Function at 0x180007a30
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x20], 0
xor edx, edx
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xffffffffffffffff
je 0x180007cd8
mov dword [rsp + 0x40], 0x1c
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180007ccd
mov dword [rsp + 0x20], 1
mov eax, dword [rsp + 0x40]
cmp rax, 0x10
jb 0x180007c0e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x4c], eax
jne 0x180007c0e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x48], eax
je 0x180007c0e
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180007af8
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x180007af8
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], 0
cmp qword [rsp + 0x28], 0
je 0x180007c0e
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x180007b56
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], pe_nt_image_headers64
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl rax, 3
mov r8, rax
xor edx, edx
mov rcx, qword [0x1800264f0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
jne 0x180007b54
mov dword [rsp + 0x20], 0
jmp 0x180007bc4
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x180007bc4
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
shl rax, 3
mov r9, rax
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1800264f0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180007bbc
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
jmp 0x180007bc4
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x20], 0
jne 0x180007be3
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180007c2e
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x28]
mov qword [rcx + rax*8], rdx
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 0xc], eax
mov dword [rsp + 0x40], 0x1c
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180007a87
cmp dword [rsp + 0x20], 0
je 0x180007c48
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x180007c48
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x20], 0
jne 0x180007ccd
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x180007ccd
mov dword [rsp + 0x24], 0
jmp 0x180007c6e
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x24], eax
jae 0x180007caa
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180007c64
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1800264f0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x70]
mov qword [rax], 0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
add rsp, 0x68
ret