Function at 0x14004e330
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x558
cmp qword [rsp + 0x560], 0
je 0x14004e359
mov rcx, qword [rsp + 0x560]
mov rax, qword [0x140082400]
mov qword [rcx], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1400823f8], eax
je 0x14004e371
mov eax, 0x10dd
jmp 0x14004e79c
cmp dword [0x1400823fc], 0
je 0x14004e38a
call fcn.14004e120
mov eax, dword [0x1400823fc]
jmp 0x14004e79c
mov dword [rsp + 0x20], 0
mov rax, qword [0x140082410]
mov qword [rsp + 0x38], rax
jmp 0x14004e3ad
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14004e479
mov rax, qword [rsp + 0x38]
cmp dword [rax + 8], 0
je 0x14004e404
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x20]
movzx r8d, byte [rax + 0x3e]
mov rdx, qword [rsp + 0x38]
mov rdx, qword [rdx + 0x20]
add rdx, 0x20
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x18]
call fcn.140044e20
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x18]
mov qword [rcx], rax
jmp 0x14004e474
mov rdx, qword [rsp + 0x38]
mov rdx, qword [rdx + 0x20]
add rdx, 0x50
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x20]
add rcx, 0x58
call fcn.14004e810
mov rdx, qword [rsp + 0x38]
mov rdx, qword [rdx + 0x20]
add rdx, 0x58
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x18]
call fcn.14004e7b0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rdx, qword [rdx + 0x20]
mov rdx, qword [rdx + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.14004e890
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x20]
mov qword [rcx], rax
jmp 0x14004e3a0
mov rax, qword [0x140082408]
mov qword [rsp + 0x30], rax
jmp 0x14004e494
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14004e5fb
mov dword [rsp + 0x80], 0x100001
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14004e5f6
mov rax, qword [0x140082410]
mov qword [rsp + 0x38], rax
jmp 0x14004e4e2
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14004e5f6
mov rax, qword [rsp + 0x38]
cmp dword [rax + 8], 0
je 0x14004e572
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x20]
cmp qword [rsp + 0x148], rax
jb 0x14004e570
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x20]
add rax, 8
cmp qword [rsp + 0x148], rax
jae 0x14004e570
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x20]
mov rax, qword [rsp + 0x148]
sub rax, rcx
movzx edx, al
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x20]
call fcn.14004ea20
movzx eax, al
mov rcx, qword [rsp + 0x38]
add rax, qword [rcx + 0x18]
mov qword [rsp + 0x148], rax
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
jmp 0x14004e5f1
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x18]
cmp qword [rsp + 0x148], rax
jb 0x14004e5f1
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
mov rcx, qword [rsp + 0x38]
add rax, qword [rcx + 0x18]
cmp qword [rsp + 0x148], rax
jae 0x14004e5f1
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rsp + 0x148]
sub rax, rcx
movzx edx, al
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x20]
call fcn.14004ea90
cdqe
mov rcx, qword [rsp + 0x38]
add rax, qword [rcx + 0x20]
mov qword [rsp + 0x148], rax
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
jmp 0x14004e4d5
jmp 0x14004e487
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x28], rax
mov rax, qword [0x140082410]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14004e6e3
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x20]
movzx edx, byte [rax + 0x3e]
lea r9, [rsp + 0x528]
mov rax, qword [rsp + 0x38]
mov r8d, dword [rax + 0x28]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x20]
movzx r8d, byte [rax + 0x3e]
mov rdx, qword [rsp + 0x38]
mov rdx, qword [rdx + 0x18]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rax, qword [rsp + 0x38]
cmp dword [rax + 8], 0
je 0x14004e6a7
mov rax, qword [rsp + 0x38]
cmp qword [rax + 0x20], 0
je 0x14004e6a7
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x20]
call fcn.14004e2d0
mov r11, qword [rsp + 0x38]
mov qword [r11 + 0x20], 0
mov dword [rsp + 0x20], 1
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x520], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x538], rax
mov rcx, qword [rsp + 0x538]
call fcn.140042a98
mov rax, qword [rsp + 0x520]
mov qword [rsp + 0x38], rax
jmp 0x14004e612
mov qword [0x140082410], 0
cmp dword [rsp + 0x20], 0
je 0x14004e703
cmp dword [0x1400823f4], 0
jne 0x14004e703
call fcn.14004e8d0
call fcn.14004e260
mov rax, qword [0x140082408]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14004e764
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x530], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x540], rax
mov rcx, qword [rsp + 0x540]
call fcn.140042a98
mov rax, qword [rsp + 0x530]
mov qword [rsp + 0x30], rax
jmp 0x14004e714
mov qword [0x140082408], 0
mov dword [0x1400823f8], 0
cmp qword [rsp + 0x560], 0
je 0x14004e796
mov rcx, qword [rsp + 0x560]
mov rax, qword [0x140082400]
mov qword [rcx], rax
mov eax, dword [0x1400823fc]
add rsp, 0x558
ret