Function at 0x140088df0
Capabilities:
Suspend thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x540
mov qword [rbp - 0x520], rbx
mov qword [rbp - 0x518], rsi
mov qword [rbp - 0x510], rdi
mov rsi, rcx
mov qword [rbp - 0x500], 0x64
mov rcx, rsi
call fcn.140032fc0
xor al, 1
jne 0x140088fd9
cmp byte [rsi + 0x49], 0
je 0x140088f9c
lea rcx, [0x1400be9d8]
call sub.KERNEL32.dll_LeaveCriticalSection
mov rax, qword [rbp - 0x500]
mov qword [rbp - 0x4f8], rax
neg rax
sbb rax, 0
shr rax, 0x3f
and eax, 1
mov rbx, qword [rbp - 0x500]
shr rbx, 0x3f
and ebx, 1
sub eax, ebx
xor edx, edx
cmp eax, edx
jle 0x140088eb0
mov edi, 0x2710
cmp qword [rbp - 0x500], rdi
setg cl
and ecx, 1
cmp qword [rbp - 0x500], rdi
setl al
and eax, 1
sub ecx, eax
cmp ecx, edx
jns 0x140088eb0
mov qword [rbp - 0x4f8], 0x2710
mov rbx, qword [rbp - 0x4f8]
movabs rdx, 0x270fffffb1e0
cmp rbx, rdx
setg dil
and edi, 1
cmp rbx, rdx
setl cl
and ecx, 1
sub edi, ecx
test edi, edi
jle 0x140088f23
mov ecx, 0xfffffffe
call sub.KERNEL32.dll_Sleep
movabs rax, 0x270fffffb1e0
sub qword [rbp - 0x4f8], rax
mov rdx, qword [rbp - 0x4f8]
cmp rdx, rax
setg bl
and ebx, 1
cmp rdx, rax
setl dil
and edi, 1
sub ebx, edi
test ebx, ebx
jg 0x140088ee1
mov rcx, qword [rbp - 0x4f8]
movabs rax, 0x346dc5d63886594b
imul rcx
mov rax, rcx
sar rax, 0x3f
sar rdx, 0xb
sub rdx, rax
mov ecx, edx
call sub.KERNEL32.dll_Sleep
mov rax, qword [rbp - 0x500]
mov edx, 0x186a0
cmp rax, rdx
setg bl
and ebx, 1
cmp rax, rdx
setl dil
and edi, 1
sub ebx, edi
test ebx, ebx
jns 0x140088f7f
shl qword [rbp - 0x500], 1
lea rcx, [0x1400be9d8]
call sub.KERNEL32.dll_EnterCriticalSection
mov rcx, rsi
call fcn.140032fc0
xor al, 1
jne 0x140088fd9
jmp 0x140088e2e
mov eax, dword [rsi + 0x10]
mov qword [rbp - 0x508], rax
call sub.KERNEL32.dll_GetCurrentThreadId
mov edx, eax
mov rax, qword [rbp - 0x508]
cmp eax, edx
je 0x140088ffd
mov rcx, qword [rsi + 0xb0]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x140088ffd
mov rcx, rsi
call fcn.140032fc0
xor al, 1
je 0x140089141
mov rcx, rsi
call fcn.140033c90
xor eax, eax
mov rbx, qword [rbp - 0x520]
mov rsi, qword [rbp - 0x518]
mov rdi, qword [rbp - 0x510]
mov rsp, rbp
pop rbp
ret
mov dword [rbp - 0x4b0], 0x100003
lea rdx, [rbp - 0x4e0]
mov rcx, qword [rsi + 0xb0]
call sub.KERNEL32.dll_GetThreadContext
test eax, eax
je 0x140089166
movsx r8d, byte [rsi + 0x90]
xor r8b, 1
je 0x140089042
mov rdx, qword [rbp - 0x448]
mov rbx, qword [rsi + 0x88]
mov qword [rbx + 8], rdx
mov rax, qword [rbp - 0x468]
mov qword [rsi + 0xb8], rax
mov rcx, qword [rbp - 0x450]
mov qword [rsi + 0xc0], rcx
mov rdi, qword [rbp - 0x460]
mov qword [rsi + 0xc8], rdi
mov rdx, qword [rbp - 0x458]
mov qword [rsi + 0xd0], rdx
mov rbx, qword [rbp - 0x430]
mov qword [rsi + 0xd8], rbx
mov rax, qword [rbp - 0x438]
mov qword [rsi + 0xe0], rax
mov rcx, qword [rbp - 0x440]
mov qword [rsi + 0xe8], rcx
mov rdi, qword [rbp - 0x448]
mov qword [rsi + 0xf0], rdi
mov rdx, qword [rbp - 0x428]
mov qword [rsi + 0xf8], rdx
mov rbx, qword [rbp - 0x420]
mov qword [rsi + 0x100], rbx
mov rax, qword [rbp - 0x418]
mov qword [rsi + 0x108], rax
mov rcx, qword [rbp - 0x410]
mov qword [rsi + 0x110], rcx
mov rdi, qword [rbp - 0x408]
mov qword [rsi + 0x118], rdi
mov rdx, qword [rbp - 0x400]
mov qword [rsi + 0x120], rdx
mov rbx, qword [rbp - 0x3f8]
mov qword [rsi + 0x128], rbx
mov rax, qword [rbp - 0x3f0]
mov qword [rsi + 0x130], rax
mov eax, 1
mov rbx, qword [rbp - 0x520]
mov rsi, qword [rbp - 0x518]
mov rdi, qword [rbp - 0x510]
mov rsp, rbp
pop rbp
ret
lea rdx, str.Unable_to_suspend_thread
mov qword [rbp - 0x4e8], rdx
mov qword [rbp - 0x4f0], 0x18
lea rcx, [rbp - 0x4f0]
call fcn.140047f80
lea rax, str.Unable_to_load_thread_context
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], 0x1d
lea rcx, [rbp - 0x10]
call fcn.140047f80
int3