Function at 0x180002110
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x528
mov edi, r8d
mov dword [rsp + 0x2c], edx
mov rsi, rcx
mov rax, qword [0x18005f7d8]
xor rax, rsp
mov qword [rsp + 0x520], rax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov ecx, 4
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, 9
cmp rax, 0xffffffffffffffff
je 0x1800024ac
mov r14, rax
mov dword [rsp + 0x50], 0x1c
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1800024a3
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r15, [rsp + 0x50]
jmp 0x1800021e7
mov dword [rsi + 8], 0x80
mov rcx, qword [0x180060220]
mov r8d, 0x200
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsi], rax
test rax, rax
je 0x1800024a3
mov ecx, dword [rsp + 0x58]
mov edx, dword [rsi + 0xc]
lea r8d, [rdx + 1]
mov dword [rsi + 0xc], r8d
mov dword [rax + rdx*4], ecx
nop
mov dword [rsp + 0x50], 0x1c
mov rcx, r14
mov rdx, r15
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x18000224b
cmp dword [rsp + 0x50], 0x10
jb 0x1800021d0
mov r13d, dword [rsp + 0x5c]
call rbx
cmp r13d, eax
jne 0x1800021d0
mov r13d, dword [rsp + 0x58]
call r12
cmp r13d, eax
je 0x1800021d0
mov rax, qword [rsi]
test rax, rax
je 0x180002195
mov r9d, dword [rsi + 8]
cmp dword [rsi + 0xc], r9d
jb 0x1800021bd
add r9d, r9d
mov dword [rsi + 8], r9d
shl r9, 2
mov rcx, qword [0x180060220]
xor edx, edx
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x180002485
mov qword [rsi], rax
jmp 0x1800021bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x180002485
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
cmp qword [rsi], 0
je 0x1800024ac
cmp dword [rsi + 0xc], 0
je 0x1800024ac
xor r12d, r12d
mov eax, dword [rsp + 0x2c]
mov ecx, eax
inc ecx
mov dword [rsp + 0x3c], ecx
cmove eax, r12d
mov qword [rsp + 0x40], rax
imul rax, rax, 0x38
add rax, 0x30
mov qword [rsp + 0x48], rax
jmp 0x1800022b8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r12
mov eax, dword [rsi + 0xc]
cmp r12, rax
jae 0x1800024d2
mov rax, qword [rsi]
mov r8d, dword [rax + r12*4]
mov ecx, 0x5a
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
je 0x1800022a9
mov r15, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [rsp + 0x80], 0x100001
mov rcx, r15
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1800022a0
mov eax, dword [rsp + 0x3c]
cmp dword [rsp + 0x2c], 0xffffffff
jne 0x18000230b
mov eax, dword [0x180060234]
cmp dword [rsp + 0x40], eax
jae 0x1800022a0
mov ebp, eax
mov rax, qword [0x180060228]
mov rbx, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
mov qword [rsp + 0x30], r15
jmp 0x180002350
mov rsi, r15
mov r15, qword [rsp + 0x30]
nop word cs:[rax + rax]
inc r13
add rbx, 0x38
cmp r13, rbp
je 0x1800022a0
imul rcx, r13, 0x38
mov r9d, edi
test edi, edi
je 0x18000237d
cmp edi, 1
jne 0x180002370
mov r9d, 1
jmp 0x18000237d
mov r9d, dword [rax + rcx + 0x20]
shr r9d, 2
and r9d, 1
mov r10d, dword [rax + rcx + 0x20]
bt r10d, 1
mov edx, r9d
sbb edx, 0
je 0x180002340
lea r8, [rax + rcx]
mov rdx, qword [rsp + 0x148]
test r9d, r9d
je 0x1800023db
mov r9d, dword [rax + rcx + 0x24]
and r9, 0xf
je 0x180002340
mov r10, qword [r8]
lea r8, [rax + rbx]
xor r11d, r11d
nop word cs:[rax + rax]
movzx r14d, byte [r8 + r11 - 8]
add r14, r10
cmp r14, rdx
je 0x180002435
inc r11
cmp r9, r11
jne 0x1800023c0
jmp 0x180002340
test r10b, 1
je 0x1800023ed
mov r9, qword [r8]
lea r10, [r9 - 5]
cmp r10, rdx
je 0x18000243f
mov r15, rsi
mov r9d, dword [rax + rcx + 0x24]
and r9, 0xf
je 0x180002425
mov r11, qword [rax + rcx + 0x10]
lea r10, [rax + rbx]
xor r14d, r14d
nop word [rax + rax]
movzx esi, byte [r10 + r14]
add rsi, r11
cmp rsi, rdx
je 0x180002449
inc r14
cmp r9, r14
jne 0x180002410
cmp rdx, qword [rax + rcx + 8]
jne 0x18000232b
mov r9, qword [r8]
jmp 0x180002452
movzx r9d, byte [r11 + r8]
add r9, qword [rax + rcx + 0x10]
test r9, r9
jne 0x180002463
jmp 0x180002340
movzx r9d, byte [r14 + r10 - 8]
add r9, qword [r8]
mov rsi, r15
mov r15, qword [rsp + 0x30]
test r9, r9
je 0x180002340
mov qword [rsp + 0x148], r9
mov rcx, r15
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rax, qword [0x180060228]
jmp 0x180002340
mov r8, qword [rsi]
test r8, r8
je 0x1800024a3
mov rcx, qword [0x180060220]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsi], 0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.18003c3c0
mov eax, ebp
add rsp, 0x528
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ebp, ebp
jmp 0x1800024ac