Function at 0x14006cee6
Capabilities:
Authenticate hmac
Enumerate threads
Suspend thread

Disassembly:
push rax
pushf
mov eax, 0xd01c6cfe
pushf
not eax
add eax, 0xc8c72231
xor eax, 0xbb9093ed
rol eax, 0x95
popf
pushf
not eax
add eax, 0xf02e0cb2
xor eax, 0xe107e60c
rol eax, 0xae
popf
pushf
not eax
add eax, 0xbbb5905e
xor eax, 0xdaec8f74
rol eax, 4
popf
pushf
not eax
add eax, 0xeff5615c
xor eax, 0xecdb99bc
rol eax, 0x5c
popf
cmp eax, 4
jne 0x14006cf49
popf
pop rax
jmp 0x14006d2fd
cmp eax, 0
jne 0x14006cf58
popf
pop rax
jmp 0x14006d084
cmp eax, 3
jne 0x14006cf67
popf
pop rax
jmp 0x14006d278
cmp eax, 1
jne 0x14006cf76
popf
pop rax
jmp 0x14006d16d
cmp eax, 0xd
jne 0x14006cf85
popf
pop rax
jmp 0x14006d804
cmp eax, 7
jne 0x14006cf94
popf
pop rax
jmp 0x14006d4e7
cmp eax, 0xe
jne 0x14006cfa3
popf
pop rax
jmp 0x14006d89a
cmp eax, 0xb
jne 0x14006cfb2
popf
pop rax
jmp 0x14006d772
cmp eax, 0xc
jne 0x14006cfc1
popf
pop rax
jmp 0x14006d7c3
cmp eax, 8
jne 0x14006cfd0
popf
pop rax
jmp 0x14006d5e4
cmp eax, 0x10
jne 0x14006cfdf
popf
pop rax
jmp 0x14006d97b
cmp eax, 2
jne 0x14006cfee
popf
pop rax
jmp 0x14006d216
cmp eax, 9
jne 0x14006cffd
popf
pop rax
jmp 0x14006d62f
cmp eax, 0x12
jne 0x14006d00c
popf
pop rax
jmp 0x14006da71
cmp eax, 6
jne 0x14006d01b
popf
pop rax
jmp 0x14006d440
cmp eax, 0x11
jne 0x14006d02a
popf
pop rax
jmp 0x14006da0c
cmp eax, 5
jne 0x14006d039
popf
pop rax
jmp 0x14006d3a9
cmp eax, 0x15
jne 0x14006d048
popf
pop rax
jmp 0x14006dbf6
cmp eax, 0xa
jne 0x14006d057
popf
pop rax
jmp 0x14006d6c3
cmp eax, 0x14
jne 0x14006d066
popf
pop rax
jmp 0x14006db63
cmp eax, 0xf
jne 0x14006d075
popf
pop rax
jmp 0x14006d8d7
cmp eax, 0x13
jne 0x14006d084
popf
pop rax
jmp 0x14006db40
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14000a230]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov r14d, edx
mov rbx, rcx
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
xor edx, edx
mov ebp, r8d
lea ecx, [rsi + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14006d127
push rax
pushf
mov eax, 0xf0c4e8d6
pushf
not eax
add eax, 0xa80ae6c2
xor eax, 0xccc260a0
rol eax, 0xfa
popf
pushf
not eax
add eax, 0xfe415d5e
xor eax, 0xc0ebd03c
rol eax, 0x8a
popf
pushf
not eax
add eax, 0xf7e88951
xor eax, 0xea438555
rol eax, 0x4e
popf
pushf
not eax
add eax, 0x9cd555c4
xor eax, 0xed3e5628
rol eax, 0x89
popf
jmp 0x14006cf3a
push rax
pushf
mov eax, 0x85c13e1
pushf
not eax
add eax, 0xa0a6c669
xor eax, 0xb9a0f087
rol eax, 0x69
popf
pushf
not eax
add eax, 0xfd2b6594
xor eax, 0xe859a2ed
rol eax, 0x4c
popf
pushf
not eax
add eax, 0xa3615ee2
xor eax, 0xb6e59cd2
rol eax, 0xf7
popf
jmp 0x14006cf3a
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x14006d1d0
push rax
pushf
mov eax, 0xfafb0117
pushf
not eax
add eax, 0xfec7e7b3
xor eax, 0xd23d7ba8
rol eax, 0xd8
popf
pushf
not eax
add eax, 0xd8a96c81
xor eax, 0x95094ca2
rol eax, 0x2f
popf
pushf
not eax
add eax, 0xcbb3511b
xor eax, 0x9092b82b
rol eax, 0xe4
popf
jmp 0x14006cf3a
push rax
pushf
mov eax, 0x9608d341
pushf
not eax
add eax, 0x837a288f
xor eax, 0xeaff5128
rol eax, 0xa9
popf
pushf
not eax
add eax, 0xbbf2bb31
xor eax, 0xff022624
rol eax, 0xcd
popf
pushf
not eax
add eax, 0xebdcaa59
xor eax, 0xf0fbfe38
rol eax, 2
popf
jmp 0x14006cf3a
nop word [rax + rax]
push rax
pushf
mov eax, 0x169c24ea
pushf
not eax
add eax, 0xfeaecad2
xor eax, 0xe4ce0854
rol eax, 0x27
popf
pushf
not eax
add eax, 0xd515219d
xor eax, 0x81550df1
rol eax, 0xe0
popf
pushf
not eax
add eax, 0xeb40a266
xor eax, 0x9e507266
rol eax, 0x6c
popf
pushf
not eax
add eax, 0xf4f9c0eb
xor eax, 0xa21b371a
rol eax, 0x50
popf
jmp 0x14006cf3a
cmp dword [rsp + 0x20], 0x10
jb 0x14006d2b6
push rax
pushf
mov eax, 0x2217aae3
pushf
not eax
add eax, 0xab24f1b4
xor eax, 0xfad95660
rol eax, 0xa2
popf
pushf
not eax
add eax, 0x90b20437
xor eax, 0xc361c175
rol eax, 0x69
popf
jmp 0x14006cf3a
push rax
pushf
mov eax, 0x2dcea645
pushf
not eax
add eax, 0xcf23c1d2
xor eax, 0x8baf66ba
rol eax, 0xed
popf
pushf
not eax
add eax, 0xdff32411
xor eax, 0xad303552
rol eax, 0xa2
popf
pushf
not eax
add eax, 0xded0bd8a
xor eax, 0x80df0dfd
rol eax, 0x45
popf
jmp 0x14006cf3a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x14006d362
push rax
pushf
mov eax, 0x1cc8ab40
pushf
not eax
add eax, 0xa427a699
xor eax, 0xf1895225
rol eax, 0x85
popf
pushf
not eax
add eax, 0xad549456
xor eax, 0x922983b2
rol eax, 0xbb
popf
pushf
not eax
add eax, 0xe77182b5
xor eax, 0xb4f9fa50
rol eax, 0x54
popf
pushf
not eax
add eax, 0xc1cd1eaf
xor eax, 0xaf0487eb
rol eax, 0x79
popf
jmp 0x14006cf3a
push rax
pushf
mov eax, 0x45f90d2b
pushf
not eax
add eax, 0xf27e01c5
xor eax, 0xb86f5fba
rol eax, 0xe3
popf
pushf
not eax
add eax, 0x8a3e9b8a
xor eax, 0xba60a26b
rol eax, 0x4a
popf
pushf
not eax
add eax, 0xb1ac6ddd
xor eax, 0xaa2c307a
rol eax, 0x36
popf
jmp 0x14006cf3a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x14006d3fa
push rax
pushf
mov eax, 0x5542b842
pushf
not eax
add eax, 0xc5522cdd
xor eax, 0x91c8f703
rol eax, 0xe8
popf
pushf
not eax
add eax, 0x8e947733
xor eax, 0xe1b33a56
rol eax, 0x2b
popf
pushf
not eax
add eax, 0xb9662c03
xor eax, 0x9a2df2ce
rol eax, 1
popf
jmp 0x14006cf3a
push rax
pushf
mov eax, 0x2d4697ce
pushf
not eax
add eax, 0x92e02f98
xor eax, 0x9543bf8e
rol eax, 0x56
popf
pushf
not eax
add eax, 0xa420ec95
xor eax, 0xf24a9290
rol eax, 0xae
popf
pushf
not eax
add eax, 0xd400f146
xor eax, 0x9ada592a
rol eax, 0xc4
popf
jmp 0x14006cf3a
mov rdx, qword [rbx]
test rdx, rdx
jne 0x14006d48e
push rax
pushf
mov eax, 0x98a9e5a1
pushf
not eax
add eax, 0xf033ba66
xor eax, 0xcdde5b01
rol eax, 0xbe
popf
pushf
not eax
add eax, 0xb150573b
xor eax, 0xc4a425e7
rol eax, 0x87
popf
pushf
not eax
add eax, 0xc383e45e
xor eax, 0xc4588d16
rol eax, 0x84
popf
jmp 0x14006cf3a
push rax
pushf
mov eax, 0xdaa2b2f
pushf
not eax
add eax, 0xbe824bc5
xor eax, 0x93c35f8d
rol eax, 0x76
popf
pushf
not eax
add eax, 0xac9dac25
xor eax, 0xf9c88a0b
rol eax, 0x23
popf
pushf
not eax
add eax, 0x82476f6b
xor eax, 0x87abeabc
rol eax, 0x70
popf
pushf
not eax
add eax, 0xbe872541
xor eax, 0xa045a478
rol eax, 0x51
popf
jmp 0x14006cf3a
mov dword [rbx + 8], 0x80
mov r8d, 0x10ef5623
pushf
not r8d
add r8d, 0xe09cbb5b
xor r8d, 0x90bb8fa9
rol r8d, 0x1a
popf
pushf
not r8d
add r8d, 0xabd39f32
xor r8d, 0xa0d1ee29
rol r8d, 0xbe
popf
pushf
not r8d
add r8d, 0xd28ff123
xor r8d, 0xadee45b7
rol r8d, 0x4a
popf
mov rcx, qword [0x14000a348]
jmp 0x14006d547
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x14006d5b1
push rax
pushf
mov eax, 0x6db68051
pushf
not eax
add eax, 0x93f4d0fb
xor eax, 0x800564a0
rol eax, 0x3b
popf
pushf
not eax
add eax, 0x9d924977
xor eax, 0x9307f4f2
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xb802e8cf
xor eax, 0xbc95639b
rol eax, 0xc7
popf
pushf
not eax
add eax, 0xb3f31b1e
xor eax, 0x83de1e59
rol eax, 0xe0
popf
jmp 0x14006cf3a
push rax
pushf
mov eax, 0xaecdddfa
pushf
not eax
add eax, 0xba8aacbc
xor eax, 0x9addf124
rol eax, 0xb5
popf
pushf
not eax
add eax, 0x8a644504
xor eax, 0x8db2f8dc
rol eax, 0x54
popf
jmp 0x14006cf3a
jmp 0x14006d7c3
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x14006d67d
push rax
pushf
mov eax, 0x8901d24b
pushf
not eax
add eax, 0x8371f926
xor eax, 0x820710c4
rol eax, 0x49
popf
pushf
not eax
add eax, 0xe7002528
xor eax, 0xf3a4a0aa
rol eax, 0x95
popf
pushf
not eax
add eax, 0xbab7a587
xor eax, 0xa71c3e9d
rol eax, 0xf0
popf
jmp 0x14006cf3a
push rax
pushf
mov eax, 0x3caa5a00
pushf
not eax
add eax, 0x8bf45d44
xor eax, 0xd59bc89b
rol eax, 0xd0
popf
pushf
not eax
add eax, 0xad92225e
xor eax, 0xff290396
rol eax, 0x21
popf
pushf
not eax
add eax, 0xdc10234b
xor eax, 0x9eef1bd6
rol eax, 0x7c
popf
jmp 0x14006cf3a
mov rcx, qword [0x14000a348]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
jmp 0x14006d6d8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x14006d72c
push rax
pushf
mov eax, 0xb2761582
pushf
not eax
add eax, 0x92e5714b
xor eax, 0x82518e08
rol eax, 0x14
popf
pushf
not eax
add eax, 0xa7ee76f3
xor eax, 0xd5738ed5
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xd3cf5ea2
xor eax, 0xe4e70454
rol eax, 0xf8
popf
jmp 0x14006cf3a
push rax
pushf
mov eax, 0x93f20ba9
pushf
not eax
add eax, 0xccd9bbc3
xor eax, 0x85db5de5
rol eax, 0x87
popf
pushf
not eax
add eax, 0xe49cb64c
xor eax, 0x993ea602
rol eax, 0xf8
popf
pushf
not eax
add eax, 0xdb7885ee
xor eax, 0xeb996adb
rol eax, 0xe1
popf
jmp 0x14006cf3a
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
push rax
pushf
mov eax, 0x64544c9e
pushf
not eax
add eax, 0xf8950767
xor eax, 0x994d44e1
rol eax, 0xfb
popf
pushf
not eax
add eax, 0xfe3ad665
xor eax, 0xfa025418
rol eax, 3
popf
pushf
not eax
add eax, 0xdc577c16
xor eax, 0xddd5e8ba
rol eax, 0x43
popf
jmp 0x14006cf3a
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
jmp 0x14006d7ce
inc dword [rbx + 0xc]
push rax
pushf
mov eax, 0x92821cd4
pushf
not eax
add eax, 0x87b2de07
xor eax, 0xc4da8534
rol eax, 0x77
popf
pushf
not eax
add eax, 0xfe21c9f3
xor eax, 0xfb08d4e4
rol eax, 0x1e
popf
jmp 0x14006cf3a
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x14006d867
push rax
pushf
mov eax, 0x6345e250
pushf
not eax
add eax, 0x86e39407
xor eax, 0xae5e35ce
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xed3e46f1
xor eax, 0xfe7edee8
rol eax, 0xeb
popf
pushf
not eax
add eax, 0xc7adbc35
xor eax, 0xef697085
rol eax, 0xba
popf
jmp 0x14006cf3a
push rax
pushf
mov eax, 0x577bb67d
pushf
not eax
add eax, 0xd1bcae7d
xor eax, 0xcbbd8d10
rol eax, 4
popf
pushf
not eax
add eax, 0xb9e2602b
xor eax, 0x9a6ab12f
rol eax, 0x8b
popf
jmp 0x14006cf3a
mov rcx, rdi
jmp 0x14006d89e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0x6bb10244
pushf
not eax
add eax, 0xd168ebef
xor eax, 0xfa7ff0a2
rol eax, 0xff
popf
pushf
not eax
add eax, 0xc32daf9f
xor eax, 0xf349a31d
rol eax, 0x21
popf
jmp 0x14006cf3a
cmp qword [rbx], rsi
je 0x14006d935
push rax
pushf
mov eax, 0x81663b47
pushf
not eax
add eax, 0xc3ad70cd
xor eax, 0x8bffa488
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xb85216a7
xor eax, 0xdb73dd43
rol eax, 0xd4
popf
pushf
not eax
add eax, 0x8e5c5121
xor eax, 0xe9f2a72b
rol eax, 0xd6
popf
pushf
not eax
add eax, 0x8ddecb21
xor eax, 0xcf93be38
rol eax, 0x28
popf
jmp 0x14006cf3a
push rax
pushf
mov eax, 0x53a3fb78
pushf
not eax
add eax, 0x835edf8e
xor eax, 0x91b7c8ab
rol eax, 0xd0
popf
pushf
not eax
add eax, 0xe3b8505a
xor eax, 0xaeea5921
rol eax, 7
popf
pushf
not eax
add eax, 0xae91bb80
xor eax, 0xe4ac04f6
rol eax, 0xe2
popf
jmp 0x14006cf3a
cmp dword [rbx + 0xc], esi
jbe 0x14006d9d9
push rax
pushf
mov eax, 0x68b8ffe6
pushf
not eax
add eax, 0xcd5dffac
xor eax, 0x8050fa62
rol eax, 0x2d
popf
pushf
not eax
add eax, 0xd8d2b33b
xor eax, 0xa8d1fd4e
rol eax, 0x9f
popf
pushf
not eax
add eax, 0xd51a202d
xor eax, 0xad6d4b04
rol eax, 0x48
popf
pushf
not eax
add eax, 0xd36a83f8
xor eax, 0xf4b93c8e
rol eax, 0x7d
popf
jmp 0x14006cf3a
push rax
pushf
mov eax, 0x22fa518f
pushf
not eax
add eax, 0xb5c4f1c4
xor eax, 0xf423a2bc
rol eax, 0x99
popf
pushf
not eax
add eax, 0xe774e89d
xor eax, 0xd6a7163f
rol eax, 0x7d
popf
jmp 0x14006cf3a
nop dword [rax]
nop dword [rax + rax]
push rax
pushf
mov eax, 0xef8c2e06
pushf
not eax
add eax, 0xe80676e4
xor eax, 0xa6c4273d
rol eax, 0x65
popf
pushf
not eax
add eax, 0x84cbebd0
xor eax, 0x98373c01
rol eax, 0x9f
popf
pushf
not eax
add eax, 0xe78e3895
xor eax, 0x8d83f983
rol eax, 0xd2
popf
pushf
not eax
add eax, 0x81cc20ba
xor eax, 0xa5051a8d
rol eax, 0x3a
popf
jmp 0x14006cf3a
mov r8, qword [rbx]
xor edx, edx
mov eax, esi
lea ecx, [rdx + 0x5a]
mov r8d, dword [r8 + rax*4]
jmp 0x14006da80
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x14006dae7
push rax
pushf
mov eax, 0x7f0ce9b0
pushf
not eax
add eax, 0xa2bdf6fd
xor eax, 0xa4ff9670
rol eax, 0xf9
popf
pushf
not eax
add eax, 0xc878bd80
xor eax, 0xa55c9fc6
rol eax, 0x6b
popf
pushf
not eax
add eax, 0x8bf7e65b
xor eax, 0xdd14bcf9
rol eax, 0xd4
popf
pushf
not eax
add eax, 0x976d9f64
xor eax, 0xda0d1066
rol eax, 0xeb
popf
jmp 0x14006cf3a
push rax
pushf
mov eax, 0x5a7b7e19
pushf
not eax
add eax, 0x9e1348e0
xor eax, 0xd5a3c76d
rol eax, 0x4e
popf
pushf
not eax
add eax, 0x9b153ac3
xor eax, 0xc8ae43aa
rol eax, 0xca
popf
pushf
not eax
add eax, 0xd9b146a3
xor eax, 0xf714d3be
rol eax, 0x67
popf
pushf
not eax
add eax, 0xeade5351
xor eax, 0xc9d105b1
rol eax, 0xdb
popf
jmp 0x14006cf3a
mov rcx, rax
jmp 0x14006db44
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.140063277
mov rcx, rdi
jmp 0x14006db5c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14006db63
inc esi
cmp esi, dword [rbx + 0xc]
jb 0x14006db9d
push rax
pushf
mov eax, 0xf98ce49
pushf
not eax
add eax, 0xcb1dade9
xor eax, 0xe94dae95
rol eax, 0x95
popf
pushf
not eax
add eax, 0xfec7d8ce
xor eax, 0xdd7d7d3f
rol eax, 0x5b
popf
jmp 0x14006cf3a
push rax
pushf
mov eax, 0xee9675af
pushf
not eax
add eax, 0xd6f9af05
xor eax, 0xb15cd7ca
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xce0a0ea2
xor eax, 0xa76c952e
rol eax, 0x17
popf
pushf
not eax
add eax, 0xa63a6852
xor eax, 0xa610701f
rol eax, 0x1e
popf
pushf
not eax
add eax, 0xcfa4f1ad
xor eax, 0xfdddddeb
rol eax, 0xf7
popf
jmp 0x14006cf3a
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140061636
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret