Function at 0x18002d690
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x180133da0], eax
je 0x18002d6ac
mov eax, 0x10dd
jmp 0x18002d7cb
mov rax, qword [0x180133d90]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18002d753
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x18002d722
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x18002d722
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.18002d440
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x18002d6b8
mov qword [0x180133d90], 0
call fcn.18002cd80
mov rax, qword [0x180133d80]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18002d7b4
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x18002d76f
mov qword [0x180133d80], 0
mov dword [0x180133da0], 0
xor eax, eax
add rsp, 0x68
ret

Function at 0x18002dd60
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x180133da4], 0
je 0x18002dd7d
mov eax, dword [0x180133da4]
jmp 0x18002de43
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp qword [rsp + 0x50], rax
jne 0x18002dd91
xor eax, eax
jmp 0x18002de43
mov ecx, 0x10
call qword [sym.imp.MSVCR120.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18002ddfc
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x18002dde1
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x180133da4], eax
mov qword [0x180133d78], 0
mov eax, dword [rsp + 0x20]
jmp 0x18002de43
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x18002de18
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x18002ddbb
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x180133d80]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x180133d80], rax
xor eax, eax
add rsp, 0x48
ret