Function at 0x18002d720
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x180133da0], eax
je 0x18002d73c
mov eax, 0x10dd
jmp 0x18002d85b
mov rax, qword [0x180133d90]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18002d7e3
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x18002d7b2
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x18002d7b2
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.18002d4d0
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x18002d748
mov qword [0x180133d90], 0
call fcn.18002ce10
mov rax, qword [0x180133d80]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18002d844
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x18002d7ff
mov qword [0x180133d80], 0
mov dword [0x180133da0], 0
xor eax, eax
add rsp, 0x68
ret

Function at 0x18002ddf0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x180133da4], 0
je 0x18002de0d
mov eax, dword [0x180133da4]
jmp 0x18002ded3
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp qword [rsp + 0x50], rax
jne 0x18002de21
xor eax, eax
jmp 0x18002ded3
mov ecx, 0x10
call qword [sym.imp.MSVCR120.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18002de8c
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x18002de71
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x180133da4], eax
mov qword [0x180133d78], 0
mov eax, dword [rsp + 0x20]
jmp 0x18002ded3
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x18002dea8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x18002de4b
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x180133d80]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x180133d80], rax
xor eax, eax
add rsp, 0x48
ret