Function at 0x10018aa0
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x45c
mov eax, dword [0x1008500c]
xor eax, esp
mov dword [esp + 0x458], eax
cmp byte [0x10086001], 0
push ebx
push esi
push edi
mov byte [esp + 0x13], cl
jne 0x10018cef
push 0x210
lea eax, [esp + 0x234]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea edx, [esp + 0x230]
mov ecx, str.xlive.dll
call fcn.10048cf0
test al, al
jne 0x10018b3e
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x24
movups xmmword [ecx], xmm0
push str._gfwl__Unable_to_find_GFWL_module_:_
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.10005760
call fcn.10019210
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x458]
xor ecx, esp
call fcn.10053c04
mov esp, ebp
pop ebp
ret
push 0x210
lea eax, [esp + 0x24]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea edx, [esp + 0x20]
mov ecx, str.ntdll.dll
call fcn.10048cf0
test al, al
jne 0x10018ba8
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x29
movups xmmword [ecx], xmm0
push str._gfwl__Unable_to_find_ntdll.dll_module_:_
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.10005760
call fcn.10019210
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x458]
xor ecx, esp
call fcn.10053c04
mov esp, ebp
pop ebp
ret
push str.NtQueryInformationThread
push dword [esp + 0x128]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x10018bfc
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x31
movups xmmword [ecx], xmm0
push str._gfwl__Unable_to_find_NtQueryInformationThread_:_
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
call fcn.10005760
call fcn.10019210
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x458]
xor ecx, esp
call fcn.10053c04
mov esp, ebp
pop ebp
ret
push 0
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [esp + 0x18], eax
xor edi, edi
mov eax, dword [esp + 0x334]
add eax, 0x146ab8
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
mov dword [esp + 0x444], 0x1c
lea eax, [esp + 0x444]
mov dword [esp + 0x1c], esi
xorps xmm0, xmm0
push eax
push dword [esp + 0x1c]
movlpd qword [esp + 0x450], xmm0
movlpd qword [esp + 0x458], xmm0
movlpd qword [esp + 0x460], xmm0
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10018ce5
nop dword [eax]
cmp dword [esp + 0x450], esi
jne 0x10018ccf
push dword [esp + 0x44c]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x10018ccb
push 0
push 4
lea eax, [esp + 0x468]
mov dword [esp + 0x468], 0
push eax
push 9
push esi
call ebx
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x460], eax
jne 0x10018cc4
mov eax, edi
inc edi
cmp eax, 1
je 0x10018d06
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x444]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10018c70
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x458]
xor ecx, esp
call fcn.10053c04
mov esp, ebp
pop ebp
ret
mov bl, byte [esp + 0x13]
push esi
test bl, bl
je 0x10018d17
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x10018d1d
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x10018ce5
mov ecx, str.Resumed
test bl, bl
mov eax, str.Suspended
xorps xmm0, xmm0
cmove eax, ecx
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x2c], eax
push 0x38
movups xmmword [ecx], xmm0
push str._gfwl___main_thread_0x:04x_of_start_address_0x:04x
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.10005760
lea eax, [esp + 0x478]
push eax
lea edx, [esp + 0x468]
lea ecx, [esp + 0x30]
call fcn.10019890
mov ecx, dword [esp + 0x480]
add esp, 0x1c
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10053c04
mov esp, ebp
pop ebp
ret