Function at 0x180001000
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov rax, qword [0x180005008]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov qword [rsp + 0x28], rcx
mov r13d, 1
mov dword [rsp + 0x24], r13d
xor edx, edx
mov r8d, 0x4d0
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x60], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r14d, eax
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
xor edi, edi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x24], r13d
movdqu xmmword [rsp + 0x4c], xmm0
mov qword [rsp + 0x5c], rdi
mov dword [rsp + 0x48], 0x1c
xor edx, edx
lea ecx, [rdi + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800010b3
mov rbx, qword [rsp + 0x38]
jmp 0x180001165
lea rdx, [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180001156
cmp dword [rsp + 0x54], r14d
jne 0x1800010ee
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
lea r8, [rsp + 0x20]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180001450
mov rdi, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
je 0x180001156
mov rbx, qword [rsp + 0x38]
cmp dword [rsp + 0x54], r14d
jne 0x180001142
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
cmp rbx, rdi
je 0x180001126
mov dword [rbx], eax
add rbx, 4
mov qword [rsp + 0x38], rbx
jmp 0x180001142
lea r8, [rsp + 0x20]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180001450
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180001105
jmp 0x18000115b
mov rbx, qword [rsp + 0x38]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r14, qword [rsp + 0x30]
sub rbx, r14
sar rbx, 2
test rbx, rbx
je 0x1800011f0
xor esi, esi
mov r15, r14
nop
mov r8d, dword [r15]
mov edx, r13d
mov ecx, 0x58
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov r12, rax
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rax, qword [rsp + 0x28]
mov qword [rbp - 0x48], rax
mov rcx, qword [rbp - 0x20]
and rcx, 0xfffffffffffcffff
or rcx, 1
mov qword [rbp - 0x20], rcx
mov dword [rbp - 0x60], 0x100010
lea rdx, [rsp + 0x70]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1800011f0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
add r15, 4
movsxd rax, esi
cmp rax, rbx
jb 0x180001180
jmp 0x1800011f3
xor r13d, r13d
test r14, r14
je 0x180001232
sub rdi, r14
and rdi, 0xfffffffffffffffc
mov rax, r14
cmp rdi, 0x1000
jb 0x180001227
add rdi, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001227
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rdi
mov rcx, r14
call fcn.1800017d0
mov eax, r13d
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.1800017b0
lea r11, [rsp + 0x550]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret