Function at 0x1800ebada
Capabilities:
Resume thread

Disassembly:
push rax
pushf
mov eax, 0xcc5b15e4
pushf
not eax
add eax, 0xbf0ade1f
xor eax, 0xf9739b5c
rol eax, 0x21
popf
pushf
not eax
add eax, 0xdff45638
xor eax, 0xc83baf6b
rol eax, 0x39
popf
cmp eax, 4
jne 0x1800ebb17
popf
pop rax
jmp 0x1800ebe9a
cmp eax, 0
jne 0x1800ebb26
popf
pop rax
jmp 0x1800ebc43
cmp eax, 3
jne 0x1800ebb35
popf
pop rax
jmp 0x1800ebe04
cmp eax, 1
jne 0x1800ebb44
popf
pop rax
jmp 0x1800ebd18
cmp eax, 0xd
jne 0x1800ebb53
popf
pop rax
jmp 0x1800ec3a2
cmp eax, 7
jne 0x1800ebb62
popf
pop rax
jmp 0x1800ec061
cmp eax, 0xe
jne 0x1800ebb71
popf
pop rax
jmp 0x1800ec436
cmp eax, 0xb
jne 0x1800ebb80
popf
pop rax
jmp 0x1800ec27b
cmp eax, 0xc
jne 0x1800ebb8f
popf
pop rax
jmp 0x1800ec30e
cmp eax, 8
jne 0x1800ebb9e
popf
pop rax
jmp 0x1800ec0c5
cmp eax, 0x10
jne 0x1800ebbad
popf
pop rax
jmp 0x1800ec4ab
cmp eax, 2
jne 0x1800ebbbc
popf
pop rax
jmp 0x1800ebd58
cmp eax, 9
jne 0x1800ebbcb
popf
pop rax
jmp 0x1800ec17f
cmp eax, 0x12
jne 0x1800ebbda
popf
pop rax
jmp 0x1800ec59b
cmp eax, 6
jne 0x1800ebbe9
popf
pop rax
jmp 0x1800ebf74
cmp eax, 0x11
jne 0x1800ebbf8
popf
pop rax
jmp 0x1800ec518
cmp eax, 5
jne 0x1800ebc07
popf
pop rax
jmp 0x1800ebedf
cmp eax, 0x13
jne 0x1800ebc16
popf
pop rax
jmp 0x1800ec5e6
cmp eax, 0xa
jne 0x1800ebc25
popf
pop rax
jmp 0x1800ec22d
cmp eax, 0x14
jne 0x1800ebc34
popf
pop rax
jmp 0x1800ec641
cmp eax, 0xf
jne 0x1800ebc43
popf
pop rax
jmp 0x1800ec494
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, ecx
mov ecx, dword [0x180042e5c]
mov ebx, edi
test ecx, ecx
je 0x1800ebcbf
push rax
pushf
mov eax, 0x96d50862
pushf
not eax
add eax, 0xabc833a8
xor eax, 0xaf40681d
rol eax, 0x13
popf
pushf
not eax
add eax, 0xe0175db9
xor eax, 0x984c4f79
rol eax, 0xa7
popf
pushf
not eax
add eax, 0xac85d958
xor eax, 0xe7c5bb66
rol eax, 0xbe
popf
pushf
not eax
add eax, 0xc68f846c
xor eax, 0xc7f89cba
rol eax, 0x3f
popf
jmp 0x1800ebb08
push rax
pushf
mov eax, 0xbc310002
pushf
not eax
add eax, 0xdf9579c9
xor eax, 0xe4ee5c67
rol eax, 0xd0
popf
pushf
not eax
add eax, 0xd132b6d0
xor eax, 0x90455d83
rol eax, 0x39
popf
pushf
not eax
add eax, 0xfe2b6a60
xor eax, 0xe407f664
rol eax, 0x98
popf
pushf
not eax
add eax, 0x8d3297fb
xor eax, 0xee9cf7b2
rol eax, 0xf8
popf
jmp 0x1800ebb08
mov rax, qword [0x180042e50]
add rax, 0x20
nop
push rax
pushf
mov eax, 0x549a9bdb
pushf
not eax
add eax, 0xa07a768f
xor eax, 0xcf32a7a9
rol eax, 0xbb
popf
pushf
not eax
add eax, 0xc307aa51
xor eax, 0xeee01e68
rol eax, 0x54
popf
jmp 0x1800ebb08
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x1800ebdbd
push rax
pushf
mov eax, 0xb8fed30f
pushf
not eax
add eax, 0xd0e1e3e8
xor eax, 0xb0714437
rol eax, 0x9d
popf
pushf
not eax
add eax, 0x849c1694
xor eax, 0x9bc4b6df
rol eax, 0x1e
popf
pushf
not eax
add eax, 0xe382a17a
xor eax, 0xce322975
rol eax, 0x6c
popf
pushf
not eax
add eax, 0xef2bf2f0
xor eax, 0x99f64dea
rol eax, 9
popf
jmp 0x1800ebb08
push rax
pushf
mov eax, 0xa5ca9b11
pushf
not eax
add eax, 0xad071a6d
xor eax, 0xb33aa712
rol eax, 0xa8
popf
pushf
not eax
add eax, 0xc85cd9d5
xor eax, 0x83b4b9c6
rol eax, 0x91
popf
pushf
not eax
add eax, 0xe2347f95
xor eax, 0x8e37fb34
rol eax, 0x6c
popf
jmp 0x1800ebb08
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x1800ebe54
push rax
pushf
mov eax, 0x802a400e
pushf
not eax
add eax, 0x81030735
xor eax, 0xe4840493
rol eax, 0x87
popf
pushf
not eax
add eax, 0xd6f21155
xor eax, 0xd76e5138
rol eax, 0x8c
popf
pushf
not eax
add eax, 0xb71b6cfa
xor eax, 0xd0a544fa
rol eax, 0xb3
popf
jmp 0x1800ebb08
push rax
pushf
mov eax, 0x61e4d89a
pushf
not eax
add eax, 0xafdc4339
xor eax, 0x8165b853
rol eax, 0x13
popf
pushf
not eax
add eax, 0xe6b4512b
xor eax, 0x99a4b8fd
rol eax, 0x91
popf
pushf
not eax
add eax, 0x9885a459
xor eax, 0xffb21096
rol eax, 0x65
popf
jmp 0x1800ebb08
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x1800ebf41
push rax
pushf
mov eax, 0xe2e71032
pushf
not eax
add eax, 0xa44a0381
xor eax, 0xf38491de
rol eax, 9
popf
pushf
not eax
add eax, 0xe50b5ae8
xor eax, 0xd7d8e507
rol eax, 0xee
popf
pushf
not eax
add eax, 0xbd5f4142
xor eax, 0xaa472ccf
rol eax, 0x28
popf
pushf
not eax
add eax, 0xbd97404a
xor eax, 0x82adaa9a
rol eax, 0xae
popf
jmp 0x1800ebb08
push rax
pushf
mov eax, 0x138e7ab2
pushf
not eax
add eax, 0x8e1901c9
xor eax, 0xd53de348
rol eax, 0x88
popf
pushf
not eax
add eax, 0xa80b5f08
xor eax, 0xf0a70008
rol eax, 0x5e
popf
jmp 0x1800ebb08
mov r8d, edi
lea rcx, [rsp + 0x20]
test esi, esi
mov edx, 0xcd68ce3f
pushf
not edx
add edx, 0xb742878c
xor edx, 0xe681e991
rol edx, 0x5f
popf
pushf
not edx
add edx, 0xda393a5f
xor edx, 0xad72ee0f
rol edx, 0xa0
popf
setne r8b
call fcn.18016e9b4
mov r8d, dword [0x180042e5c]
cmp ebx, r8d
jae 0x1800ec01b
push rax
pushf
mov eax, 0x3f5d851a
pushf
not eax
add eax, 0xca847a0c
xor eax, 0xc0973fac
rol eax, 0xaf
popf
pushf
not eax
add eax, 0xb4763bf6
xor eax, 0xfe801fa8
rol eax, 0x54
popf
pushf
not eax
add eax, 0xbcb10186
xor eax, 0xc7ed888a
rol eax, 0xec
popf
pushf
not eax
add eax, 0x9bce8bdc
xor eax, 0x94760ef0
rol eax, 0xd9
popf
jmp 0x1800ebb08
push rax
pushf
mov eax, 0x836f145c
pushf
not eax
add eax, 0xe9231506
xor eax, 0xbf27fbb1
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xf8112dcf
xor eax, 0xfa8fc6bd
rol eax, 0xb2
popf
pushf
not eax
add eax, 0x8b27e1d1
xor eax, 0xe7cf490d
rol eax, 0xc1
popf
jmp 0x1800ebb08
nop word [rax + rax]
push rax
pushf
mov eax, 0x7e28bcad
pushf
not eax
add eax, 0x98920691
xor eax, 0xf8eb00e6
rol eax, 0x83
popf
pushf
not eax
add eax, 0xd2a24d10
xor eax, 0xd3b49778
rol eax, 4
popf
pushf
not eax
add eax, 0xc6582d0f
xor eax, 0xa1978c55
rol eax, 0x33
popf
pushf
not eax
add eax, 0xe9b2f2b0
xor eax, 0xeac845ec
rol eax, 0x80
popf
jmp 0x1800ebb08
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x180042e50]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x1800ec139
push rax
pushf
mov eax, 0x145166ff
pushf
not eax
add eax, 0xd45d5963
xor eax, 0xcd389000
rol eax, 0xa2
popf
pushf
not eax
add eax, 0xef38a448
xor eax, 0xc5fc90ce
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xa7178037
xor eax, 0xae043245
rol eax, 0x98
popf
pushf
not eax
add eax, 0xb702ad37
xor eax, 0xa2982ba4
rol eax, 0xd9
popf
jmp 0x1800ebb08
push rax
pushf
mov eax, 0x22a63e4d
pushf
not eax
add eax, 0xb2c31097
xor eax, 0xa06c045d
rol eax, 0xfe
popf
pushf
not eax
add eax, 0x9120c287
xor eax, 0xa6652591
rol eax, 0xc
popf
pushf
not eax
add eax, 0xf9c3ad52
xor eax, 0xdf3bcb1b
rol eax, 0xb3
popf
jmp 0x1800ebb08
mov edx, esi
mov ecx, ebx
call fcn.18015640a
mov edi, eax
test eax, eax
jne 0x1800ec1d4
push rax
pushf
mov eax, 0x6bce5394
pushf
not eax
add eax, 0xb1239112
xor eax, 0xb4401539
rol eax, 0x8d
popf
pushf
not eax
add eax, 0xde994b55
xor eax, 0xf6e85eb8
rol eax, 0x42
popf
pushf
not eax
add eax, 0xf80cfa23
xor eax, 0xba792bf7
rol eax, 0xed
popf
jmp 0x1800ebb08
push rax
pushf
mov eax, 0x4ad246f4
pushf
not eax
add eax, 0xe898e129
xor eax, 0xa6083604
rol eax, 0xd1
popf
pushf
not eax
add eax, 0xc1577de6
xor eax, 0xa30e1f05
rol eax, 0xad
popf
pushf
not eax
add eax, 0xa58c2cea
xor eax, 0x90cfcace
rol eax, 0xd8
popf
pushf
not eax
add eax, 0x867ebd6c
xor eax, 0xe20c0fb2
rol eax, 0x4d
popf
jmp 0x1800ebb08
mov r8d, dword [0x180042e5c]
push rax
pushf
mov eax, 0xc8b4ac96
pushf
not eax
add eax, 0x81e26a36
xor eax, 0xd32ecb18
rol eax, 0xfb
popf
pushf
not eax
add eax, 0x9961ab0d
xor eax, 0x83398c59
rol eax, 0x7a
popf
pushf
not eax
add eax, 0x81025641
xor eax, 0xf98db631
rol eax, 0xe1
popf
jmp 0x1800ebb08
inc ebx
cmp ebx, r8d
jb 0x1800ec2b5
push rax
pushf
mov eax, 0xdd2876b8
pushf
not eax
add eax, 0xb6a735f7
xor eax, 0xc8658120
rol eax, 0x14
popf
pushf
not eax
add eax, 0xd056da6b
xor eax, 0xee7508b7
rol eax, 0x34
popf
jmp 0x1800ebb08
push rax
pushf
mov eax, 0x9eeacdb1
pushf
not eax
add eax, 0xe4819e44
xor eax, 0xe04e87ea
rol eax, 0x7c
popf
pushf
not eax
add eax, 0xe1285600
xor eax, 0xaab663b6
rol eax, 0xfe
popf
pushf
not eax
add eax, 0xbe6c973b
xor eax, 0xfe2d7047
rol eax, 0xa4
popf
pushf
not eax
add eax, 0xdbf2a042
xor eax, 0xc5e0fd81
rol eax, 0xcf
popf
jmp 0x1800ebb08
cmp qword [rsp + 0x20], 0
je 0x1800ec349
push rax
pushf
mov eax, 0x76fcdd0
pushf
not eax
add eax, 0xf42a8c4b
xor eax, 0xe741210a
rol eax, 0x55
popf
pushf
not eax
add eax, 0xace594f7
xor eax, 0xbda41583
rol eax, 0xea
popf
jmp 0x1800ebb08
push rax
pushf
mov eax, 0x20e9601d
pushf
not eax
add eax, 0x969aee88
xor eax, 0x859fed52
rol eax, 0x75
popf
pushf
not eax
add eax, 0x9ca70d1a
xor eax, 0xa73a0caa
rol eax, 0xcf
popf
pushf
not eax
add eax, 0x844491d6
xor eax, 0xffca97a3
rol eax, 0x81
popf
pushf
not eax
add eax, 0xb51faa9e
xor eax, 0xb1e86adf
rol eax, 0x93
popf
jmp 0x1800ebb08
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800ec3dd
push rax
pushf
mov eax, 0x799465fd
pushf
not eax
add eax, 0xffac1cab
xor eax, 0x940b38e6
rol eax, 0x87
popf
pushf
not eax
add eax, 0xbb3c4745
xor eax, 0xacf6a1bb
rol eax, 0xd2
popf
jmp 0x1800ebb08
push rax
pushf
mov eax, 0x992c35b2
pushf
not eax
add eax, 0xe30122c4
xor eax, 0x9d2a0ac4
rol eax, 0x43
popf
pushf
not eax
add eax, 0xd135fc93
xor eax, 0x966a6fce
rol eax, 0x95
popf
pushf
not eax
add eax, 0x80d743f8
xor eax, 0xc40c2b7a
rol eax, 0xd5
popf
pushf
not eax
add eax, 0xe222b1e0
xor eax, 0x9d22c7b1
rol eax, 0x7a
popf
jmp 0x1800ebb08
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
push rax
pushf
mov eax, 0x9a88e3d2
pushf
not eax
add eax, 0x82d69bd2
xor eax, 0xfe48c137
rol eax, 0x3a
popf
pushf
not eax
add eax, 0xfe4c75cf
xor eax, 0x84af2268
rol eax, 0x94
popf
pushf
not eax
add eax, 0xd170aa5b
xor eax, 0xf47b14a3
rol eax, 0xaa
popf
jmp 0x1800ebb08
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
jmp 0x1800ec49d
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800ec518
mov rcx, rax
jmp 0x1800ec4af
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
jmp 0x1800ec4b9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0xc7021e25
pushf
not eax
add eax, 0x96adb51a
xor eax, 0xdadc19a4
rol eax, 0x9e
popf
pushf
not eax
add eax, 0xb5b466f0
xor eax, 0xc53668ba
rol eax, 0x17
popf
pushf
not eax
add eax, 0xdb5baae7
xor eax, 0x8a03e0c2
rol eax, 0xd6
popf
pushf
not eax
add eax, 0xc368a302
xor eax, 0x96887a33
rol eax, 0x41
popf
jmp 0x1800ebb08
add rbx, 4
sub rbp, 1
jne 0x1800ec555
push rax
pushf
mov eax, 0xa1b378d5
pushf
not eax
add eax, 0xd20186f9
xor eax, 0xd096f8ad
rol eax, 0xa1
popf
pushf
not eax
add eax, 0x9b58b8b9
xor eax, 0xd9a6ef9b
rol eax, 0xb7
popf
jmp 0x1800ebb08
push rax
pushf
mov eax, 0x80c2da5b
pushf
not eax
add eax, 0xc8cf3e42
xor eax, 0x82f7dc7d
rol eax, 0x81
popf
pushf
not eax
add eax, 0xb71aad3b
xor eax, 0x9ea73442
rol eax, 0x42
popf
pushf
not eax
add eax, 0xb2180c6c
xor eax, 0xb407a4e5
rol eax, 0x39
popf
jmp 0x1800ebb08
mov rbp, qword [rsp + 0x40]
push rax
pushf
mov eax, 0x7d77af24
pushf
not eax
add eax, 0x9833c46c
xor eax, 0xbc168bff
rol eax, 0x59
popf
pushf
not eax
add eax, 0xdba5186e
xor eax, 0xe0bcb7dd
rol eax, 0xba
popf
pushf
not eax
add eax, 0x8a67020f
xor eax, 0xd428543b
rol eax, 0x10
popf
jmp 0x1800ebb08
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180041560]
jmp 0x1800ec5f5
call qword [sym.imp.KERNEL32.dll_HeapFree]
push rax
pushf
mov eax, 0x81a6c252
pushf
not eax
add eax, 0xed906fee
xor eax, 0xf4437317
rol eax, 0xbf
popf
pushf
not eax
add eax, 0xc3dac38e
xor eax, 0xa72e44a0
rol eax, 0x9a
popf
pushf
not eax
add eax, 0xc1099d8d
xor eax, 0xa1bcf14b
rol eax, 0xc3
popf
jmp 0x1800ebb08
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret