Function at 0x180048770
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x30]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x1800a2f60]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800487d4
mov eax, 0xa
jmp 0x180048863
test esi, esi
je 0x1800487f6
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180048819
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180048819
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180048812
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180048819
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
movzx eax, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180048880
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov eax, dword [0x1800a2f6c]
xor edi, edi
mov ebx, edi
test eax, eax
je 0x1800489a0
mov rcx, qword [0x1800a2f60]
add rcx, 0x20
test byte [rcx], 2
je 0x1800488c3
inc ebx
add rcx, 0x38
cmp ebx, eax
jb 0x1800488a7
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x1800489a0
mov edx, 0xffffffff
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.1800485c0
mov edx, dword [0x1800a2f6c]
cmp ebx, edx
jae 0x180048922
nop dword [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x1800a2f60]
test byte [rcx + rax + 0x20], 2
jne 0x18004891c
mov edx, 1
mov ecx, ebx
call fcn.180048770
mov edi, eax
test eax, eax
jne 0x180048922
mov edx, dword [0x1800a2f6c]
inc ebx
cmp ebx, edx
jb 0x1800488f0
cmp qword [rsp + 0x20], 0
je 0x1800489a0
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18004898c
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
mov qword [rsp + 0x48], rsi
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180048978
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x180048950
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800a2860]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x30
pop rdi
ret