Function at 0x180018070
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x538
mov r15d, r8d
mov dword [rsp + 0x2c], edx
mov rax, qword [0x1800576c8]
xor rax, rsp
mov qword [rsp + 0x530], rax
xorps xmm0, xmm0
mov qword [rsp + 0x30], rcx
movups xmmword [rcx], xmm0
mov ecx, 4
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13d, 9
cmp rax, 0xffffffffffffffff
je 0x18001842b
mov rbp, rax
mov dword [rsp + 0x60], 0x1c
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x180018422
mov r14, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rbx, [rsp + 0x60]
jmp 0x180018157
mov dword [rsi + 8], 0x80
mov rcx, qword [0x1800588d8]
mov r8d, 0x200
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, qword [rsp + 0x30]
mov qword [rsi], rax
test rax, rax
je 0x180018422
mov ecx, dword [rsp + 0x68]
mov edx, dword [rsi + 0xc]
lea edi, [rdx + 1]
mov dword [rsi + 0xc], edi
mov dword [rax + rdx*4], ecx
nop word cs:[rax + rax]
mov dword [rsp + 0x60], 0x1c
mov rcx, rbp
mov rdx, rbx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x1800181bd
cmp dword [rsp + 0x60], 0x10
jb 0x180018140
mov edi, dword [rsp + 0x6c]
call r14
cmp edi, eax
jne 0x180018140
mov edi, dword [rsp + 0x68]
call r12
cmp edi, eax
je 0x180018140
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsi]
test rax, rax
je 0x1800180f8
mov r9d, dword [rsi + 8]
cmp dword [rsi + 0xc], r9d
jb 0x180018125
add r9d, r9d
mov dword [rsi + 8], r9d
shl r9, 2
mov rcx, qword [0x1800588d8]
xor edx, edx
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x180018404
mov qword [rsi], rax
jmp 0x180018125
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
mov rsi, qword [rsp + 0x30]
jne 0x180018404
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r13d, r13d
cmp qword [rsi], 0
je 0x18001842b
mov rcx, rsi
cmp dword [rsi + 0xc], 0
je 0x18001842b
xor esi, esi
mov eax, dword [rsp + 0x2c]
mov edx, eax
inc edx
mov dword [rsp + 0x3c], edx
cmove eax, esi
mov qword [rsp + 0x40], rax
imul rax, rax, 0x38
add rax, 0x30
mov qword [rsp + 0x50], rax
jmp 0x180018244
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x58]
inc rsi
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + 0xc]
cmp rsi, rax
jae 0x180018452
mov rax, qword [rcx]
mov r8d, dword [rax + rsi*4]
mov ecx, 0x5a
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
je 0x180018230
mov rdi, rax
mov qword [rsp + 0x58], rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [rsp + 0x90], 0x100001
mov qword [rsp + 0x48], rdi
mov rcx, rdi
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x180018220
mov eax, dword [rsp + 0x3c]
cmp dword [rsp + 0x2c], 0xffffffff
jne 0x1800182a1
mov eax, dword [0x1800588ec]
cmp dword [rsp + 0x40], eax
jae 0x180018220
mov r12d, eax
mov r9, qword [0x1800588e0]
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x40]
jmp 0x1800182e0
inc r13
add r14, 0x38
cmp r13, r12
je 0x180018220
imul rcx, r13, 0x38
mov edi, r15d
test r15d, r15d
je 0x18001830b
cmp r15d, 1
jne 0x180018300
mov edi, 1
jmp 0x18001830b
mov edi, dword [r9 + rcx + 0x20]
shr edi, 2
and edi, 1
mov ebp, dword [r9 + rcx + 0x20]
bt ebp, 1
mov edx, edi
sbb edx, 0
je 0x1800182d0
lea r8, [r9 + rcx]
mov rdx, qword [rsp + 0x158]
test edi, edi
je 0x18001835a
mov ebp, dword [r9 + rcx + 0x24]
and rbp, 0xf
je 0x1800182d0
mov rdi, qword [r8]
lea rbx, [r9 + r14]
xor esi, esi
nop
movzx eax, byte [rbx + rsi - 8]
add rax, rdi
cmp rax, rdx
je 0x1800183bc
inc rsi
cmp rbp, rsi
jne 0x180018340
jmp 0x1800182d0
test bpl, 1
je 0x18001836c
mov rbp, qword [r8]
lea rax, [rbp - 5]
cmp rax, rdx
je 0x1800183c5
mov ebp, dword [r9 + rcx + 0x24]
and rbp, 0xf
je 0x1800183a4
mov rbx, qword [r9 + rcx + 0x10]
lea rdi, [r9 + r14]
xor esi, esi
nop word cs:[rax + rax]
movzx eax, byte [rdi + rsi]
add rax, rbx
cmp rax, rdx
je 0x1800183f2
inc rsi
cmp rbp, rsi
jne 0x180018390
cmp rdx, qword [r9 + rcx + 8]
jne 0x1800182d0
mov rbp, qword [r8]
test rbp, rbp
jne 0x1800183ce
jmp 0x1800182d0
movzx ebp, byte [rsi + rbx]
add rbp, qword [r9 + rcx + 0x10]
test rbp, rbp
je 0x1800182d0
mov qword [rsp + 0x158], rbp
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov r9, qword [0x1800588e0]
jmp 0x1800182d0
movzx ebp, byte [rsi + rdi - 8]
add rbp, qword [r8]
test rbp, rbp
jne 0x1800183ce
jmp 0x1800182d0
mov r8, qword [rsi]
test r8, r8
je 0x180018422
mov rcx, qword [0x1800588d8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsi], 0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.180018f40
mov eax, r13d
add rsp, 0x538
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r13d, r13d
jmp 0x18001842b