Function at 0x18000d750
Capabilities:
Contain obfuscated stackstrings
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x500]
sub rsp, 0x600
mov rax, qword [0x180064040]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
mov r14, r8
mov rsi, rdx
mov qword [rsp + 0x30], rdx
mov rbx, rcx
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rdi, vtable.std::exception.0
test eax, eax
jne 0x18000d829
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_suspend_main_thread:__d.
lea rcx, [rsp + 0x38]
call fcn.18001abc0
nop
mov rcx, rax
call fcn.18000c7b0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x18000d807
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d802
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ddbf
call fcn.18001c7c8
movdqa xmm0, xmmword [0x180052e60]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x40]
call fcn.18001e234
mov dword [rbp], 0x100001
lea rdx, [rbp - 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x18000d8c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_get_thread_context:__d.
lea rcx, [rsp + 0x38]
call fcn.18001abc0
nop
mov rcx, rax
call fcn.18000c7b0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x18000d8a6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d8a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ddc5
call fcn.18001c7c8
movdqa xmm0, xmmword [0x180052e60]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x40]
call fcn.18001e234
lea rdx, [rbx + 8]
mov rcx, rsi
call fcn.180010130
lea r15, vtable.NullLog.0
mov rcx, r15
mov rdx, qword [0x1800650d8]
test rdx, rdx
cmovne rcx, rdx
mov rdx, qword [rcx]
mov r9, qword [rdx]
mov r8, rax
lea rdx, str.Stored_hook_details_at_addr__p._n
call r9
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.LoadLibraryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
xor r8d, r8d
lea rdx, [rsp + 0x70]
call fcn.18000ecc0
nop
mov rcx, qword [rbp - 0x80]
lea rbx, [rcx*2 + 2]
mov r9d, 4
mov r8, rbx
mov rdx, rsi
call fcn.18000de00
mov r12, rax
lea r9, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova r9, qword [rsp + 0x70]
mov qword [rsp + 0x20], rbx
mov r8, rax
mov rdx, rsi
call fcn.18000dee0
mov dword [rbp + 0x4a0], 0x57565355
mov dword [rbp + 0x4a4], 0x50415251
mov dword [rbp + 0x4a8], 0x9c505141
mov dword [rbp + 0x4ac], 0x38ec8348
mov dword [rbp + 0x4b0], 0xbbbbb848
mov dword [rbp + 0x4b4], 0xbbbbbbbb
mov dword [rbp + 0x4b8], 0x8948bbbb
mov dword [rbp + 0x4bc], 0x48202444
mov dword [rbp + 0x4c0], 0xaaaaaab9
mov dword [rbp + 0x4c4], 0xaaaaaaaa
mov dword [rbp + 0x4c8], 0x2454ffaa
mov dword [rbp + 0x4cc], 0xc4834820
mov dword [rbp + 0x4d0], 0x41589d38
mov dword [rbp + 0x4d4], 0x5a584159
mov dword [rbp + 0x4d8], 0x5b5e5f59
mov dword [rbp + 0x4dc], 0xcccce95d
mov word [rbp + 0x4e0], 0xcccc
mov rdi, qword [rbp + 0xc8]
mov r9d, 0x40
lea r8d, [r9 + 2]
mov rdx, rsi
call fcn.18000de00
mov r8, rax
mov qword [rbp + 0xc8], rax
xor esi, esi
mov ebx, esi
movabs rcx, 0xbbbbbbbbbbbbbbbb
mov r10d, 0x80000000
mov r11d, 0xffffffff
movabs r9, 0xaaaaaaaaaaaaaaaa
nop dword [rax]
mov edx, ebx
cmp dword [rbp + rdx + 0x4a0], 0xcccccccc
jne 0x18000db4f
lea rax, [rdx + 4]
add rax, r8
mov rcx, rdi
sub rcx, rax
lea rax, [rcx + r10]
cmp rax, r11
ja 0x18000daa2
mov dword [rbp + rdx + 0x4a0], ecx
add ebx, 3
movabs rcx, 0xbbbbbbbbbbbbbbbb
jmp 0x18000db7b
lea rdx, str.Displacements_outside_32_bit_range_not_implemented_yet.
lea rcx, [rsp + 0x38]
call fcn.18001abc0
nop
mov rcx, rax
call fcn.18000c7b0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x18000dafa
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000daf5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ddd1
call fcn.18001c7c8
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
lea rax, vtable.std::exception.0
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x40]
call fcn.18001e234
mov r8, rdi
mov qword [rbp + 0xc8], rdi
movabs rcx, 0xbbbbbbbbbbbbbbbb
movabs r9, 0xaaaaaaaaaaaaaaaa
mov r10d, 0x80000000
mov r11d, 0xffffffff
jmp 0x18000db7b
cmp ebx, 0x3a
ja 0x18000db7b
mov rax, qword [rbp + rdx + 0x4a0]
cmp rax, r9
jne 0x18000db6b
mov qword [rbp + rdx + 0x4a0], r12
jmp 0x18000db78
cmp rax, rcx
jne 0x18000db7b
mov qword [rbp + rdx + 0x4a0], r13
add ebx, 7
inc ebx
cmp ebx, 0x3e
jbe 0x18000da60
mov qword [rsp + 0x20], 0x42
lea r9, [rbp + 0x4a0]
mov rdx, qword [rsp + 0x30]
call fcn.18000dee0
mov rcx, r15
mov rax, qword [0x1800650d8]
test rax, rax
cmovne rcx, rax
mov rax, qword [rcx]
mov r9, qword [rbp + 0xc8]
mov r8, rdi
lea rdx, str.Resuming_main_thread__old_IP__zx__new_IP__zx._n
call qword [rax]
cmp qword [rbp + 0xc8], rdi
je 0x18000dc75
lea rdx, [rbp - 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x18000dc75
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_set_thread_context:__d.
lea rcx, [rsp + 0x38]
call fcn.18001abc0
nop
mov rcx, rax
call fcn.18000c7b0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x18000dc4a
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000dc45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ddcb
call fcn.18001c7c8
movdqa xmm0, xmmword [0x180052e60]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
lea r12, vtable.std::exception.0
mov qword [rsp + 0x38], r12
lea rcx, [rsp + 0x40]
call fcn.18001e234
jmp 0x18000dc7c
lea r12, vtable.std::exception.0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x18000dd52
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_resume_main_thread:__d.
lea rcx, [rsp + 0x38]
call fcn.18001abc0
mov rdi, rax
mov rdx, qword [0x1800650d8]
test rdx, rdx
cmovne r15, rdx
mov rdx, qword [r15]
mov rbx, qword [rdx]
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 8]
mov r8, rax
lea rdx, str._hs_n
mov rcx, r15
call rbx
cmp dword [0x1800650cc], 0
jne 0x18000dcf2
cmp dword [0x180064c90], 0
sete sil
test esi, esi
je 0x18000ddd7
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x18000dd2f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000dd2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ddf4
call fcn.18001c7c8
movdqa xmm0, xmmword [0x180052e60]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x38], r12
lea rcx, [rsp + 0x40]
call fcn.18001e234
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x18000dd8f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000dd8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ddb9
call fcn.18001c7c8
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.18001c3d0
mov rbx, qword [rsp + 0x658]
add rsp, 0x600
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800232b4
int3
call fcn.1800232b4
int3
call fcn.1800232b4
nop
call fcn.1800232b4
nop
call fcn.1800232b4
nop
mov rdx, rdi
lea rcx, [rbp - 0x70]
call fcn.1800074b0
lea rdx, [0x1800586d0]
lea rcx, [rbp - 0x70]
call fcn.18001e690
nop
call fcn.1800232b4
int3