Function at 0x1800014f8
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x458]
sub rsp, 0x558
mov rsi, rcx
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x4d0
call sub.ntdll.dll_memset
mov rax, qword [rsi]
xor edx, edx
mov ecx, dword [rsi + 0x10]
xor r12d, r12d
mov r15, qword [0x180035698]
mov qword [rsp + 0x40], rax
mov dword [rbp + 0x4b8], 0xccccfeeb
call fcn.180004e28
mov r13, qword [rsi]
lea ecx, [r12 + 0x10]
xor r14d, r14d
mov dword [rbp - 0x50], 0x100003
test eax, eax
cmovne r14d, ecx
mov ecx, 0x1000
mov dword [rbp + 0x4a0], r14d
xor ebx, ebx
call fcn.180001e70
mov rdi, rax
test rax, rax
je 0x180001693
mov rcx, r13
call fcn.180004854
mov r14, rax
test rax, rax
je 0x180001684
lea rax, [rsp + 0x38]
mov r9d, 0x1000
mov r8, rdi
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x180001684
movsxd rdx, dword [rdi + 0x3c]
lea rax, [rsp + 0x38]
add rdx, r14
mov qword [rsp + 0x20], rax
mov r9d, 0x1000
mov r8, rdi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x180001684
mov ebx, dword [rdi + 0x28]
mov eax, 0xc0
add rbx, r14
mov edx, 0x8664
cmp word [rdi + 4], dx
lea ecx, [rax + 0x10]
cmove eax, ecx
cmp dword [rax + rdi], r12d
je 0x180001684
cmp dword [rax + rdi + 4], r12d
je 0x180001684
mov edx, dword [rax + rdi]
lea r9d, [r12 + 0x28]
lea rax, [rsp + 0x38]
add rdx, r14
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r14d, dword [rbp + 0x4a0]
test eax, eax
je 0x18000168b
mov edx, dword [rsp + 0x5c]
test r14d, r14d
jne 0x180001656
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x18000168b
lea rax, [rsp + 0x38]
mov r9d, 0x1000
mov r8, rdi
mov qword [rsp + 0x20], rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18000168b
cmp qword [rdi], r12
cmovne rbx, qword [rdi]
jmp 0x18000168b
mov r14d, dword [rbp + 0x4a0]
mov rcx, rdi
call fcn.180001e84
mov r13, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov edi, 4
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, [rsp + 0x30]
mov rcx, r13
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18000178c
cmp qword [rsp + 0x48], rdi
jne 0x18000178c
mov r9d, edi
lea r8, [rbp + 0x4b8]
mov rdx, rbx
mov rcx, r13
call fcn.180001dd8
test eax, eax
je 0x18000178c
mov edi, 0x1770
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, qword [rsi + 8]
lea rdx, [rbp - 0x80]
sub edi, 0x12c
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x18000178c
test edi, edi
jle 0x180001731
cmp qword [rbp + 0x78], rbx
jne 0x1800016f0
test r14d, r14d
je 0x180001748
mov rcx, r15
call fcn.180004fac
test rax, rax
mov r12, rax
cmovne r15, rax
cmp dword [rbp + 0x4b0], 0
mov rcx, rsi
je 0x18000175e
mov edx, r14d
call fcn.1800019a8
jmp 0x180001769
mov r8d, r14d
mov rdx, r15
call fcn.180004c04
mov edi, eax
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov r9d, 4
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, r13
call fcn.180001dd8
cmp edi, 0xffffffff
jne 0x180001794
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test byte [rbp + 0x4a8], 4
jne 0x1800017a7
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test r12, r12
je 0x1800017b4
mov rcx, r12
call fcn.180001e84
mov eax, edi
add rsp, 0x558
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret