Function at 0x180050f70
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x538
mov edi, r8d
mov dword [rsp + 0x20], edx
mov rsi, rcx
mov rax, qword [0x1800d3040]
xor rax, rsp
mov qword [rsp + 0x530], rax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov ecx, 4
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x1800510b6
mov r14, rax
mov dword [rsp + 0x44], 0x1c
lea rdx, [rsp + 0x44]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x18005132f
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r13, qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r15, [rsp + 0x44]
jmp 0x180051057
mov dword [rsi + 8], 0x80
mov rcx, qword [0x1800f2290]
mov r8d, 0x200
xor edx, edx
call r13
mov qword [rsi], rax
mov r8, rax
test rax, rax
je 0x18005132f
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsi + 0xc]
mov edx, ecx
inc edx
mov dword [rsi + 0xc], edx
mov dword [r8 + rcx*4], eax
nop word cs:[rax + rax]
mov dword [rsp + 0x44], 0x1c
mov rcx, r14
mov rdx, r15
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x1800510c0
cmp dword [rsp + 0x44], 0x10
jb 0x180051040
mov ebp, dword [rsp + 0x50]
call rbx
cmp ebp, eax
jne 0x180051040
mov ebp, dword [rsp + 0x4c]
call r12
cmp ebp, eax
je 0x180051040
mov r8, qword [rsi]
test r8, r8
je 0x180050ff7
mov eax, dword [rsi + 8]
cmp dword [rsi + 0xc], eax
jb 0x18005101f
add eax, eax
mov dword [rsi + 8], eax
mov r9d, eax
shl r9, 2
mov rcx, qword [0x1800f2290]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x180051311
mov qword [rsi], rax
mov r8, rax
jmp 0x18005101f
mov eax, 9
jmp 0x180051341
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x180051311
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsi], 0
je 0x18005133f
cmp dword [rsi + 0xc], 0
mov eax, 0
je 0x180051341
xor eax, eax
mov ecx, dword [rsp + 0x20]
mov edx, ecx
inc edx
mov dword [rsp + 0x24], edx
cmove ecx, eax
mov eax, ecx
mov qword [rsp + 0x28], rax
imul rax, rax, 0x38
add rax, 0x30
mov qword [rsp + 0x30], rax
xor ebp, ebp
jmp 0x180051143
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x38]
mov rax, rbp
inc rax
mov ecx, dword [rsi + 0xc]
mov rbp, rax
cmp rax, rcx
jae 0x18005133f
mov rax, qword [rsi]
mov r8d, dword [rax + rbp*4]
mov ecx, 0x5a
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
je 0x18005112e
mov qword [rsp + 0x38], rbp
mov r15, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [rsp + 0x90], 0x100001
mov rcx, r15
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x180051120
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x20], 0xffffffff
jne 0x18005119b
mov eax, dword [0x1800f22a4]
mov rcx, qword [rsp + 0x28]
cmp ecx, eax
jae 0x180051120
mov eax, eax
mov r13d, eax
mov rax, qword [0x1800f2298]
mov rbx, qword [rsp + 0x30]
mov r12, qword [rsp + 0x28]
jmp 0x1800511d6
mov rcx, r12
inc rcx
add rbx, 0x38
mov r12, rcx
cmp rcx, r13
je 0x180051120
imul rcx, r12, 0x38
mov r10d, edi
test edi, edi
je 0x1800511fd
cmp edi, 1
jne 0x1800511f0
mov r10d, 1
jmp 0x1800511fd
mov edx, dword [rax + rcx + 0x20]
shr edx, 2
and edx, 1
mov r10d, edx
mov r9d, dword [rax + rcx + 0x20]
bt r9d, 1
mov edx, r10d
sbb edx, 0
je 0x1800511c0
lea r8, [rax + rcx]
mov rdx, qword [rsp + 0x158]
test r10d, r10d
je 0x180051261
mov r9d, dword [rax + rcx + 0x24]
and r9, 0xf
je 0x1800511c0
mov r10, qword [r8]
lea r8, [rax + rbx]
xor r11d, r11d
nop word cs:[rax + rax]
movzx r14d, byte [r8 + r11 - 8]
add r14, r10
cmp r14, rdx
je 0x1800512c3
mov r14, r11
inc r14
mov r11, r14
cmp r9, r14
jne 0x180051240
jmp 0x1800511c0
test r9b, 1
je 0x180051273
mov r9, qword [r8]
lea r10, [r9 - 5]
cmp r10, rdx
je 0x1800512d0
mov r9d, dword [rax + rcx + 0x24]
and r9, 0xf
je 0x1800512ab
mov r11, qword [rax + rcx + 0x10]
lea r10, [rax + rbx]
xor ebp, ebp
nop dword [rax]
mov r14, rbp
movzx ebp, byte [r10 + rbp]
add rbp, r11
cmp rbp, rdx
je 0x1800512fb
inc r14
mov rbp, r14
cmp r9, r14
jne 0x180051290
cmp rdx, qword [rax + rcx + 8]
jne 0x1800511c0
mov r9, qword [r8]
test r9, r9
jne 0x1800512d9
jmp 0x1800511c0
movzx edx, byte [r11 + r8]
add rdx, qword [rax + rcx + 0x10]
mov r9, rdx
test r9, r9
je 0x1800511c0
mov qword [rsp + 0x158], r9
mov rcx, r15
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rax, qword [0x1800f2298]
jmp 0x1800511c0
movzx ecx, byte [r14 + r10 - 8]
add rcx, qword [r8]
mov r9, rcx
test r9, r9
jne 0x1800512d9
jmp 0x1800511c0
mov r8, qword [rsi]
test r8, r8
je 0x18005132f
mov rcx, qword [0x1800f2290]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsi], 0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 9
jmp 0x180051341
xor eax, eax
mov esi, eax
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.18007d5f0
mov eax, esi
add rsp, 0x538
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret