Function at 0x1400b5130
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov dword [rsp + 0x30], edx
mov rax, qword [0x1402b5380]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, 0xb4238acb
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15d, 0x5df5f594
mov esi, 0xf008db8a
mov r12d, 0x2af5958
mov ebp, 0x35f0686b
lea rdi, [rsp + 0x40]
jmp 0x1400b51c0
mov eax, dword [0x1402b5fc0]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0x98af0e7d
mov r8d, 0x58e56d27
cmove eax, r8d
cmp dword [0x1402b5fc4], 0xa
mov edx, 0x98af0e7d
cmovge eax, edx
setl dl
xor dl, cl
cmovne eax, r8d
nop dword [rax]
cmp eax, 0xc519819
jg 0x1400b5210
cmp eax, 0xcb1226e8
jg 0x1400b5290
cmp eax, 0x9f2e8c46
jg 0x1400b5321
cmp eax, 0x8d3da696
jle 0x1400b5435
cmp eax, 0x8d3da697
je 0x1400b55db
cmp eax, 0x8ddf6afb
je 0x1400b55f2
cmp eax, 0x98af0e7d
jne 0x1400b51c0
mov eax, 0x58e56d27
jmp 0x1400b51c0
cmp eax, 0x53e72f9a
jg 0x1400b52e0
cmp eax, 0x2b9d7a64
jg 0x1400b5366
cmp eax, 0x12021a77
jle 0x1400b5483
cmp eax, 0x12021a78
je 0x1400b5602
cmp eax, 0x1578665a
je 0x1400b5629
cmp eax, 0x222cc332
jne 0x1400b51c0
mov eax, dword [0x1402b5fc0]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
mov eax, 0x104365a2
mov r8d, 0x5c49ab08
cmove eax, r8d
cmp dword [0x1402b5fc4], 0xa
mov edx, 0x104365a2
jmp 0x1400b51ad
cmp eax, 0xee02c00f
jg 0x1400b539c
cmp eax, 0xe00518ad
jle 0x1400b54a9
cmp eax, 0xe00518ae
je 0x1400b5633
cmp eax, 0xe3910fc7
je 0x1400b517c
cmp eax, 0xeb124b67
jne 0x1400b51c0
mov eax, 0x12021a78
jmp 0x1400b51c0
cmp eax, 0x5df5f593
jle 0x1400b53d2
cmp eax, 0x7502aaf1
jle 0x1400b54c9
cmp eax, 0x7502aaf2
je 0x1400b5669
cmp eax, 0x7a6027a1
je 0x1400b5682
cmp eax, 0x7f72c131
jne 0x1400b51c0
mov eax, 0x5df5f594
jmp 0x1400b51c0
cmp eax, 0xabb0b906
jle 0x1400b54e9
cmp eax, 0xabb0b907
je 0x1400b56a3
cmp eax, 0xb06f0fd2
je 0x1400b56e7
cmp eax, 0xb4238acb
jne 0x1400b51c0
mov ecx, 4
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov eax, 0x2b9d7a65
jmp 0x1400b51c0
cmp eax, 0x35f0686a
jle 0x1400b5545
cmp eax, 0x35f0686b
je 0x1400b56f1
cmp eax, 0x37d68622
je 0x1400b56fb
cmp eax, 0x5108d6af
jne 0x1400b51c0
mov eax, 0xee02c010
jmp 0x1400b51c0
cmp eax, 0xf13af423
jle 0x1400b559b
cmp eax, 0xf13af424
je 0x1400b570d
cmp eax, 0xf6dd6bcd
je 0x1400b5724
cmp eax, 0x2af5958
jne 0x1400b51c0
mov eax, 0xa94658fc
jmp 0x1400b51c0
cmp eax, 0x5755b484
jle 0x1400b55bb
cmp eax, 0x58e56d27
je 0x1400b573b
cmp eax, 0x5c49ab08
jne 0x1400b583e
mov rcx, r14
call r13
mov eax, dword [0x1402b5fc0]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0x104365a2
cmove eax, r12d
cmp dword [0x1402b5fc4], 0xa
mov edx, 0x104365a2
cmovge eax, edx
setl dl
xor dl, cl
cmovne eax, r12d
jmp 0x1400b51c0
cmp eax, 0x81aea06e
je 0x1400b5780
cmp eax, 0x8c3cfd3e
jne 0x1400b51c0
mov eax, dword [0x1402b5fc0]
mov ecx, dword [0x1402b5fc4]
lea edx, [rax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl r8b
xor r8b, al
mov r8d, 0x37d68622
mov r9d, 0xabb0b907
jmp 0x1400b5532
cmp eax, 0xc51981a
je 0x1400b5797
cmp eax, 0x104365a2
jne 0x1400b51c0
mov rcx, r14
call r13
mov eax, 0x5c49ab08
jmp 0x1400b51c0
cmp eax, 0xcb1226e9
je 0x1400b57a1
cmp eax, 0xda03b432
jne 0x1400b51c0
mov eax, 0x55c28110
jmp 0x1400b51c0
cmp eax, 0x5df5f594
je 0x1400b57ab
cmp eax, 0x6c521023
jne 0x1400b51c0
mov eax, 0x81aea06e
jmp 0x1400b51c0
cmp eax, 0x9f2e8c47
je 0x1400b5801
cmp eax, 0xa94658fc
jne 0x1400b51c0
mov eax, dword [0x1402b5fc0]
mov ecx, dword [0x1402b5fc4]
lea edx, [rax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl r8b
xor r8b, al
mov r8d, 0xc51981a
mov r9d, 0xe00518ae
cmovne r8d, r9d
cmp edx, 0xffffffff
mov eax, r8d
cmove eax, r9d
jmp 0x1400b5774
cmp eax, 0x2b9d7a65
je 0x1400b580b
cmp eax, 0x35d79da0
jne 0x1400b51c0
mov eax, dword [0x1402b5fc0]
mov ecx, dword [0x1402b5fc4]
lea edx, [rax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl r8b
xor r8b, al
mov r8d, 0x7f72c131
cmovne r8d, r15d
cmp edx, 0xffffffff
mov eax, r8d
cmove eax, r15d
jmp 0x1400b5774
cmp eax, 0xee02c010
je 0x1400b5821
cmp eax, 0xf008db8a
jne 0x1400b51c0
mov eax, 0x35d79da0
jmp 0x1400b51c0
cmp eax, 0x53e72f9b
je 0x1400b582b
cmp eax, 0x55c28110
jne 0x1400b51c0
mov eax, 0x5755b485
jmp 0x1400b51c0
cmp byte [rsp + 0x27], 0
mov eax, 0x5108d6af
mov ecx, 0x53e72f9b
cmovne eax, ecx
jmp 0x1400b51c0
mov rcx, rbx
call r13
mov eax, 0xda03b432
jmp 0x1400b51c0
mov r8d, dword [rsp + 0x48]
mov ecx, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov r14, rax
test rax, rax
setne byte [rsp + 0x27]
mov eax, 0x8d3da697
jmp 0x1400b51c0
mov eax, 0xf6dd6bcd
jmp 0x1400b51c0
mov eax, dword [0x1402b5fc0]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0xc51981a
mov r8d, 0xcb1226e9
cmove eax, r8d
cmp dword [0x1402b5fc4], 0xa
mov edx, 0xc51981a
jmp 0x1400b51ad
mov rcx, rbx
mov rdx, rdi
call sub.KERNEL32.dll_Thread32Next
mov dword [rsp + 0x34], eax
mov eax, 0xf13af424
jmp 0x1400b51c0
mov rcx, qword [rsp + 0x38]
mov rdx, rdi
call sub.KERNEL32.dll_Thread32First
test eax, eax
mov eax, 0xe3910fc7
mov ecx, 0x8ddf6afb
cmove eax, ecx
jmp 0x1400b51c0
mov eax, dword [rsp + 0x28]
cmp eax, dword [rsp + 0x2c]
sete byte [rsp + 0x26]
mov eax, dword [0x1402b5fc0]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
mov eax, 0x37d68622
mov r8d, 0x1578665a
cmove eax, r8d
cmp dword [0x1402b5fc4], 0xa
mov edx, 0x37d68622
jmp 0x1400b51ad
mov eax, 0x8ddf6afb
jmp 0x1400b51c0
mov eax, 0x8c3cfd3e
jmp 0x1400b51c0
mov eax, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
mov eax, 0xabb0b907
jmp 0x1400b51c0
cmp dword [rsp + 0x34], 0
mov eax, 0x35d79da0
mov ecx, 0xb06f0fd2
cmove eax, ecx
jmp 0x1400b51c0
cmp byte [rsp + 0x26], 0
mov eax, 0x9f2e8c47
mov ecx, 0xeb124b67
cmovne eax, ecx
jmp 0x1400b51c0
mov eax, dword [0x1402b5fc0]
mov ecx, dword [0x1402b5fc4]
lea edx, [rax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete r8b
cmp ecx, 0xa
setl r9b
xor r9b, r8b
mov r8d, 0x98af0e7d
cmovne r8d, esi
test eax, edx
mov eax, r8d
cmove eax, esi
cmp ecx, 0xa
cmovge eax, r8d
jmp 0x1400b51c0
mov dword [rsp + 0x40], Ordinal_32
mov qword [rsp + 0x38], rbx
mov eax, 0x7a6027a1
jmp 0x1400b51c0
mov eax, 0xe00518ae
jmp 0x1400b51c0
mov eax, 0x5108d6af
jmp 0x1400b51c0
mov eax, dword [0x1402b5fc0]
mov ecx, dword [0x1402b5fc4]
lea edx, [rax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl r8b
xor r8b, al
mov r8d, 0x7f72c131
cmovne r8d, ebp
cmp edx, 0xffffffff
mov eax, r8d
cmove eax, ebp
cmp ecx, 0xa
mov ecx, dword [rsp + 0x4c]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x30]
mov dword [rsp + 0x2c], ecx
cmovge eax, r8d
jmp 0x1400b51c0
mov eax, 0x7502aaf2
jmp 0x1400b51c0
cmp rbx, 0xffffffffffffffff
mov eax, 0x6c521023
mov ecx, 0x55c28110
cmove eax, ecx
jmp 0x1400b51c0
mov eax, 0x9f2e8c47
jmp 0x1400b51c0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, 0x222cc332
jmp 0x1400b51c0
cmp eax, 0x5755b485
jne 0x1400b51c0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1402388f0
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret