580]
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1e8], rdi
lea rdi, str.SWL_Window_Class
lea rsi, [0x1800059e0]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x50
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x74], ebx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa8], rbx
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
je 0x180006b7a
mov rax, qword [0x18000f580]
mov qword [rsp + 0x58], rbx
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExW]
test rax, rax
mov rdi, rax
je 0x180006b70
cmp qword [0x18000f060], rbx
jne 0x180006b29
call fcn.180006c50
cmp qword [0x18000f060], rbx
je 0x180006b70
cmp dword [0x18000f578], ebx
jne 0x180006b3b
mov rcx, rdi
call fcn.180008980
jmp 0x180006b43
mov rcx, rdi
call fcn.180008935
test rax, rax
je 0x180006b70
mov ecx, ebx
nop
nop
cmp qword [rax], rsi
je 0x180006b63
add ecx, 1
add rax, 8
cmp ecx, 0x20
jb 0x180006b50
jmp 0x180006b70
lea eax, [rcx + 1]
shl rax, 3
mov dword [0x18000f5a4], eax
mov eax, dword [0x18000f5a4]
test eax, eax
jne 0x180006b81
xor eax, eax
jmp 0x180006c36
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov dword [0x18000f638], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea r8, [0x180005d50]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [0x18000f63c], eax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov rdi, rax
je 0x180006c30
mov ecx, dword [0x18000f644]
test ecx, ecx
jne 0x180006bf8
nop
mov ecx, dword [0x18000f640]
cmp ecx, 0xa
jae 0x180006bf8
cmp ebx, 0x64
jae 0x180006bf8
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x18000f644]
add ebx, 1
test eax, eax
je 0x180006bd0
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov cl, 0x1b
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov cl, 0x12
call qword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [0x18000f644]
mov rsi, qword [rsp + 0x1e0]
mov rdi, qword [rsp + 0x1e8]
add rsp, 0x1d0
pop rbx
ret