Function at 0x140020ea0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov r14d, r8d
mov edi, edx
mov rax, qword [0x1400532c8]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rax, [rcx + 8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x98], rcx
lea rax, [rcx + 0xc]
mov qword [rsp + 0x90], rax
mov eax, 0xa251280d
mov rbx, qword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [rsp + 0xcc], r8d
mov dword [rsp + 0xc8], edx
jmp 0x140020f2d
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd16a72fe
mov ecx, 0xf2944e92
nop dword [rax]
cmove eax, ecx
cmp dword [0x140053de8], 0xa
cmovl eax, ecx
cmp eax, 0xb5dd9af
jle 0x140020f80
cmp eax, 0x3aa4676d
jle 0x140020fe0
cmp eax, 0x5093adcc
jg 0x1400210a1
cmp eax, 0x42a3e0a6
jg 0x1400211a1
cmp eax, 0x3aa4676e
je 0x14002270c
cmp eax, 0x3cb70142
je 0x14002271f
cmp eax, 0x3f4476f4
jne 0x140020f2d
mov eax, 0x97f6fddd
jmp 0x140020f2d
cmp eax, 0xc26ca71c
jle 0x140021060
cmp eax, 0xe7f1fbea
jle 0x1400210eb
cmp eax, 0xf2944e91
jg 0x1400211cc
cmp eax, 0xe7f1fbeb
je 0x14002273d
cmp eax, 0xec255b88
je 0x14002275b
cmp eax, 0xf00519b7
jne 0x140020f2d
mov eax, 0x7a8d96fd
mov esi, dword [rsp + 0xd8]
jmp 0x140020f2d
cmp eax, 0x2543d84d
jle 0x140021121
cmp eax, 0x2e1189b2
jg 0x1400225c9
cmp eax, 0x2543d84e
je 0x140022765
cmp eax, 0x25ae6893
je 0x14002277c
cmp eax, 0x2cff5c01
jne 0x140020f2d
mov rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x108]
mov r8d, dword [rax + rcx*4]
mov ecx, 0x5a
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
mov eax, 0x6d127dfd
mov ecx, 0xb1a0fd78
cmove eax, ecx
jmp 0x140020f2d
cmp eax, 0xa251280c
jle 0x140021157
cmp eax, 0xaae8bb8a
jg 0x140022602
cmp eax, 0xa251280d
je 0x1400227b6
cmp eax, 0xa304d6c7
je 0x1400227cd
cmp eax, 0xa890581b
jne 0x140020f2d
mov eax, 0x67007280
jmp 0x140020f2d
cmp eax, 0x69d35260
jg 0x140022641
cmp eax, 0x5093adcd
je 0x14002280c
cmp eax, 0x67007280
je 0x140022816
cmp eax, 0x6741f13e
jne 0x140020f2d
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x153b5290
mov ecx, 0xd106a2e
jmp 0x140020f20
cmp eax, 0xd16a72fd
jle 0x140022684
cmp eax, 0xd16a72fe
je 0x140022834
cmp eax, 0xe02f8016
je 0x140022855
cmp eax, 0xe396e81b
jne 0x140020f2d
mov eax, 0x8480ad2a
jmp 0x140020f2d
cmp eax, 0x1409e11d
jle 0x1400226b8
cmp eax, 0x1409e11e
je 0x14002286c
cmp eax, 0x153b5290
je 0x14002289d
cmp eax, 0x1f72d6ba
jne 0x140020f2d
mov eax, 0x4f85196
jmp 0x140020f2d
cmp eax, 0x90db785e
jle 0x1400226e7
cmp eax, 0x90db785f
je 0x1400228a7
cmp eax, 0x94c18ddf
je 0x1400228bd
cmp eax, 0x97f6fddd
jne 0x140020f2d
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3f4476f4
mov ecx, 0xec255b88
jmp 0x140020f20
cmp eax, 0x42a3e0a7
je 0x1400228c9
cmp eax, 0x4e6912e4
je 0x140020f04
cmp eax, 0x4fb42276
jne 0x140020f2d
mov eax, 0xfd46e295
jmp 0x140020f2d
cmp eax, 0xf2944e92
je 0x1400228e7
cmp eax, 0xfd46e295
je 0x14002292c
cmp eax, 0x4f85196
jne 0x140020f2d
mov dword [rsp + 0xd0], esi
mov dword [rsp + 0xd4], ebp
mov rax, qword [rsp + 0xa0]
mov dword [rax], 0
mov eax, 0xc8a75bf6
lea rbx, [rsp + 0x110]
jmp 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x15873d4c
mov ecx, 0x390b1f8c
nop word cs:[rax + rax]
nop dword [rax + rax]
cmove eax, ecx
cmp dword [0x140053e40], 0xa
cmovl eax, ecx
cmp eax, 0xfabdf7a2
jg 0x1400212c0
cmp eax, 0xc9cf30eb
jle 0x140021330
cmp eax, 0xe228e2fe
jle 0x1400213f0
cmp eax, 0xf0b4abf8
jle 0x14002150d
cmp eax, 0xf7970069
jg 0x140021777
cmp eax, 0xf43a75ce
jg 0x140021b8b
cmp eax, 0xf0b4abf9
je 0x140021f4b
cmp eax, 0xf1e1ab08
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x59d48dea
mov ecx, 0xa95c3bfb
jmp 0x140021240
cmp eax, 0x390b1f8b
jle 0x140021390
cmp eax, 0x57817dc0
jle 0x140021436
cmp eax, 0x69923329
jle 0x140021557
cmp eax, 0x775aca61
jg 0x1400217b7
cmp eax, 0x768d8c36
jg 0x140021bbe
cmp eax, 0x6992332a
je 0x140021f5d
cmp eax, 0x73c6e9bc
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb1e8421f
mov ecx, 0xcd2d5418
jmp 0x140021240
cmp eax, 0xa7783bc4
jg 0x14002148b
cmp eax, 0x96e28eed
jg 0x14002158d
cmp eax, 0x88926e97
jle 0x1400217f6
cmp eax, 0x8a8dc9f2
jg 0x140021bee
cmp eax, 0x88926e98
je 0x140021f8c
cmp eax, 0x89fcb202
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x57817dc1
mov ecx, 0x418f9c67
jmp 0x140021240
cmp eax, 0x15981bea
jg 0x1400214cc
cmp eax, 0x79d7891
jg 0x1400215c3
cmp eax, 0x4a53b8d
jle 0x140021835
cmp eax, 0x5db8a57
jg 0x140021c26
cmp eax, 0x4a53b8e
je 0x140021f9f
cmp eax, 0x4cc6079
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1a4f2e09
mov ecx, 0x8a5e562
jmp 0x140021240
cmp eax, 0xcf468af0
jg 0x14002161f
cmp eax, 0xcd2d5417
jle 0x140021870
cmp eax, 0xce8a86cc
jg 0x140021c5f
cmp eax, 0xcd2d5418
je 0x140021fb0
cmp eax, 0xcd648cad
jne 0x14002124d
mov rax, qword [rsp + 0x70]
mov eax, 0xd6cd3110
jmp 0x14002124d
cmp eax, 0x4837d229
jg 0x140021655
cmp eax, 0x3dd70569
jle 0x1400218ab
cmp eax, 0x418f9c66
jg 0x140021c93
cmp eax, 0x3dd7056a
je 0x140021ffd
cmp eax, 0x3fe4ffa6
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x55e18020
mov ecx, 0x79d7892
jmp 0x140021240
cmp eax, 0xb901fc22
jg 0x1400216e3
cmp eax, 0xb096f1d9
jle 0x1400218fd
cmp eax, 0xb2abc72c
jg 0x140021cc7
cmp eax, 0xb096f1da
je 0x140022012
cmp eax, 0xb1e8421f
jne 0x14002124d
mov eax, 0xcd2d5418
jmp 0x14002124d
cmp eax, 0x1e152dd5
jg 0x14002172d
cmp eax, 0x16c6560f
jle 0x14002194a
cmp eax, 0x17f6288f
jg 0x140021cfb
cmp eax, 0x16c65610
je 0x140022030
cmp eax, 0x17a8f562
jne 0x14002124d
mov eax, 0x1e152dd6
jmp 0x14002124d
cmp eax, 0xe937b676
jle 0x140021989
cmp eax, 0xedc16b3b
jg 0x140021d1b
cmp eax, 0xe937b677
je 0x14002204d
cmp eax, 0xeb6203a8
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x57817dc1
mov ecx, 0x89fcb202
jmp 0x140021240
cmp eax, 0x5f09407a
jle 0x1400219b4
cmp eax, 0x6390c3de
jg 0x140021d56
cmp eax, 0x5f09407b
je 0x140022068
cmp eax, 0x62867b7b
jne 0x14002124d
mov eax, 0xce9a858b
jmp 0x14002124d
cmp eax, 0x9ad52c2d
jle 0x1400219f3
cmp eax, 0x9f358533
jg 0x140021d92
cmp eax, 0x9ad52c2e
je 0x1400220a0
cmp eax, 0x9c3fe7e9
jne 0x14002124d
mov eax, 0xeb6203a8
jmp 0x14002124d
cmp eax, 0xff84b7a
jle 0x140021a4c
cmp eax, 0x10d1caf1
jg 0x140021dd9
cmp eax, 0xff84b7b
je 0x1400220c1
cmp eax, 0x10b024bc
jne 0x14002124d
mov r8, qword [rsp + 0xf8]
mov rcx, qword [0x140054378]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0xc0]
mov qword [rax], 0
mov eax, 0xe21d73c4
jmp 0x14002124d
cmp eax, 0xdead3077
jle 0x140021a77
cmp eax, 0xe18bc3e4
jg 0x140021df9
cmp eax, 0xdead3078
je 0x1400220df
cmp eax, 0xe0560ffe
jne 0x14002124d
mov eax, 0x2ce6ef27
jmp 0x14002124d
cmp eax, 0x4ec353e1
jle 0x140021ac6
cmp eax, 0x55e1801f
jg 0x140021e2d
cmp eax, 0x4ec353e2
je 0x1400220e9
cmp eax, 0x4ee44bcf
jne 0x14002124d
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
mov r9d, dword [rsp + 0x38]
shl r9, 2
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
mov rcx, qword [0x140054378]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
sete byte [rsp + 0x2c]
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x9a38d495
mov ecx, 0xcb37ae0a
jmp 0x140021240
cmp eax, 0xbf4eac86
jle 0x140021af1
cmp eax, 0xc8a75bf5
jg 0x140021e5f
cmp eax, 0xbf4eac87
je 0x140022100
cmp eax, 0xc60c73a4
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4c1a872c
mov ecx, 0xb901fc23
jmp 0x140021240
cmp eax, 0x264a2573
jle 0x140021b60
cmp eax, 0x34dc31f8
jg 0x140021e9b
cmp eax, 0x264a2574
je 0x140022126
cmp eax, 0x2ce6ef27
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x34dc31f9
mov ecx, 0xf43a75cf
jmp 0x140021240
cmp eax, 0xf8e7e098
jg 0x140021ecf
cmp eax, 0xf797006a
je 0x140022130
cmp eax, 0xf80edbf4
jne 0x14002124d
cmp byte [rsp + 0x29], 0
mov eax, 0x775aca62
mov ecx, 0xf961fe19
cmovne eax, ecx
mov dword [rsp + 0x78], 0
jmp 0x14002124d
cmp eax, 0x7a9cfef0
jle 0x140021f03
cmp eax, 0x7a9cfef1
je 0x14002215e
cmp eax, 0x7f4d7141
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x257da3bd
mov ecx, 0x167554ae
jmp 0x140021240
cmp eax, 0x8030a897
je 0x14002217c
cmp eax, 0x82d343f4
je 0x140022186
cmp eax, 0x8727524d
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x77082c84
mov ecx, 0xd784b740
jmp 0x140021240
cmp eax, 0xfabdf7a3
je 0x1400221a4
cmp eax, 0xfbb207f0
je 0x1400221c5
cmp eax, 0xfbd72f90
jne 0x14002124d
lea rax, [rsp + 0x118]
mov qword [rsp + 0xf0], rax
mov eax, 0x768d8c37
jmp 0x14002124d
cmp eax, 0xc9cf30ec
je 0x140022204
cmp eax, 0xcb37ae0a
je 0x140022222
cmp eax, 0xccf2805a
jne 0x14002124d
mov qword [rsp + 0x70], rbx
mov rax, qword [rsp + 0x70]
mov dword [rax], 0x1c
mov eax, 0xa7783bc5
jmp 0x14002124d
cmp eax, 0x390b1f8c
je 0x140022239
cmp eax, 0x3940492b
je 0x140022248
cmp eax, 0x3c15c0a9
jne 0x14002124d
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x84], eax
mov dword [rsp + 0x88], r12d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4a53b8e
mov ecx, 0x9f358534
jmp 0x140021240
cmp eax, 0xa7783bc5
je 0x14002226d
cmp eax, 0xa95bbd40
je 0x14002228b
cmp eax, 0xa95c3bfb
jne 0x14002124d
mov rax, qword [rsp + 0x50]
cmp rax, 0xffffffffffffffff
setne byte [rsp + 0x29]
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x59d48dea
mov ecx, 0xf80edbf4
jmp 0x140021240
cmp eax, 0x15981beb
je 0x1400222a9
cmp eax, 0x15dc6941
je 0x1400222b3
cmp eax, 0x167554ae
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x257da3bd
mov ecx, 0x6390c3df
jmp 0x140021240
cmp eax, 0xe228e2ff
je 0x1400222ca
cmp eax, 0xe307dc66
je 0x1400222d4
cmp eax, 0xe9227bcd
jne 0x14002124d
mov eax, 0xb6968099
jmp 0x14002124d
cmp eax, 0x57817dc1
je 0x1400222de
cmp eax, 0x59d48dea
je 0x1400222e8
cmp eax, 0x5bc2153c
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x9a38d495
mov ecx, 0x4ee44bcf
jmp 0x140021240
cmp eax, 0x96e28eee
je 0x1400222f7
cmp eax, 0x98ebcf52
je 0x140022301
cmp eax, 0x9a38d495
jne 0x14002124d
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
mov r9d, dword [rsp + 0x38]
shl r9, 2
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
mov rcx, qword [0x140054378]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov eax, 0x4ee44bcf
jmp 0x14002124d
cmp eax, 0x79d7892
je 0x14002230b
cmp eax, 0x8a5e562
je 0x14002231b
cmp eax, 0xcee8eaf
jne 0x14002124d
mov eax, 0xf797006a
jmp 0x14002124d
cmp eax, 0xcf468af1
je 0x140021218
cmp eax, 0xd6cd3110
je 0x140022328
cmp eax, 0xd784b740
jne 0x14002124d
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0xb8]
mov qword [rax], rcx
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x77082c84
mov ecx, 0x62867b7b
jmp 0x140021240
cmp eax, 0x4837d22a
je 0x140022353
cmp eax, 0x4c0ec329
je 0x140022365
cmp eax, 0x4c1a872c
jne 0x14002124d
mov eax, 0xc60c73a4
jmp 0x14002124d
cmp eax, 0xb901fc23
je 0x14002236f
cmp eax, 0xbe8169c0
je 0x140022379
cmp eax, 0xbf396648
jne 0x14002124d
mov rax, qword [rsp + 0x60]
mov dword [rax], 0x80
mov rcx, qword [0x140054378]
mov r8d, 0x200
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
test rax, rax
sete byte [rsp + 0x2b]
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb2abc72d
mov ecx, 0x8030a897
jmp 0x140021240
cmp eax, 0x1e152dd6
je 0x140022383
cmp eax, 0x1eab4947
je 0x14002239e
cmp eax, 0x257da3bd
jne 0x14002124d
mov eax, 0x167554ae
jmp 0x14002124d
cmp eax, 0xf43a75cf
je 0x1400223c2
cmp eax, 0xf7713afc
jne 0x14002124d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0xa8]
mov eax, 0x9f88a97f
jmp 0x14002124d
cmp eax, 0x768d8c37
je 0x1400223e0
cmp eax, 0x77082c84
jne 0x14002124d
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0xb8]
mov qword [rax], rcx
mov eax, 0xd784b740
jmp 0x14002124d
cmp eax, 0x8a8dc9f3
je 0x1400223fe
cmp eax, 0x91ba4a3c
jne 0x14002124d
mov rax, qword [rsp + 0x70]
mov dword [rax], 0x1c
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
call sub.KERNEL32.dll_Thread32Next
mov eax, 0x7a056846
jmp 0x14002124d
cmp eax, 0x5db8a58
je 0x140022419
cmp eax, 0x715882c
jne 0x14002124d
mov dword [rsp + 0x30], r14d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcd648cad
mov ecx, 0xd6cd3110
jmp 0x140021240
cmp eax, 0xce8a86cd
je 0x140022437
cmp eax, 0xce9a858b
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdead3078
mov ecx, 0x7a9cfef1
jmp 0x140021240
cmp eax, 0x418f9c67
je 0x14002245c
cmp eax, 0x42bc3dca
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe228e2ff
mov ecx, 0xedc16b3c
jmp 0x140021240
cmp eax, 0xb2abc72d
je 0x140022471
cmp eax, 0xb6968099
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x55e18020
mov ecx, 0x3fe4ffa6
jmp 0x140021240
cmp eax, 0x17f62890
je 0x1400224a3
cmp eax, 0x1a4f2e09
jne 0x14002124d
mov eax, 0x4cc6079
jmp 0x14002124d
cmp eax, 0xedc16b3c
je 0x1400224ba
cmp eax, 0xf08b5b62
jne 0x14002124d
cmp byte [rsp + 0x2d], 0
mov eax, 0x88926e98
mov ecx, 0x5f09407b
cmovne eax, ecx
mov edi, dword [rsp + 0x88]
mov esi, dword [rsp + 0x88]
jmp 0x14002124d
cmp eax, 0x6390c3df
je 0x1400224c4
cmp eax, 0x642be831
jne 0x14002124d
mov qword [rsp + 0xa8], rbx
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4c0ec329
mov ecx, 0x15981beb
jmp 0x140021240
cmp eax, 0x9f358534
je 0x1400224d0
cmp eax, 0x9f88a97f
jne 0x14002124d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0xa8]
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf7713afc
mov ecx, 0x3dd7056a
jmp 0x140021240
cmp eax, 0x10d1caf2
je 0x1400224fb
cmp eax, 0x15873d4c
jne 0x14002124d
mov eax, 0xcf468af1
jmp 0x14002124d
cmp eax, 0xe18bc3e5
je 0x140022526
cmp eax, 0xe21d73c4
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x15873d4c
mov ecx, 0xcf468af1
jmp 0x140021240
cmp eax, 0x55e18020
je 0x14002253e
cmp eax, 0x576d5d95
jne 0x14002124d
cmp byte [rsp + 0x2f], 0
mov eax, 0xc9186f77
mov ecx, 0x10b024bc
cmovne eax, ecx
mov r13d, dword [rsp + 0x3c]
jmp 0x14002124d
cmp eax, 0xc8a75bf6
je 0x140022548
cmp eax, 0xc9186f77
jne 0x14002124d
mov dword [rsp + 0xec], r13d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf7713afc
mov ecx, 0x9f88a97f
jmp 0x140021240
cmp eax, 0x34dc31f9
je 0x140022566
cmp eax, 0x35765c8a
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x98ebcf52
mov ecx, 0x10d1caf2
jmp 0x140021240
cmp eax, 0xf8e7e099
je 0x140022570
cmp eax, 0xf961fe19
jne 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4c0ec329
mov ecx, 0x642be831
jmp 0x140021240
cmp eax, 0x7a056846
jne 0x140022586
mov rax, qword [rsp + 0x70]
mov dword [rax], 0x1c
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
setne byte [rsp + 0x2e]
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x91ba4a3c
mov ecx, 0xbf4eac87
jmp 0x140021240
mov rax, qword [rsp + 0xa8]
mov eax, 0xccf2805a
jmp 0x14002124d
mov ecx, 4
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x50], rax
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf8e7e099
mov ecx, 0xe0560ffe
jmp 0x140021240
mov dword [rsp + 0x5c], esi
cmp dword [rsp + 0x5c], 0
mov eax, 0x4ec353e2
jmp 0x1400220af
mov eax, dword [rsp + 0x84]
mov eax, 0x9f358534
jmp 0x14002124d
mov rax, qword [rsp + 0x90]
mov eax, dword [rax]
mov dword [rsp + 0xe4], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax]
mov dword [rsp + 0x80], eax
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb1e8421f
mov ecx, 0xe307dc66
jmp 0x140021240
mov eax, 0x775aca62
mov ecx, dword [rsp + 0xec]
mov dword [rsp + 0x78], ecx
jmp 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4837d22a
mov ecx, 0xfbb207f0
jmp 0x140021240
cmp dword [rsp + 0xdc], 0
mov eax, 0xe9227bcd
mov ecx, 0xc9186f77
cmove eax, ecx
xor r13d, r13d
jmp 0x14002124d
cmp byte [rsp + 0x2b], 0
mov eax, 0x5f09407b
mov ecx, 0x96e28eee
cmovne eax, ecx
mov edi, dword [rsp + 0x30]
jmp 0x14002124d
mov rax, qword [rsp + 0xf0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov rbx, qword [rsp + 0x90]
mov edx, dword [rbx]
lea ebp, [rdx + 1]
mov dword [rbx], ebp
lea rbx, [rsp + 0x110]
mov dword [rcx + rdx*4], eax
mov eax, 0x3940492b
mov ebp, edi
jmp 0x14002124d
mov eax, dword [rsp + 0xe8]
cmp eax, 0x12
mov eax, 0xa95bbd40
mov ecx, 0xfabdf7a3
cmove eax, ecx
mov r15d, dword [rsp + 0x5c]
jmp 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb2abc72d
mov ecx, 0xbf396648
jmp 0x140021240
mov eax, 0x7a9cfef1
jmp 0x14002124d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xe8], eax
mov eax, 0x9ad52c2e
jmp 0x14002124d
cmp byte [rsp + 0x2e], 0
mov eax, 0x88926e98
mov ecx, 0x715882c
cmovne eax, ecx
mov r14d, dword [rsp + 0x8c]
mov esi, dword [rsp + 0x8c]
jmp 0x14002124d
mov eax, 0xf1e1ab08
jmp 0x14002124d
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xc0], rax
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcee8eaf
mov ecx, 0xbe8169c0
jmp 0x140021240
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdead3078
mov ecx, 0x17f62890
jmp 0x140021240
mov eax, 0xe937b677
jmp 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf8e7e099
mov ecx, 0x6992332a
jmp 0x140021240
mov dword [rsp + 0x3c], r15d
cmp dword [rsp + 0x3c], 0
mov eax, 0xc9186f77
mov ecx, 0xc9cf30ec
cmove eax, ecx
mov r13d, dword [rsp + 0x3c]
jmp 0x14002124d
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov qword [rsp + 0xf8], rax
cmp qword [rsp + 0xf8], 0
setne byte [rsp + 0x2f]
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4837d22a
mov ecx, 0x576d5d95
jmp 0x140021240
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcee8eaf
mov ecx, 0xf797006a
jmp 0x140021240
cmp byte [rsp + 0x2c], 0
mov eax, 0x8727524d
mov ecx, 0x9c3fe7e9
cmovne eax, ecx
jmp 0x14002124d
mov eax, 0xc9186f77
mov r13d, dword [rsp + 0x3c]
jmp 0x14002124d
mov dword [rsp + 0x8c], ebp
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x91ba4a3c
mov ecx, 0x7a056846
jmp 0x140021240
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
call sub.KERNEL32.dll_Thread32First
mov dword [rsp + 0xdc], eax
mov eax, 0x16c65610
jmp 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4c1a872c
mov ecx, 0xc60c73a4
jmp 0x140021240
mov eax, 0xf0b4abf9
jmp 0x14002124d
mov eax, dword [rsp + 0x80]
add eax, eax
mov dword [rsp + 0x38], eax
mov eax, 0x5bc2153c
jmp 0x14002124d
mov eax, 0x42bc3dca
jmp 0x14002124d
mov eax, 0x1eab4947
jmp 0x14002124d
mov eax, 0x89fcb202
jmp 0x14002124d
mov rax, qword [rsp + 0x50]
mov eax, 0xa95c3bfb
jmp 0x14002124d
mov eax, 0x7f4d7141
jmp 0x14002124d
mov eax, 0x10d1caf2
jmp 0x14002124d
mov eax, 0x715882c
mov r14d, 1
jmp 0x14002124d
mov eax, 0xfabdf7a3
xor r15d, r15d
jmp 0x14002124d
mov rax, qword [rsp + 0x70]
cmp dword [rax], 0x10
setae byte [rsp + 0x2a]
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcd648cad
mov ecx, 0x8a8dc9f3
jmp 0x140021240
mov rax, qword [rsp + 0xc0]
mov eax, 0xfbb207f0
jmp 0x14002124d
mov eax, 0x642be831
jmp 0x14002124d
mov eax, 0x5db8a58
jmp 0x14002124d
mov eax, 0xb096f1da
jmp 0x14002124d
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
mov eax, 0x73c6e9bc
mov ecx, 0xff84b7b
cmove eax, ecx
jmp 0x14002124d
mov eax, dword [rsp + 0xe4]
cmp eax, dword [rsp + 0x80]
mov eax, 0x15dc6941
mov ecx, 0x5f09407b
cmovb eax, ecx
mov edi, dword [rsp + 0x30]
jmp 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x34dc31f9
mov ecx, 0x264a2574
jmp 0x140021240
mov rax, qword [rsp + 0xf0]
mov ebp, dword [rax]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp ebp, eax
mov eax, 0x35765c8a
mov ecx, 0x3940492b
jmp 0x140022450
cmp byte [rsp + 0x2a], 0
mov eax, 0x3940492b
mov ecx, 0xe18bc3e5
cmovne eax, ecx
mov ebp, dword [rsp + 0x30]
jmp 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1a4f2e09
mov ecx, 0x4cc6079
jmp 0x140021240
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [rsp + 0xe0]
cmp ecx, eax
mov eax, 0x3940492b
mov ecx, 0xfbd72f90
cmove eax, ecx
mov ebp, dword [rsp + 0x30]
jmp 0x14002124d
mov eax, 0x3c15c0a9
xor r12d, r12d
mov dword [rsp + 0x7c], 2
jmp 0x14002124d
mov rax, qword [rsp + 0x60]
mov dword [rax], 0x80
mov rcx, qword [0x140054378]
mov r8d, 0x200
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
mov eax, 0xbf396648
jmp 0x14002124d
mov eax, 0x3c15c0a9
mov dword [rsp + 0x7c], 0
mov r12d, dword [rsp + 0x30]
jmp 0x14002124d
mov eax, 0x82d343f4
jmp 0x14002124d
mov eax, 0x88926e98
xor esi, esi
jmp 0x14002124d
cmp dword [rsp + 0x84], 0
sete byte [rsp + 0x2d]
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4a53b8e
mov ecx, 0xf08b5b62
jmp 0x140021240
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x40], rax
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x98ebcf52
mov ecx, 0x17a8f562
jmp 0x140021240
mov eax, dword [rsp + 0x11c]
mov dword [rsp + 0xe0], eax
mov eax, 0xce8a86cd
jmp 0x14002124d
mov eax, 0x3fe4ffa6
jmp 0x14002124d
mov eax, dword [0x140053e3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe228e2ff
mov ecx, 0x42bc3dca
jmp 0x140021240
mov eax, 0xf43a75cf
jmp 0x14002124d
mov ecx, 4
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov eax, 0x6992332a
jmp 0x14002124d
cmp eax, 0x775aca62
jne 0x14002124d
cmp dword [rsp + 0x78], 0
setne byte [rsp + 0x26]
mov eax, 0xe02f8016
mov r14d, dword [rsp + 0xcc]
mov edi, dword [rsp + 0xc8]
mov rbx, qword [sym.imp.KERNEL32.dll_SuspendThread]
mov ebp, dword [rsp + 0xd4]
mov esi, dword [rsp + 0xd0]
jmp 0x140020f2d
cmp eax, 0x2e1189b3
je 0x14002294a
cmp eax, 0x2fc36de3
je 0x140022975
cmp eax, 0x33841c82
jne 0x140020f2d
mov rax, qword [rsp + 0x68]
cmp qword [rax], 0
setne byte [rsp + 0x27]
mov eax, 0x42a3e0a7
jmp 0x140020f2d
cmp eax, 0xaae8bb8b
je 0x14002297f
cmp eax, 0xb1a0fd78
je 0x140022989
cmp eax, 0xc157b0a2
jne 0x140020f2d
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xaae8bb8b
mov ecx, 0xe7f1fbeb
jmp 0x140020f20
cmp eax, 0x69d35261
je 0x1400229a1
cmp eax, 0x6d127dfd
je 0x1400229ad
cmp eax, 0x7a8d96fd
jne 0x140020f2d
mov dword [rsp + 0x34], esi
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x90db785f
mov ecx, 0x1409e11e
jmp 0x140020f20
cmp eax, 0xc26ca71d
je 0x1400229cb
cmp eax, 0xd0ef20f0
jne 0x140022a11
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5093adcd
mov ecx, 0x69d35261
jmp 0x140020f20
cmp eax, 0xb5dd9b0
je 0x1400229e9
cmp eax, 0xd106a2e
jne 0x140020f2d
cmp byte [rsp + 0x27], 0
mov eax, 0xcf22fe34
mov ecx, 0xc157b0a2
cmovne eax, ecx
xor ebp, ebp
jmp 0x140020f2d
cmp eax, 0x8480ad2a
je 0x140022a07
cmp eax, 0x8d7389ee
jne 0x140020f2d
mov eax, 0xcf22fe34
mov ebp, 9
jmp 0x140020f2d
mov rax, qword [rsp + 0x68]
mov eax, dword [rsp + 0x34]
mov eax, 0x25ae6893
jmp 0x140020f2d
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3f4476f4
mov ecx, 0x97f6fddd
jmp 0x140020f20
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xaae8bb8b
mov ecx, 0x4fb42276
jmp 0x140020f20
mov eax, 0x8d7389ee
jmp 0x140020f2d
cmp byte [rsp + 0x28], 0
mov eax, 0xb5dd9b0
mov ecx, 0xc26ca71d
cmovne eax, ecx
jmp 0x140020f2d
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov qword [rsp + 0x100], rax
mov eax, dword [rsp + 0x34]
mov qword [rsp + 0x108], rax
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3aa4676e
mov ecx, 0x2fc36de3
jmp 0x140020f20
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x68], rax
mov eax, 0x4e6912e4
jmp 0x140020f2d
mov rcx, qword [rsp + 0x48]
call rbx
mov rcx, qword [rsp + 0x48]
mov edx, edi
mov r8d, r14d
call fcn.1400240e0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2e1189b3
mov ecx, 0xe396e81b
jmp 0x140020f20
mov eax, 0xd0ef20f0
jmp 0x140020f2d
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa890581b
mov ecx, 0x94c18ddf
jmp 0x140020f20
mov rax, qword [rsp + 0x68]
mov qword [rax], 0
mov rax, qword [rsp + 0x60]
mov dword [rax], 0
mov eax, 0xf2944e92
jmp 0x140020f2d
cmp byte [rsp + 0x26], 0
mov eax, 0x3cb70142
mov ecx, 0x33841c82
cmovne eax, ecx
jmp 0x140020f2d
mov rax, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0x34]
cmp ecx, dword [rax]
setb byte [rsp + 0x28]
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x90db785f
mov ecx, 0x2543d84e
jmp 0x140020f20
mov eax, 0x6741f13e
jmp 0x140020f2d
mov rax, qword [rsp + 0xa0]
mov eax, dword [rsp + 0x34]
mov eax, 0x1409e11e
jmp 0x140020f2d
mov eax, 0xcf22fe34
xor ebp, ebp
jmp 0x140020f2d
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x153b5290
mov ecx, 0x6741f13e
jmp 0x140020f20
mov rax, qword [rsp + 0x68]
mov qword [rax], 0
mov rax, qword [rsp + 0x60]
mov dword [rax], 0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xa0], rax
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd16a72fe
mov ecx, 0x1f72d6ba
jmp 0x140020f20
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5093adcd
mov ecx, 0xd0ef20f0
jmp 0x140020f20
mov rcx, qword [rsp + 0x48]
call rbx
mov rcx, qword [rsp + 0x48]
mov edx, edi
mov r8d, r14d
call fcn.1400240e0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xa304d6c7
jmp 0x140020f2d
mov eax, 0x2cff5c01
jmp 0x140020f2d
mov eax, 0xe7f1fbeb
jmp 0x140020f2d
mov eax, dword [rsp + 0x34]
add eax, 1
mov dword [rsp + 0xd8], eax
mov eax, 0xf00519b7
jmp 0x140020f2d
mov eax, 0x7a8d96fd
xor esi, esi
jmp 0x140020f2d
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2e1189b3
mov ecx, 0xa304d6c7
jmp 0x140020f20
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3aa4676e
mov ecx, 0x25ae6893
jmp 0x140020f20
mov eax, dword [0x140053de4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa890581b
mov ecx, 0x67007280
jmp 0x140020f20
mov eax, 0xb1a0fd78
jmp 0x140020f2d
cmp eax, 0xcf22fe34
jne 0x140020f2d
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140032600
mov eax, ebp
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret