Function at 0x1400693fa
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r15
mov rax, 8
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140069409
sub rsp, 0x28
call fcn.14012b830
mov rcx, qword [rsp + 0xa0]
call fcn.1400bd588
mov dword [section..data], 0x100003
mov dword [section..data], 0x100005
movabs rdx, 0
movabs rcx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
mov dword [section..data], 0x100006
mov r15, qword [rsp + 0x28]
and r15, r15
jne 0x1400694b7
mov dword [section..data], 0x100007
movabs rcx, 0x140211776
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
pop rax
push rax
call fcn.14012b6a0
pop rdx
add rax, rdx
jmp 0x14006970a
mov dword [section..data], 0x100008
mov dword [section..data], 0x10000b
movabs rdx, 0x140207502
lea rcx, [rsp + 0x50]
call fcn.14012b3b0
mov dword [section..data], 0x10000d
lea rbp, [rsp + 0x30]
mov dword [rbp], reloc.OLEAUT32.dll_DispGetIDsOfNames
mov dword [section..data], 0x10000e
lea rax, [rsp + 0x30]
mov rdx, rax
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Thread32First
mov qword [rsp + 0x58], rax
mov dword [section..data], 0x10000f
cmp qword [rsp + 0x58], 0
je 0x1400696a9
mov dword [section..data], 0x100010
lea rbp, [rsp + 0x30]
movsxd r15, dword [rbp + 0xc]
cmp r15, qword [rsp + 0x80]
jne 0x14006966f
mov dword [section..data], 0x100011
push qword [rsp + 0x50]
movabs rcx, 0x140207502
pop rdx
call fcn.14012b640
or rax, rax
je 0x1400695d2
mov dword [section..data], 0x100012
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
lea rbp, [rsp + 0x48]
movsxd rax, dword [rbp + 8]
mov rcx, rax
pop rdx
sub rsp, 0x20
call fcn.1401278e0
add rsp, 0x28
lea rcx, [rsp + 0x58]
pop rdx
call fcn.14012b4f0
mov dword [section..data], 0x100013
jmp 0x140069665
mov dword [section..data], 0x100013
mov dword [section..data], 0x100014
mov rcx, qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
movabs rcx, 0x14020836e
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
push rcx
sub rsp, 0x20
call fcn.14012b4a0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
lea rbp, [rsp + 0x48]
movsxd rax, dword [rbp + 8]
mov rcx, rax
pop rdx
sub rsp, 0x20
call fcn.1401278e0
add rsp, 0x20
pop rax
lea rcx, [rsp + 0x58]
pop rdx
call fcn.14012b4f0
mov dword [section..data], 0x100015
mov dword [section..data], 0x100016
mov dword [section..data], 0x100017
lea rax, [rsp + 0x30]
mov rdx, rax
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Thread32Next
mov qword [rsp + 0x58], rax
mov dword [section..data], 0x100018
jmp 0x140069516
mov dword [section..data], 0x100019
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_CloseHandle
mov dword [section..data], 0x10001b
mov rcx, qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.14012b4a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14012b5d0
add rsp, 0x28
pop rax
push rax
call fcn.14012b6a0
pop rdx
add rax, rdx
jmp 0x14006970a
push rax
mov rcx, qword [rsp + 0x58]
sub rsp, 0x28
call fcn.14012b910
add rsp, 0x28
pop rax
add rsp, 0x68
pop r15
pop rbp
ret