Function at 0x14020ca94
Capabilities:
Resume thread

Disassembly:
jmp 0x14043f850
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x5d0
lea rdi, [rsp + 0x30]
mov ecx, 0x168
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x5e0]
mov rax, qword [0x140961e80]
xor rax, rsp
mov qword [rsp + 0x5c0], rax
cmp qword [rsp + 0x5e0], 0
je 0x14043f8a5
mov rax, qword [rsp + 0x5e0]
mov rcx, qword [0x14096c818]
mov qword [rax], rcx
call fcn.140212854
mov rcx, qword [rax + 0x48]
call fcn.14020ba13
cmp dword [0x14096c810], eax
je 0x14043f8c5
mov eax, 0xc0000476
jmp 0x14043fd4d
cmp dword [0x14096c814], 0
jge 0x14043f8de
call fcn.140211760
mov eax, dword [0x14096c814]
jmp 0x14043fd4d
mov dword [rsp + 0x40], 0
mov rax, qword [0x14096c828]
mov qword [rsp + 0x30], rax
jmp 0x14043f901
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14043f9d8
mov rax, qword [rsp + 0x30]
cmp dword [rax + 8], 0
je 0x14043f95d
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x20]
add rcx, 0x20
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x18]
call fcn.14020eed9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x18]
mov qword [rax], rcx
jmp 0x14043f9d3
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
add rax, 0x50
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x20]
add rcx, 0x58
mov rdx, rax
call fcn.14020f460
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
add rax, 0x58
mov rdx, rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x18]
call fcn.140210b6c
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
mov rdx, qword [rax + 0x48]
mov rcx, qword [rsp + 0x48]
call fcn.14021202a
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x10]
mov qword [rcx], rax
jmp 0x14043f8f4
mov rax, qword [0x14096c820]
mov qword [rsp + 0x38], rax
jmp 0x14043f9f3
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14043fb6b
mov dword [rsp + 0x90], 0x100001
lea rdx, [rsp + 0x60]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.ntdll.dll_NtGetContextThread]
test eax, eax
je 0x14043fb66
mov rax, qword [0x14096c828]
mov qword [rsp + 0x30], rax
jmp 0x14043fa41
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14043fb66
mov rax, qword [rsp + 0x30]
cmp dword [rax + 8], 0
je 0x14043fadc
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
cmp qword [rsp + 0x158], rax
jb 0x14043fad7
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
add rax, 8
cmp qword [rsp + 0x158], rax
jae 0x14043fad7
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
mov rcx, qword [rsp + 0x158]
sub rcx, rax
mov rax, rcx
movzx edx, al
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x20]
call fcn.140441ae0
movzx eax, al
mov rcx, qword [rsp + 0x30]
add rax, qword [rcx + 0x18]
mov qword [rsp + 0x158], rax
lea rdx, [rsp + 0x60]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.ntdll.dll_NtSetContextThread]
nop
jmp 0x14043fb61
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
cmp qword [rsp + 0x158], rax
jb 0x14043fb61
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
mov rcx, qword [rsp + 0x30]
add rax, qword [rcx + 0x18]
cmp qword [rsp + 0x158], rax
jae 0x14043fb61
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov rcx, qword [rsp + 0x158]
sub rcx, rax
mov rax, rcx
movzx eax, al
mov edx, eax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x20]
call fcn.140441b50
cdqe
mov rcx, qword [rsp + 0x30]
add rax, qword [rcx + 0x20]
mov qword [rsp + 0x158], rax
lea rdx, [rsp + 0x60]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.ntdll.dll_NtSetContextThread]
nop
jmp 0x14043fa34
jmp 0x14043f9e6
mov rax, qword [0x14096c828]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14043fc8a
mov dword [rsp + 0x544], 0
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x568], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
mov qword [rsp + 0x588], rax
lea rax, [rsp + 0x544]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x30]
mov r9d, dword [rax + 0x28]
lea r8, [rsp + 0x588]
lea rdx, [rsp + 0x568]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
mov r8d, eax
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 0x18]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtFlushInstructionCache]
nop
mov rax, qword [rsp + 0x30]
cmp dword [rax + 8], 0
je 0x14043fc48
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x20], 0
je 0x14043fc48
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x20]
call fcn.1404418f0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x20], 0
mov dword [rsp + 0x40], 1
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x598], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x5b0], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x5b0]
call fcn.1402123cc
nop
mov rax, qword [rsp + 0x598]
mov qword [rsp + 0x30], rax
jmp 0x14043fb77
mov qword [0x14096c828], 0
cmp dword [rsp + 0x40], 0
je 0x14043fcab
cmp dword [0x14096c80c], 0
jne 0x14043fcab
call fcn.140441a10
nop
call fcn.140441000
nop
mov rax, qword [0x14096c820]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14043fd15
xor edx, edx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.ntdll.dll_NtResumeThread]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x5a0], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x5b8], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x5b8]
call fcn.1402123cc
nop
mov rax, qword [rsp + 0x5a0]
mov qword [rsp + 0x38], rax
jmp 0x14043fcbd
mov qword [0x14096c820], 0
mov dword [0x14096c810], 0
cmp qword [rsp + 0x5e0], 0
je 0x14043fd47
mov rax, qword [rsp + 0x5e0]
mov rcx, qword [0x14096c818]
mov qword [rax], rcx
mov eax, dword [0x14096c814]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1407c4ac0]
call fcn.1402124fd
mov rax, rdi
mov rcx, qword [rsp + 0x5c0]
xor rcx, rsp
call fcn.14020ee98
add rsp, 0x5d0
pop rdi
ret