Function at 0x180031ea0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x180047040]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov dword [rsp + 0x30], 1
mov r14d, dword [0x180047af0]
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
xor ebx, ebx
mov qword [rbp - 0x50], rbx
mov dword [rsp + 0x30], 1
xor edx, edx
lea ecx, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180031f80
mov dword [rbp - 0x30], 0x1c
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180031f80
mov rdi, qword [rbp - 0x58]
cmp dword [rbp - 0x30], 0x10
jb 0x180031f68
mov eax, dword [rbp - 0x24]
cmp rax, r14
jne 0x180031f68
mov eax, dword [rbp - 0x28]
mov qword [rsp + 0x38], rax
cmp rdi, rbx
je 0x180031f4f
mov qword [rdi], rax
add rdi, 8
mov qword [rbp - 0x58], rdi
jmp 0x180031f68
lea r8, [rsp + 0x38]
mov rdx, rdi
lea rcx, [rbp - 0x60]
call fcn.180033010
mov rbx, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x58]
mov dword [rbp - 0x30], 0x1c
lea rdx, [rbp - 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180031f27
mov r8, qword [rbp - 0x60]
mov r8d, dword [r8]
xor edx, edx
lea ecx, [rdx + 0x48]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x38], rax
mov rdx, rax
call fcn.180031ca0
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rsp + 0x40], 0x78
mov qword [rsp + 0x48], 0x110
mov qword [rsp + 0x50], 0x738
mov qword [rsp + 0x58], 0x78
mov qword [rsp + 0x60], 0x60
mov qword [rsp + 0x68], 0x78
mov ecx, 0x30
call fcn.180035168
mov qword [rbp - 0x48], rax
lea rdi, [rax + 0x30]
mov qword [rbp - 0x38], rdi
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 0x40], rdi
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp - 0x30], 0x78
mov qword [rbp - 0x28], 0x110
mov qword [rbp - 0x20], 0x738
mov qword [rbp - 0x18], 0x78
mov qword [rbp - 0x10], 0x60
mov qword [rbp - 8], 0x88
mov ecx, 0x30
call fcn.180035168
mov r14, rax
mov qword [rbp], rax
lea r13, [rax + 0x30]
mov qword [rbp + 0x10], r13
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 8], r13
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov qword [rsp + 0x70], 0x78
mov qword [rsp + 0x78], 0x110
mov qword [rbp - 0x80], 0x738
mov qword [rbp - 0x78], 0x78
mov qword [rbp - 0x70], 0x60
mov qword [rbp - 0x68], 0x94
mov ecx, 0x30
call fcn.180035168
mov r15, rax
mov qword [rbp + 0x18], rax
lea r12, [rax + 0x30]
mov qword [rbp + 0x28], r12
mov r8d, 0x30
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x20], r12
lea rdi, [rsi - 0x270]
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 8]
lea r8, [0x180047b20]
mov rdx, rdi
mov rcx, qword [0x180047b30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 8]
lea r8, [0x180047b38]
mov rdx, rdi
mov rcx, qword [0x180047b30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 8]
lea r8, [0x180047af8]
mov rdx, rdi
mov rcx, qword [0x180047b30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor edi, edi
cmp rdi, 6
jae 0x18003238b
mov rax, qword [rbp - 0x48]
mov rdx, qword [0x180047b20]
add rdx, qword [rax + rdi*8]
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [0x180047b20]
mov rcx, qword [0x180047b30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
inc esi
inc rdi
cmp esi, 5
jb 0x180032146
xor esi, esi
sub r13, r14
sar r13, 3
lea rdx, [r13 - 1]
test rdx, rdx
je 0x1800321e8
xor edi, edi
cmp r13, rdi
jbe 0x18003238b
mov rdx, qword [0x180047b38]
add rdx, qword [r14 + rdi*8]
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [0x180047b38]
mov rcx, qword [0x180047b30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
inc esi
inc rdi
movsxd rax, esi
lea rdx, [r13 - 1]
cmp rax, rdx
jb 0x1800321a0
xor esi, esi
sub r12, r15
sar r12, 3
lea rcx, [r12 - 1]
test rcx, rcx
je 0x18003224d
xor edi, edi
nop dword [rax]
cmp r12, rdi
jbe 0x18003238b
mov rdx, qword [0x180047af8]
add rdx, qword [r15 + rdi*8]
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [0x180047af8]
mov rcx, qword [0x180047b30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
inc esi
inc rdi
movsxd rax, esi
lea rcx, [r12 - 1]
cmp rax, rcx
jb 0x180032200
lea rdx, [r13 - 1]
mov rdi, qword [rbp - 0x48]
mov rax, qword [rdi + 0x28]
add qword [0x180047b20], rax
cmp r13, rdx
jbe 0x18003238b
mov rax, qword [r14 + rdx*8]
add qword [0x180047b38], rax
cmp r12, rcx
jbe 0x18003238b
mov rax, qword [r15 + rcx*8]
add qword [0x180047af8], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r15, r15
je 0x1800322cb
lea rdx, [r12*8]
cmp rdx, 0x1000
jb 0x1800322c2
add rdx, 0x27
mov rcx, qword [r15 - 8]
sub r15, rcx
lea rax, [r15 - 8]
cmp rax, 0x1f
ja 0x180032348
mov r15, rcx
mov rcx, r15
call fcn.180034f74
nop
test r14, r14
je 0x180032302
lea rdx, [r13*8]
cmp rdx, 0x1000
jb 0x1800322f9
add rdx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x18003234f
mov r14, rcx
mov rcx, r14
call fcn.180034f74
nop
test rdi, rdi
je 0x180032315
mov edx, 0x30
mov rcx, rdi
call fcn.180034f74
nop
mov rcx, qword [rbp - 0x60]
sub rbx, rcx
and rbx, 0xfffffffffffffff8
mov rax, rcx
cmp rbx, 0x1000
jb 0x180032356
add rbx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032356
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, rbx
call fcn.180034f74
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.180034a30
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180032fd0
nop
int3