Function at 0x18016e93f
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push rax
pushf
mov eax, 0x147a326c
pushf
not eax
add eax, 0xd864d143
xor eax, 0x88be6a52
rol eax, 0xe6
popf
pushf
not eax
add eax, 0xa1416bbf
xor eax, 0xacd5ed9e
rol eax, 0xf4
popf
pushf
not eax
add eax, 0xfea9c1cf
xor eax, 0xbbecd6e6
rol eax, 0x1f
popf
pushf
not eax
add eax, 0xd979c533
xor eax, 0xc1421409
rol eax, 0xde
popf
cmp eax, 4
jne 0x18016e9a2
popf
pop rax
jmp 0x18016ed69
cmp eax, 0
jne 0x18016e9b1
popf
pop rax
jmp 0x18016eadd
cmp eax, 3
jne 0x18016e9c0
popf
pop rax
jmp 0x18016ecab
cmp eax, 1
jne 0x18016e9cf
popf
pop rax
jmp 0x18016eb8d
cmp eax, 0xd
jne 0x18016e9de
popf
pop rax
jmp 0x18016f232
cmp eax, 7
jne 0x18016e9ed
popf
pop rax
jmp 0x18016ef1b
cmp eax, 0xe
jne 0x18016e9fc
popf
pop rax
jmp 0x18016f301
cmp eax, 0xb
jne 0x18016ea0b
popf
pop rax
jmp 0x18016f17a
cmp eax, 0xc
jne 0x18016ea1a
popf
pop rax
jmp 0x18016f1de
cmp eax, 8
jne 0x18016ea29
popf
pop rax
jmp 0x18016efd9
cmp eax, 0x10
jne 0x18016ea38
popf
pop rax
jmp 0x18016f3f5
cmp eax, 2
jne 0x18016ea47
popf
pop rax
jmp 0x18016ec49
cmp eax, 9
jne 0x18016ea56
popf
pop rax
jmp 0x18016f011
cmp eax, 0x12
jne 0x18016ea65
popf
pop rax
jmp 0x18016f4fe
cmp eax, 6
jne 0x18016ea74
popf
pop rax
jmp 0x18016ee9a
cmp eax, 0x11
jne 0x18016ea83
popf
pop rax
jmp 0x18016f4ac
cmp eax, 5
jne 0x18016ea92
popf
pop rax
jmp 0x18016ee02
cmp eax, 0x15
jne 0x18016eaa1
popf
pop rax
jmp 0x18016f64a
cmp eax, 0xa
jne 0x18016eab0
popf
pop rax
jmp 0x18016f0a5
cmp eax, 0x14
jne 0x18016eabf
popf
pop rax
jmp 0x18016f5ca
cmp eax, 0xf
jne 0x18016eace
popf
pop rax
jmp 0x18016f351
cmp eax, 0x13
jne 0x18016eadd
popf
pop rax
jmp 0x18016f5a7
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x180040280]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov r14d, edx
mov rbx, rcx
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
xor edx, edx
mov ebp, r8d
lea ecx, [rsi + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18016eb5a
push rax
pushf
mov eax, 0x68e45b6e
pushf
not eax
add eax, 0xca4fc2f2
xor eax, 0x94719a3f
rol eax, 0x82
popf
pushf
not eax
add eax, 0xa55b519d
xor eax, 0xd0ef7aa9
rol eax, 0xf3
popf
jmp 0x18016e993
push rax
pushf
mov eax, 0xb15b0047
pushf
not eax
add eax, 0xfa8fdf9f
xor eax, 0xae8f3aca
rol eax, 0x56
popf
pushf
not eax
add eax, 0x882e1d6f
xor eax, 0xe0b42e76
rol eax, 0x62
popf
jmp 0x18016e993
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x18016ebf0
push rax
pushf
mov eax, 0x8edaaf60
pushf
not eax
add eax, 0x82f3b7ea
xor eax, 0xebb2add2
rol eax, 0xaf
popf
pushf
not eax
add eax, 0xb5b68fad
xor eax, 0xfcdf11d8
rol eax, 0xef
popf
pushf
not eax
add eax, 0xbee2dd28
xor eax, 0xc7dbcd3c
rol eax, 0x52
popf
jmp 0x18016e993
push rax
pushf
mov eax, 0x41a6e7b7
pushf
not eax
add eax, 0xf112be21
xor eax, 0xf64edac5
rol eax, 0x79
popf
pushf
not eax
add eax, 0xcc186cf1
xor eax, 0x85d92787
rol eax, 0xf0
popf
pushf
not eax
add eax, 0xbf4fc4ed
xor eax, 0xb4c5c731
rol eax, 0x3f
popf
pushf
not eax
add eax, 0xd549ec66
xor eax, 0xceac67d9
rol eax, 0x60
popf
jmp 0x18016e993
nop word [rax + rax]
push rax
pushf
mov eax, 0x2ca86866
pushf
not eax
add eax, 0xa2b5caf6
xor eax, 0xe93d6e7e
rol eax, 0x15
popf
pushf
not eax
add eax, 0xc8d3e0c6
xor eax, 0xd4c3fcad
rol eax, 0x80
popf
pushf
not eax
add eax, 0x8742ecbb
xor eax, 0x930ab5ac
rol eax, 0xa1
popf
pushf
not eax
add eax, 0xf2416717
xor eax, 0xbaa8bf1c
rol eax, 0xca
popf
jmp 0x18016e993
cmp dword [rsp + 0x20], 0x10
jb 0x18016ed0f
push rax
pushf
mov eax, 0x48210df5
pushf
not eax
add eax, 0xc4875af4
xor eax, 0xbf20b0c6
rol eax, 0x85
popf
pushf
not eax
add eax, 0xef058102
xor eax, 0xbc8de414
rol eax, 4
popf
pushf
not eax
add eax, 0x8682f068
xor eax, 0xb318e367
rol eax, 0xd2
popf
pushf
not eax
add eax, 0xb3234ff0
xor eax, 0xe2559388
rol eax, 0xea
popf
jmp 0x18016e993
push rax
pushf
mov eax, 0x19be14ec
pushf
not eax
add eax, 0xb2522785
xor eax, 0xfed24df7
rol eax, 0x61
popf
pushf
not eax
add eax, 0xba3943b1
xor eax, 0x8b1a022a
rol eax, 0x4e
popf
pushf
not eax
add eax, 0xdf7e5645
xor eax, 0xb45652b0
rol eax, 0x9d
popf
pushf
not eax
add eax, 0xa7007359
xor eax, 0xb5cc0594
rol eax, 0x53
popf
jmp 0x18016e993
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x18016edbb
push rax
pushf
mov eax, 0xaf72f4c0
pushf
not eax
add eax, 0xeeff9cc1
xor eax, 0xa70e9791
rol eax, 0xe7
popf
pushf
not eax
add eax, 0xb7a3af76
xor eax, 0xd3677402
rol eax, 0x63
popf
pushf
not eax
add eax, 0xd4bd475c
xor eax, 0xa592b1fe
rol eax, 0x6f
popf
jmp 0x18016e993
push rax
pushf
mov eax, 0x4a06b3e2
pushf
not eax
add eax, 0xb4f69b82
xor eax, 0x86cfbb74
rol eax, 0xba
popf
pushf
not eax
add eax, 0xf7ec1f6c
xor eax, 0xbda7d77b
rol eax, 0x28
popf
pushf
not eax
add eax, 0x92319867
xor eax, 0xf5e71731
rol eax, 0xba
popf
jmp 0x18016e993
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x18016ee54
push rax
pushf
mov eax, 0x4ba3f28a
pushf
not eax
add eax, 0xdc8900e3
xor eax, 0xff2f4b24
rol eax, 0x64
popf
pushf
not eax
add eax, 0xfe560c03
xor eax, 0xe0283e58
rol eax, 0x9a
popf
pushf
not eax
add eax, 0x91ad71ac
xor eax, 0xf2270b82
rol eax, 0xc7
popf
jmp 0x18016e993
push rax
pushf
mov eax, 0x1f4af55c
pushf
not eax
add eax, 0xaa8f0185
xor eax, 0xa8f9498b
rol eax, 0xc1
popf
pushf
not eax
add eax, 0x9386aa6b
xor eax, 0xb3b56f04
rol eax, 0xf9
popf
pushf
not eax
add eax, 0xfc6e6616
xor eax, 0xba6e2335
rol eax, 0x54
popf
jmp 0x18016e993
mov rdx, qword [rbx]
test rdx, rdx
jne 0x18016eee8
push rax
pushf
mov eax, 0xf615ad7b
pushf
not eax
add eax, 0xd617ebe5
xor eax, 0xc1cfd5c1
rol eax, 0x1e
popf
pushf
not eax
add eax, 0xfff94d03
xor eax, 0xf2095443
rol eax, 0x20
popf
pushf
not eax
add eax, 0xab2e2332
xor eax, 0xa5a17cd6
rol eax, 0xb3
popf
jmp 0x18016e993
push rax
pushf
mov eax, 0xd05f693f
pushf
not eax
add eax, 0xab9bb637
xor eax, 0xc1cb0327
rol eax, 0xd3
popf
pushf
not eax
add eax, 0xe9a3c0a7
xor eax, 0xfb22e8ec
rol eax, 0xe4
popf
jmp 0x18016e993
mov dword [rbx + 8], 0x80
mov r8d, 0x735ab552
pushf
not r8d
add r8d, 0xe5992c49
xor r8d, 0xd1f651a0
rol r8d, 0x77
popf
pushf
not r8d
add r8d, 0x9dd315c7
xor r8d, 0xf2813133
rol r8d, 0xe2
popf
mov rcx, qword [0x180041538]
jmp 0x18016ef62
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x18016efa6
push rax
pushf
mov eax, 0x1bb2a147
pushf
not eax
add eax, 0xefc6f7eb
xor eax, 0xb281d338
rol eax, 0x6c
popf
pushf
not eax
add eax, 0xdeb6a497
xor eax, 0x825cee2d
rol eax, 0xe9
popf
jmp 0x18016e993
push rax
pushf
mov eax, 0x1bb6aa5
pushf
not eax
add eax, 0x9a11a00d
xor eax, 0xb19c028f
rol eax, 0x59
popf
pushf
not eax
add eax, 0xe7012fc1
xor eax, 0x96ad9b52
rol eax, 0xc2
popf
jmp 0x18016e993
jmp 0x18016f1de
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x18016f05f
push rax
pushf
mov eax, 0x6185732c
pushf
not eax
add eax, 0xfc315653
xor eax, 0xc7463c50
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xb73cc934
xor eax, 0xd7e1b3e1
rol eax, 0x7f
popf
pushf
not eax
add eax, 0xb7ffc30e
xor eax, 0xa94f1283
rol eax, 0x7b
popf
jmp 0x18016e993
push rax
pushf
mov eax, 0xf41aba01
pushf
not eax
add eax, 0xbcccb198
xor eax, 0xf0da8b38
rol eax, 0xb7
popf
pushf
not eax
add eax, 0xbf41b06e
xor eax, 0xbcee0b00
rol eax, 0x55
popf
pushf
not eax
add eax, 0xcd4cdbee
xor eax, 0x975e427f
rol eax, 0xf0
popf
jmp 0x18016e993
mov rcx, qword [0x180041538]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
jmp 0x18016f0ba
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x18016f121
push rax
pushf
mov eax, 0x4ac958c6
pushf
not eax
add eax, 0x883972d1
xor eax, 0xa7e1d596
rol eax, 0x2d
popf
pushf
not eax
add eax, 0xc9d4874f
xor eax, 0xe8dc5583
rol eax, 0xae
popf
pushf
not eax
add eax, 0xb8802a67
xor eax, 0xf6ac90cc
rol eax, 0x12
popf
pushf
not eax
add eax, 0xa54efed0
xor eax, 0xa3e11d8a
rol eax, 0x1f
popf
jmp 0x18016e993
push rax
pushf
mov eax, 0xedc321b
pushf
not eax
add eax, 0x817f3e73
xor eax, 0xdb93ce85
rol eax, 0xf9
popf
pushf
not eax
add eax, 0xe7b64701
xor eax, 0xec56a0dc
rol eax, 0xc1
popf
pushf
not eax
add eax, 0x88701f97
xor eax, 0xdf32d6b1
rol eax, 0xd4
popf
pushf
not eax
add eax, 0xfa668661
xor eax, 0xcaf7532c
rol eax, 0xbb
popf
jmp 0x18016e993
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
push rax
pushf
mov eax, 0x2530a145
pushf
not eax
add eax, 0xfe70cbd8
xor eax, 0xe4e2c0ca
rol eax, 0x51
popf
pushf
not eax
add eax, 0x9765b3aa
xor eax, 0xecd2e36b
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xb4731835
xor eax, 0xe455db7c
rol eax, 0xb6
popf
pushf
not eax
add eax, 0xba2a1add
xor eax, 0xa8bc6538
rol eax, 0xbb
popf
jmp 0x18016e993
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
jmp 0x18016f1e9
inc dword [rbx + 0xc]
push rax
pushf
mov eax, 0x2eb33e
pushf
not eax
add eax, 0xbe7533a8
xor eax, 0x84097b40
rol eax, 0x17
popf
pushf
not eax
add eax, 0xdc55fe5b
xor eax, 0xf63c5174
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xdbcdb294
xor eax, 0xf6978f03
rol eax, 0xb8
popf
jmp 0x18016e993
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x18016f2a8
push rax
pushf
mov eax, 0x9397c08e
pushf
not eax
add eax, 0xb6bb8bdd
xor eax, 0xf62e763e
rol eax, 0xd
popf
pushf
not eax
add eax, 0xb42fdbea
xor eax, 0xd117a59b
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xc0e8d3f9
xor eax, 0xca921043
rol eax, 0x8a
popf
pushf
not eax
add eax, 0xf8588ccb
xor eax, 0xc5fe7816
rol eax, 0xa5
popf
jmp 0x18016e993
push rax
pushf
mov eax, 0x5d842c24
pushf
not eax
add eax, 0xf941b99f
xor eax, 0xa14c220a
rol eax, 0x50
popf
pushf
not eax
add eax, 0xba3f82bd
xor eax, 0x945ca5d4
rol eax, 0xe7
popf
pushf
not eax
add eax, 0x89aa4dd8
xor eax, 0xe2b9384b
rol eax, 0x1a
popf
pushf
not eax
add eax, 0x9249b792
xor eax, 0x82d58778
rol eax, 0xb4
popf
jmp 0x18016e993
mov rcx, rdi
jmp 0x18016f305
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0x2c602623
pushf
not eax
add eax, 0xd900a2dc
xor eax, 0xb5bde5df
rol eax, 0x54
popf
pushf
not eax
add eax, 0x8187457c
xor eax, 0xb0d3e565
rol eax, 0x9e
popf
pushf
not eax
add eax, 0xb216b914
xor eax, 0xdbd52362
rol eax, 0x8c
popf
jmp 0x18016e993
cmp qword [rbx], rsi
je 0x18016f39c
push rax
pushf
mov eax, 0xb42e8c19
pushf
not eax
add eax, 0xe42ebdb8
xor eax, 0xe1730fad
rol eax, 0x41
popf
pushf
not eax
add eax, 0xdf84107a
xor eax, 0xe810801f
rol eax, 0xca
popf
pushf
not eax
add eax, 0xe2c4385b
xor eax, 0xac740108
rol eax, 0x6b
popf
jmp 0x18016e993
push rax
pushf
mov eax, 0x71dcc3f4
pushf
not eax
add eax, 0xf79bc99f
xor eax, 0x95253ef1
rol eax, 0x4d
popf
pushf
not eax
add eax, 0xbc8c82bf
xor eax, 0xe5ea80a9
rol eax, 0xe7
popf
pushf
not eax
add eax, 0xf0e5b371
xor eax, 0xc62ecdb7
rol eax, 0xc5
popf
pushf
not eax
add eax, 0x820a660f
xor eax, 0xda90f225
rol eax, 0xb1
popf
jmp 0x18016e993
cmp dword [rbx + 0xc], esi
jbe 0x18016f453
push rax
pushf
mov eax, 0xa0838c74
pushf
not eax
add eax, 0xfa9b4519
xor eax, 0xc072fde2
rol eax, 0xb2
popf
pushf
not eax
add eax, 0x94f6bcd1
xor eax, 0x86f46313
rol eax, 0xbb
popf
pushf
not eax
add eax, 0xd6d4514a
xor eax, 0xc077f107
rol eax, 0xe1
popf
pushf
not eax
add eax, 0xf9ec4055
xor eax, 0xd2f242b6
rol eax, 0xa5
popf
jmp 0x18016e993
push rax
pushf
mov eax, 0x5c1fe5de
pushf
not eax
add eax, 0xce6d40a8
xor eax, 0xa2854233
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xc98bbbd1
xor eax, 0xbb3f51ed
rol eax, 0x59
popf
pushf
not eax
add eax, 0xa26e1764
xor eax, 0xc6d6a75a
rol eax, 0x9e
popf
pushf
not eax
add eax, 0xab129bfd
xor eax, 0xad666d73
rol eax, 0xeb
popf
jmp 0x18016e993
nop dword [rax]
nop dword [rax + rax]
push rax
pushf
mov eax, 0x6d040ef5
pushf
not eax
add eax, 0xf4a41a46
xor eax, 0xeae1c711
rol eax, 0xd5
popf
pushf
not eax
add eax, 0xe72008a6
xor eax, 0xd5497344
rol eax, 0xfd
popf
pushf
not eax
add eax, 0x95d5b669
xor eax, 0x845f7403
rol eax, 0x94
popf
jmp 0x18016e993
mov rax, qword [rbx]
xor edx, edx
mov ecx, esi
mov r8d, dword [rax + rcx*4]
lea ecx, [rdx + 0x5a]
jmp 0x18016f50d
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18016f574
push rax
pushf
mov eax, 0xb0269702
pushf
not eax
add eax, 0x8c3cee0f
xor eax, 0x9629bc2e
rol eax, 0xe6
popf
pushf
not eax
add eax, 0xb8d19285
xor eax, 0xbe91e539
rol eax, 0xfd
popf
pushf
not eax
add eax, 0xc6546660
xor eax, 0xf7402b77
rol eax, 0xfd
popf
pushf
not eax
add eax, 0xf0e61e8f
xor eax, 0xbc00a918
rol eax, 0xae
popf
jmp 0x18016e993
push rax
pushf
mov eax, 0xf50fd18d
pushf
not eax
add eax, 0x9c15dccb
xor eax, 0x9b80eb3b
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xbeb52d28
xor eax, 0xa7245127
rol eax, 0x26
popf
jmp 0x18016e993
mov rcx, rax
jmp 0x18016f5ab
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.1800fa802
mov rcx, rdi
jmp 0x18016f5c3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18016f5ca
inc esi
cmp esi, dword [rbx + 0xc]
jb 0x18016f617
push rax
pushf
mov eax, 0xfdd28799
pushf
not eax
add eax, 0xd0e83470
xor eax, 0xa8a5a7d4
rol eax, 6
popf
pushf
not eax
add eax, 0xb68d90ab
xor eax, 0xcb71a200
rol eax, 0xb2
popf
pushf
not eax
add eax, 0xad8a652e
xor eax, 0xe55f1d40
rol eax, 0x72
popf
jmp 0x18016e993
push rax
pushf
mov eax, 0x21174d55
pushf
not eax
add eax, 0xe0caa8a2
xor eax, 0x99f694c9
rol eax, 0xbd
popf
pushf
not eax
add eax, 0x9d5445bd
xor eax, 0xf88b8aec
rol eax, 0xdc
popf
jmp 0x18016e993
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800e9129
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret