Function at 0x14006c291
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push rax
pushf
mov eax, 0xc97acd02
pushf
not eax
add eax, 0xe9f32790
xor eax, 0xf555ab56
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xbd9f543f
xor eax, 0x999910e5
rol eax, 0x70
popf
pushf
not eax
add eax, 0xe22baaf1
xor eax, 0xbbc6b797
rol eax, 0x3c
popf
cmp eax, 4
jne 0x14006c2e1
popf
pop rax
jmp 0x14006c66e
cmp eax, 0
jne 0x14006c2f0
popf
pop rax
jmp 0x14006c41c
cmp eax, 3
jne 0x14006c2ff
popf
pop rax
jmp 0x14006c5e9
cmp eax, 1
jne 0x14006c30e
popf
pop rax
jmp 0x14006c4de
cmp eax, 0xd
jne 0x14006c31d
popf
pop rax
jmp 0x14006cad7
cmp eax, 7
jne 0x14006c32c
popf
pop rax
jmp 0x14006c7f9
cmp eax, 0xe
jne 0x14006c33b
popf
pop rax
jmp 0x14006cb6d
cmp eax, 0xb
jne 0x14006c34a
popf
pop rax
jmp 0x14006ca45
cmp eax, 0xc
jne 0x14006c359
popf
pop rax
jmp 0x14006ca83
cmp eax, 8
jne 0x14006c368
popf
pop rax
jmp 0x14006c8b7
cmp eax, 0x10
jne 0x14006c377
popf
pop rax
jmp 0x14006cc74
cmp eax, 2
jne 0x14006c386
popf
pop rax
jmp 0x14006c587
cmp eax, 9
jne 0x14006c395
popf
pop rax
jmp 0x14006c915
cmp eax, 0x12
jne 0x14006c3a4
popf
pop rax
jmp 0x14006cd44
cmp eax, 6
jne 0x14006c3b3
popf
pop rax
jmp 0x14006c78b
cmp eax, 0x11
jne 0x14006c3c2
popf
pop rax
jmp 0x14006ccdf
cmp eax, 5
jne 0x14006c3d1
popf
pop rax
jmp 0x14006c6f3
cmp eax, 0x15
jne 0x14006c3e0
popf
pop rax
jmp 0x14006ce6a
cmp eax, 0xa
jne 0x14006c3ef
popf
pop rax
jmp 0x14006c9a9
cmp eax, 0x14
jne 0x14006c3fe
popf
pop rax
jmp 0x14006cdea
cmp eax, 0xf
jne 0x14006c40d
popf
pop rax
jmp 0x14006cbbd
cmp eax, 0x13
jne 0x14006c41c
popf
pop rax
jmp 0x14006cdc7
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14000a230]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov r14d, edx
mov rbx, rcx
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
xor edx, edx
mov ebp, r8d
lea ecx, [rsi + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14006c499
push rax
pushf
mov eax, 0x1f3dbfe6
pushf
not eax
add eax, 0xf7c2f501
xor eax, 0xed0a086d
rol eax, 0x9b
popf
pushf
not eax
add eax, 0x9e3cf3d7
xor eax, 0xe49079ef
rol eax, 0x7e
popf
jmp 0x14006c2d2
push rax
pushf
mov eax, 0xaea3bebf
pushf
not eax
add eax, 0xb3b1643a
xor eax, 0xab3982d2
rol eax, 0xad
popf
pushf
not eax
add eax, 0xd989cbbb
xor eax, 0xdc603b1f
rol eax, 1
popf
pushf
not eax
add eax, 0xb6593f69
xor eax, 0xa470218f
rol eax, 0x5f
popf
jmp 0x14006c2d2
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x14006c541
push rax
pushf
mov eax, 0xb7cecec0
pushf
not eax
add eax, 0x8f0f6d5f
xor eax, 0xb46b9062
rol eax, 0x9e
popf
pushf
not eax
add eax, 0x81fe727b
xor eax, 0xc88e5fc8
rol eax, 0xa4
popf
pushf
not eax
add eax, 0xb2a94bd5
xor eax, 0x96ca309a
rol eax, 0x37
popf
jmp 0x14006c2d2
push rax
pushf
mov eax, 0x46625174
pushf
not eax
add eax, 0xdc3df7de
xor eax, 0xf893cac0
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xe7aa53f9
xor eax, 0xc31b12ba
rol eax, 0xf8
popf
pushf
not eax
add eax, 0xd1b1b410
xor eax, 0xb5a1cf25
rol eax, 0xf2
popf
jmp 0x14006c2d2
nop word [rax + rax]
push rax
pushf
mov eax, 0x6aaa7b9c
pushf
not eax
add eax, 0xb2d34054
xor eax, 0xe6c61e86
rol eax, 0x15
popf
pushf
not eax
add eax, 0xf0cf9311
xor eax, 0xc58b5163
rol eax, 0xa4
popf
pushf
not eax
add eax, 0xc95a0ead
xor eax, 0x8e0fb5ba
rol eax, 0x60
popf
pushf
not eax
add eax, 0xe0342413
xor eax, 0x8a0fa710
rol eax, 0x9f
popf
jmp 0x14006c2d2
cmp dword [rsp + 0x20], 0x10
jb 0x14006c627
push rax
pushf
mov eax, 0x75174df5
pushf
not eax
add eax, 0xe8ca7ed3
xor eax, 0xfd92fa7b
rol eax, 0xed
popf
pushf
not eax
add eax, 0xe6d0c8c6
xor eax, 0xad7bf700
rol eax, 0x22
popf
jmp 0x14006c2d2
push rax
pushf
mov eax, 0xb74dfa10
pushf
not eax
add eax, 0x8d892706
xor eax, 0xc2c40ae0
rol eax, 4
popf
pushf
not eax
add eax, 0x8f8633a5
xor eax, 0xeffd8334
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xe1271b88
xor eax, 0xb875b350
rol eax, 0xb1
popf
jmp 0x14006c2d2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x14006c6bf
push rax
pushf
mov eax, 0x94e72ad1
pushf
not eax
add eax, 0xc15c6377
xor eax, 0xc93435d9
rol eax, 1
popf
pushf
not eax
add eax, 0x834ec92e
xor eax, 0xde223b64
rol eax, 0x4c
popf
pushf
not eax
add eax, 0xcda0ec32
xor eax, 0xe50be5c3
rol eax, 0x6a
popf
jmp 0x14006c2d2
push rax
pushf
mov eax, 0xc13ab9d3
pushf
not eax
add eax, 0xef376b9d
xor eax, 0xaa7a4484
rol eax, 0x5d
popf
pushf
not eax
add eax, 0x83e3acbf
xor eax, 0xd2f2c895
rol eax, 0x99
popf
jmp 0x14006c2d2
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x14006c758
push rax
pushf
mov eax, 0x42972d3e
pushf
not eax
add eax, 0x95b48ab2
xor eax, 0xe83195cc
rol eax, 0x47
popf
pushf
not eax
add eax, 0xd705461e
xor eax, 0xcdef2058
rol eax, 0x4d
popf
pushf
not eax
add eax, 0x90f2bc04
xor eax, 0xf3c50715
rol eax, 6
popf
pushf
not eax
add eax, 0xa59ae3b9
xor eax, 0xaa8f8fde
rol eax, 0xc
popf
jmp 0x14006c2d2
push rax
pushf
mov eax, 0xea3036f0
pushf
not eax
add eax, 0xe0978913
xor eax, 0xc19d67c0
rol eax, 0x9f
popf
pushf
not eax
add eax, 0xaccd5516
xor eax, 0x90d03ca4
rol eax, 0xf9
popf
jmp 0x14006c2d2
mov rdx, qword [rbx]
test rdx, rdx
jne 0x14006c7c6
push rax
pushf
mov eax, 0x67bf1dae
pushf
not eax
add eax, 0xdf0765dc
xor eax, 0xd9afd17c
rol eax, 0x11
popf
pushf
not eax
add eax, 0xd04db6eb
xor eax, 0x9aaa591b
rol eax, 0xe8
popf
jmp 0x14006c2d2
push rax
pushf
mov eax, 0x332f3b5b
pushf
not eax
add eax, 0xe59a9e94
xor eax, 0xd5160558
rol eax, 0x57
popf
pushf
not eax
add eax, 0xbe0e92dc
xor eax, 0x8dd3d428
rol eax, 0x30
popf
jmp 0x14006c2d2
mov dword [rbx + 8], 0x80
mov r8d, 0x543c473a
pushf
not r8d
add r8d, 0xc5eeb464
xor r8d, 0x9b8b492c
rol r8d, 0x85
popf
pushf
not r8d
add r8d, 0xfe47f868
xor r8d, 0xb72377a8
rol r8d, 0xa8
popf
mov rcx, qword [0x14000a338]
jmp 0x14006c840
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x14006c884
push rax
pushf
mov eax, 0x79bc0f5d
pushf
not eax
add eax, 0x9d12be5e
xor eax, 0xb92fb76e
rol eax, 0x62
popf
pushf
not eax
add eax, 0xfa7b9e57
xor eax, 0x90973c9e
rol eax, 0x42
popf
jmp 0x14006c2d2
push rax
pushf
mov eax, 0x5d31b404
pushf
not eax
add eax, 0xced2dcf3
xor eax, 0xca19bef0
rol eax, 0x9c
popf
pushf
not eax
add eax, 0xd986423f
xor eax, 0xee4ab8dd
rol eax, 0xca
popf
jmp 0x14006c2d2
jmp 0x14006ca83
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x14006c950
push rax
pushf
mov eax, 0x63cedb89
pushf
not eax
add eax, 0xfe2889bd
xor eax, 0xbd44c969
rol eax, 0x42
popf
pushf
not eax
add eax, 0x80449a3d
xor eax, 0xe3cefcde
rol eax, 0x40
popf
jmp 0x14006c2d2
push rax
pushf
mov eax, 0xf967b15a
pushf
not eax
add eax, 0xe6f6d3d5
xor eax, 0xc0735ecf
rol eax, 0x58
popf
pushf
not eax
add eax, 0xd1cb6264
xor eax, 0xf21cd8f8
rol eax, 4
popf
pushf
not eax
add eax, 0xdcbbf5e5
xor eax, 0xb51c8e3e
rol eax, 0x78
popf
pushf
not eax
add eax, 0xd065c082
xor eax, 0xf8241bd4
rol eax, 0x17
popf
jmp 0x14006c2d2
mov rcx, qword [0x14000a338]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
jmp 0x14006c9be
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x14006c9ff
push rax
pushf
mov eax, 0x37652f8f
pushf
not eax
add eax, 0xad08352a
xor eax, 0xb910979a
rol eax, 0x74
popf
pushf
not eax
add eax, 0xe4887c9c
xor eax, 0xc47e3162
rol eax, 0x11
popf
jmp 0x14006c2d2
push rax
pushf
mov eax, 0x3384a03c
pushf
not eax
add eax, 0xd40e707a
xor eax, 0xd6d6b7fd
rol eax, 0
popf
pushf
not eax
add eax, 0xd6a298ff
xor eax, 0xff4cfe8e
rol eax, 0x6d
popf
pushf
not eax
add eax, 0xb635e02b
xor eax, 0xbfbfcc49
rol eax, 0x6a
popf
jmp 0x14006c2d2
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
push rax
pushf
mov eax, 0x881fb9f6
pushf
not eax
add eax, 0xbbf875b6
xor eax, 0xdd194669
rol eax, 0xf4
popf
pushf
not eax
add eax, 0x8560fb6b
xor eax, 0xa7ea0f4b
rol eax, 0xcf
popf
jmp 0x14006c2d2
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
jmp 0x14006ca8e
inc dword [rbx + 0xc]
push rax
pushf
mov eax, 0xac78cfff
pushf
not eax
add eax, 0xb14934cf
xor eax, 0xc1edb50a
rol eax, 0x6a
popf
pushf
not eax
add eax, 0xec0bc389
xor eax, 0xe6583c57
rol eax, 0xce
popf
pushf
not eax
add eax, 0xcb0b0097
xor eax, 0xa704bbef
rol eax, 0xd1
popf
jmp 0x14006c2d2
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x14006cb27
push rax
pushf
mov eax, 0x84061d0
pushf
not eax
add eax, 0xadc75f85
xor eax, 0xfc021a98
rol eax, 0x57
popf
pushf
not eax
add eax, 0x8f4ee0c5
xor eax, 0xfe221e51
rol eax, 0x89
popf
jmp 0x14006c2d2
push rax
pushf
mov eax, 0x2a936a53
pushf
not eax
add eax, 0xa0b7c682
xor eax, 0x8af1a35a
rol eax, 7
popf
pushf
not eax
add eax, 0xfd0747bd
xor eax, 0xce16852f
rol eax, 0x4c
popf
pushf
not eax
add eax, 0xc2d7180b
xor eax, 0xb2560449
rol eax, 0xb7
popf
jmp 0x14006c2d2
mov rcx, rdi
jmp 0x14006cb71
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0x6f5989e6
pushf
not eax
add eax, 0xfbba1939
xor eax, 0xf571dafe
rol eax, 0x9b
popf
pushf
not eax
add eax, 0x9f86ab10
xor eax, 0xcde0b789
rol eax, 0x6b
popf
pushf
not eax
add eax, 0xaea57259
xor eax, 0xb9f812a6
rol eax, 0xaf
popf
jmp 0x14006c2d2
cmp qword [rbx], rsi
je 0x14006cc1b
push rax
pushf
mov eax, 0x46ba68bb
pushf
not eax
add eax, 0xda2f5bc2
xor eax, 0x91b81371
rol eax, 0x64
popf
pushf
not eax
add eax, 0xabd358e9
xor eax, 0xf9466bdd
rol eax, 0xb0
popf
pushf
not eax
add eax, 0x8926cd24
xor eax, 0x8ff087e0
rol eax, 0xaf
popf
pushf
not eax
add eax, 0xb4a466eb
xor eax, 0xd4260632
rol eax, 0x93
popf
jmp 0x14006c2d2
push rax
pushf
mov eax, 0x48866c86
pushf
not eax
add eax, 0xc021d9ae
xor eax, 0x89b14a0a
rol eax, 0x9c
popf
pushf
not eax
add eax, 0xa7d7b5a0
xor eax, 0xaa53728d
rol eax, 0xa4
popf
pushf
not eax
add eax, 0x920b065d
xor eax, 0x940a039b
rol eax, 0x52
popf
pushf
not eax
add eax, 0x9bd82289
xor eax, 0xdca3c7cd
rol eax, 0x16
popf
jmp 0x14006c2d2
cmp dword [rbx + 0xc], esi
jbe 0x14006ccac
push rax
pushf
mov eax, 0xb6faa41d
pushf
not eax
add eax, 0xfdce82cc
xor eax, 0x86eb9208
rol eax, 0x60
popf
pushf
not eax
add eax, 0x91318314
xor eax, 0xd2d9366d
rol eax, 0xab
popf
jmp 0x14006c2d2
push rax
pushf
mov eax, 0xe2bffa2c
pushf
not eax
add eax, 0x88bbabd5
xor eax, 0xba2eb257
rol eax, 0x1e
popf
pushf
not eax
add eax, 0xb092adc3
xor eax, 0xe89d6983
rol eax, 0x3a
popf
jmp 0x14006c2d2
nop dword [rax]
nop dword [rax + rax]
push rax
pushf
mov eax, 0x68508999
pushf
not eax
add eax, 0xa9c6300b
xor eax, 0xf8d91bcb
rol eax, 0xa9
popf
pushf
not eax
add eax, 0xffe5e7c9
xor eax, 0xf68428ab
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xf9e0e9a0
xor eax, 0xa9a27fb1
rol eax, 0x94
popf
pushf
not eax
add eax, 0xf4a5865a
xor eax, 0xd7cd2043
rol eax, 0xeb
popf
jmp 0x14006c2d2
mov r8, qword [rbx]
xor edx, edx
mov eax, esi
lea ecx, [rdx + 0x5a]
mov r8d, dword [r8 + rax*4]
jmp 0x14006cd53
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x14006cd94
push rax
pushf
mov eax, 0xcaa2487f
pushf
not eax
add eax, 0xe0a3f619
xor eax, 0x8bcf45cd
rol eax, 0x9b
popf
pushf
not eax
add eax, 0x9078ba52
xor eax, 0xeb8a500f
rol eax, 0x38
popf
jmp 0x14006c2d2
push rax
pushf
mov eax, 0xd28f102e
pushf
not eax
add eax, 0xb52d193f
xor eax, 0x82d65889
rol eax, 0x7b
popf
pushf
not eax
add eax, 0xc9654186
xor eax, 0xfe62eaf9
rol eax, 0xf8
popf
jmp 0x14006c2d2
mov rcx, rax
jmp 0x14006cdcb
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.140062684
mov rcx, rdi
jmp 0x14006cde3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14006cdea
inc esi
cmp esi, dword [rbx + 0xc]
jb 0x14006ce37
push rax
pushf
mov eax, 0xf4476315
pushf
not eax
add eax, 0xf9d133c9
xor eax, 0xb24b22f9
rol eax, 0x43
popf
pushf
not eax
add eax, 0xd320f0a3
xor eax, 0xe1826508
rol eax, 0x88
popf
pushf
not eax
add eax, 0xc405b27b
xor eax, 0x90ca6c86
rol eax, 5
popf
jmp 0x14006c2d2
push rax
pushf
mov eax, 0xf615040c
pushf
not eax
add eax, 0x90e9d6a6
xor eax, 0xfb8ed0b5
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xfcafe95b
xor eax, 0xe084a915
rol eax, 0xa5
popf
jmp 0x14006c2d2
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140060848
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret