Function at 0x180020c0d
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x5a8
mov dword [rsp + 0x68], r8d
mov dword [rsp + 0x90], edx
mov rax, qword [0x180046008]
xor rax, rsp
mov qword [rsp + 0x5a0], rax
mov qword [rsp + 0xb0], rcx
mov rax, qword [rsp + 0xb0]
mov qword [rax], 0
lea rax, [rcx + 8]
mov qword [rsp + 0x70], rax
xor eax, eax
mov dword [rcx + 8], eax
mov qword [rsp + 0x78], rcx
add rcx, 0xc
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xc8], rcx
mov rcx, qword [rsp + 0xc8]
mov dword [rcx], eax
mov ecx, 4
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x50], rax
mov eax, 0x681738df
mov esi, 0x7915425
cmp eax, 0x47321611
jle 0x180020ce8
cmp eax, 0x67efa1ec
jg 0x180020d4a
cmp eax, 0x53a705ab
jg 0x180020de5
cmp eax, 0x47321612
je 0x180020ede
cmp eax, 0x4a2b431a
je 0x180020f2f
cmp eax, 0x4a7fe741
jne 0x180020ca1
mov eax, 0x53a705ac
mov r13d, 1
jmp 0x180020ca1
cmp eax, 0x607d367
jle 0x180020dac
cmp eax, 0x2f3ca7b0
jg 0x180020e27
cmp eax, 0x607d368
je 0x180020f4b
cmp eax, 0x7915425
je 0x180020f81
cmp eax, 0x15cc9844
jne 0x180020ca1
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x1800474c0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x38]
mov qword [rax], 0
mov eax, 0x7915425
mov r15d, dword [rsp + 0x28]
jmp 0x180020ca1
cmp eax, 0x721bc1c7
jg 0x180020e5b
cmp eax, 0x67efa1ed
je 0x180020fa3
cmp eax, 0x681738df
je 0x180020fc3
cmp eax, 0x6ad58dec
jne 0x180020ca1
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
mov rsi, qword [rsp + 0x98]
mov edx, dword [rsi]
lea ebx, [rdx + 1]
mov dword [rsi], ebx
mov esi, 0x7915425
mov dword [rcx + rdx*4], eax
mov eax, 0x607d368
mov ebx, r12d
jmp 0x180020ca1
cmp eax, 0xe68f4066
jg 0x180020e88
cmp eax, 0xae7f7f0b
je 0x180020fe6
cmp eax, 0xbc46c837
je 0x18002100c
cmp eax, 0xd3681d49
jne 0x180020ca1
mov eax, 0x60fb72b6
xor r14d, r14d
jmp 0x180020ca1
cmp eax, 0x53a705ac
je 0x18002103a
cmp eax, 0x58bb4458
je 0x18002105d
cmp eax, 0x60fb72b6
jne 0x180020ca1
mov dword [rsp + 0x28], r14d
cmp dword [rsp + 0x28], 0
mov eax, 0x7915425
mov ecx, 0x721bc1c8
cmove eax, ecx
mov r15d, dword [rsp + 0x28]
jmp 0x180020ca1
cmp eax, 0x2f3ca7b1
je 0x180021082
cmp eax, 0x30cf65ff
je 0x1800210c4
cmp eax, 0x369c198c
jne 0x180020ca1
mov dword [rsp + 0x2c], ebp
cmp dword [rsp + 0x2c], 0
mov eax, 0x67efa1ed
jmp 0x180020fb1
cmp eax, 0x721bc1c8
je 0x1800210d8
cmp eax, 0x75b7eba4
je 0x180021107
cmp eax, 0x7eff6382
jne 0x180020ca1
mov eax, 0x369c198c
xor ebp, ebp
jmp 0x180020ca1
cmp eax, 0xf230305e
je 0x18002112c
cmp eax, 0xcaf188
jne 0x180021170
mov rax, qword [rsp + 0x98]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x60]
mov ecx, dword [rcx]
mov dword [rsp + 0x94], ecx
cmp eax, dword [rsp + 0x94]
mov eax, 0x47321612
mov ecx, 0x6ad58dec
cmovb eax, ecx
mov r12d, dword [rsp + 0x24]
jmp 0x180020ca1
mov r9d, dword [rsp + 0x94]
add r9d, r9d
mov rax, qword [rsp + 0x60]
mov dword [rax], r9d
shl r9, 2
mov rax, qword [rsp + 0x30]
mov r8, qword [rax]
mov rcx, qword [0x1800474c0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
mov eax, 0xae7f7f0b
mov ecx, 0x30cf65ff
cmove eax, ecx
jmp 0x180020ca1
cmp dword [rsp + 0x44], 0
mov eax, 0x369c198c
mov ecx, 0x6ad58dec
cmove eax, ecx
mov ebp, edi
mov r12d, edi
jmp 0x180020ca1
mov rax, qword [rsp + 0x58]
mov dword [rax], 0x1c
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0xd0]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
mov eax, 0x53a705ac
mov ecx, 0x369c198c
cmove eax, ecx
mov ebp, ebx
mov r13d, ebx
jmp 0x180020ca1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0xa8]
mov eax, 0xe68f4067
mov dword [rsp + 0x40], r15d
jmp 0x180020ca1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
mov eax, 0xd3681d49
mov ecx, 0x60fb72b6
cmove eax, ecx
mov r14d, dword [rsp + 0x2c]
jmp 0x180020ca1
mov rax, qword [rsp + 0x50]
cmp rax, 0xffffffffffffffff
mov eax, 0xf230305e
mov ecx, 0xe68f4067
cmove eax, ecx
mov dword [rsp + 0x40], 0
jmp 0x180020ca1
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x88]
mov qword [rax], rcx
mov eax, 0x4a2b431a
mov dword [rsp + 0x44], 0
mov edi, dword [rsp + 0x24]
jmp 0x180020ca1
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov ebx, dword [rax]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp ebx, eax
mov eax, 0x75b7eba4
mov ecx, 0x607d368
jmp 0x180021076
mov dword [rsp + 0x24], r13d
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0x10
mov eax, 0x607d368
mov ecx, 0x58bb4458
cmovae eax, ecx
mov ebx, dword [rsp + 0x24]
jmp 0x180020ca1
mov ebx, dword [rsp + 0xdc]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebx, eax
mov eax, 0x607d368
mov ecx, 0xbc46c837
cmove eax, ecx
mov ebx, dword [rsp + 0x24]
jmp 0x180020ca1
mov rax, qword [rsp + 0x70]
mov dword [rax], 0x80
mov rcx, qword [0x1800474c0]
mov r8d, 0x200
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
test rax, rax
mov eax, 0x6ad58dec
mov ecx, 0x7eff6382
cmove eax, ecx
mov r12d, dword [rsp + 0x24]
jmp 0x180020ca1
mov eax, 0x4a2b431a
xor edi, edi
mov dword [rsp + 0x44], 2
jmp 0x180020ca1
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
mov eax, 0x15cc9844
cmove eax, esi
mov r15d, dword [rsp + 0x28]
jmp 0x180020ca1
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
mov eax, 0xcaf188
mov ecx, 0x2f3ca7b1
cmove eax, ecx
jmp 0x180020ca1
lea rdx, [rsp + 0xd0]
mov qword [rsp + 0xa8], rdx
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x58], rdx
mov rax, qword [rsp + 0x58]
mov dword [rax], 0x1c
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_Thread32First
test eax, eax
mov eax, 0x4a7fe741
cmove eax, esi
xor r15d, r15d
jmp 0x180020ca1
cmp eax, 0xe68f4067
jne 0x180020ca1
movabs r15, 0x7b99e4fe0088a78e
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0xc4], eax
mov edx, dword [rsp + 0x68]
cmp edx, 1
mov ecx, 0xa5c5b9e3
mov eax, 0xe3336bb3
cmovne ecx, eax
mov dword [rsp + 0x78], ecx
test edx, edx
mov ecx, 0x3a2fa24d
cmovne ecx, eax
mov dword [rsp + 0x40], ecx
mov eax, 0x8be3417b
mov ecx, 0x8730081f
cmovle ecx, eax
mov dword [rsp + 0x70], ecx
mov eax, dword [rsp + 0x90]
inc eax
mov dword [rsp + 0x68], eax
mov eax, 0xb172fccc
mov ecx, 0xd4a79f91
cmove ecx, eax
mov dword [rsp + 0x44], ecx
mov eax, 0x5c28d1f5
cmp eax, 0x166250ee
jg 0x180021236
cmp eax, 0xbab714e1
jle 0x18002126a
cmp eax, 0xbab714e2
je 0x1800212ae
cmp eax, 0xe531fdc0
je 0x1800212f1
cmp eax, 0x41ff877
jne 0x1800211ea
mov dword [rsp + 0x6c], edi
mov rax, qword [rsp + 0xc8]
mov ecx, dword [rsp + 0x6c]
cmp ecx, dword [rax]
mov eax, 0xb5468fa5
mov ecx, 0xbab714e2
cmovb eax, ecx
jmp 0x1800211ea
cmp eax, 0x5a6ef203
jle 0x18002128c
cmp eax, 0x5a6ef204
je 0x180021301
cmp eax, 0x5c28d1f5
jne 0x180021a23
cmp dword [rsp + 0xc4], 0
mov eax, 0x166250ef
mov ecx, 0x9a9485c1
cmove eax, ecx
jmp 0x1800211ea
cmp eax, 0x9a9485c1
je 0x1800219c6
cmp eax, 0xb5468fa5
jne 0x1800211ea
mov eax, 0x65f2cabe
xor esi, esi
jmp 0x1800211ea
cmp eax, 0x166250ef
je 0x1800219d5
cmp eax, 0x45633057
jne 0x1800211ea
mov eax, 0x41ff877
xor edi, edi
jmp 0x1800211ea
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov ecx, dword [rsp + 0x6c]
mov r8d, dword [rax + rcx*4]
mov ecx, 0x5a
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
mov eax, 0x5a6ef204
mov ecx, 0xe531fdc0
cmove eax, ecx
jmp 0x1800211ea
mov edi, dword [rsp + 0x6c]
inc edi
mov eax, 0x41ff877
jmp 0x1800211ea
mov dword [rsp + 0xbc], edi
mov dword [rsp + 0xc0], esi
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, qword [rsp + 0xa0]
lea rdx, [rsp + 0xd0]
mov qword [rsp + 0x80], rdx
mov rax, qword [rsp + 0x80]
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x100], 0x100001
mov qword [rsp + 0x98], rcx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov r9d, dword [rsp + 0x70]
mov r8d, dword [rsp + 0x78]
mov dword [rsp + 0x24], eax
mov eax, 0xb47e6b50
mov ecx, eax
cmp eax, 0xde6a946d
jle 0x1800213bf
cmp ecx, 0x20ec9cd9
jle 0x180021411
cmp ecx, 0x51576e0d
jle 0x1800214b8
cmp ecx, 0x77f04178
jg 0x180021595
cmp ecx, 0x51576e0e
je 0x1800215f8
mov eax, ecx
cmp ecx, 0x5ea51e85
je 0x1800215c1
jmp 0x180021376
cmp ecx, 0xb47e6b4f
jg 0x180021464
cmp ecx, 0x8f7c9e1f
jle 0x1800214e6
cmp ecx, 0xa5c5b9e2
jle 0x1800215d5
cmp ecx, 0xa5c5b9e3
je 0x1800217e0
mov eax, ecx
cmp ecx, 0xb172fccc
jne 0x180021376
mov eax, 0x77f04179
xor r10d, r10d
mov r13d, dword [0x1800474d4]
jmp 0x180021376
cmp ecx, 0x8e748b
jg 0x180021518
cmp ecx, 0xde6a946e
je 0x1800217f0
cmp ecx, 0xe3336bb3
je 0x180021813
mov eax, ecx
cmp ecx, 0xf6b62902
jne 0x180021376
mov dword [rsp + 0x28], r14d
mov eax, dword [rsp + 0x2c]
mov ecx, dword [rsp + 0x28]
cmp ecx, eax
mov eax, 0x441a46d6
mov ecx, 0x11ce05ad
cmovb eax, ecx
jmp 0x180021376
cmp ecx, 0xc3832c0d
jg 0x18002155c
cmp ecx, 0xb47e6b50
je 0x18002181d
cmp ecx, 0xb56e0213
je 0x180021834
mov eax, ecx
cmp ecx, 0xb7167c0a
jne 0x180021376
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax + 0x20]
shr eax, 2
mov ecx, eax
xor cl, 0x3e
movzx r12d, cl
and r12d, eax
mov eax, 0x8bb25ae2
jmp 0x180021376
mov eax, r9d
cmp ecx, 0x20ec9cda
je 0x180021376
cmp ecx, 0x3a2fa24d
je 0x180021874
mov eax, ecx
cmp ecx, 0x441a46d6
je 0x1800215cb
jmp 0x180021376
mov eax, r8d
cmp ecx, 0x8730081f
je 0x180021376
cmp ecx, 0x8bb25ae2
je 0x180021881
mov eax, ecx
cmp ecx, 0x8be3417b
jne 0x180021376
mov eax, dword [rsp + 0x40]
jmp 0x180021376
cmp ecx, 0x8e748c
je 0x1800215c1
cmp ecx, 0x4915b02
je 0x1800218b3
mov eax, ecx
cmp ecx, 0x11ce05ad
jne 0x180021376
mov eax, dword [rsp + 0x28]
imul rax, rax, 0x38
add rax, qword [0x1800474c8]
mov qword [rsp + 0x60], rax
mov eax, 0x20ec9cda
jmp 0x180021376
cmp ecx, 0xc3832c0e
je 0x1800215cb
cmp ecx, 0xc3ae686a
je 0x18002199d
mov eax, ecx
cmp ecx, 0xd4a79f91
jne 0x180021376
mov eax, 0x77f04179
mov r10d, dword [rsp + 0x90]
mov r13d, dword [rsp + 0x68]
jmp 0x180021376
cmp ecx, 0x77f04179
je 0x1800219b4
mov eax, ecx
cmp ecx, 0x7c8b0b3f
jne 0x180021376
mov r14d, dword [rsp + 0x28]
inc r14d
mov eax, 0xf6b62902
jmp 0x180021376
mov eax, 0x7c8b0b3f
jmp 0x180021376
mov eax, 0x98c85161
jmp 0x180021376
mov eax, dword [rsp + 0x44]
cmp ecx, 0x8f7c9e20
je 0x180021376
mov eax, ecx
cmp ecx, 0x98c85161
jne 0x180021376
jmp 0x1800219f5
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x60]
mov dl, byte [rcx + 0x20]
and dl, 1
movzx edx, dl
mov dword [rsp + 0xa8], edx
mov esi, 0xa23af98d
cmp esi, 0x1cf6bf6f
jg 0x180021664
cmp esi, 0xb4586865
jg 0x1800216b9
cmp esi, 0x952fbfc9
je 0x18002171b
cmp esi, 0x9a27aa3f
je 0x180021744
cmp esi, 0xa23af98d
jne 0x18002161a
cmp dword [rsp + 0xa8], 0
mov esi, 0x9a27aa3f
je 0x18002161a
mov esi, 0x758fd35b
jmp 0x18002161a
cmp esi, 0x48c84239
jle 0x1800216f6
cmp esi, 0x48c8423a
je 0x180021750
cmp esi, 0x5ba051ec
je 0x180021767
cmp esi, 0x758fd35b
jne 0x18002161a
mov rbp, qword [rcx]
mov qword [rsp + 0x38], rbp
mov rbp, qword [rsp + 0x38]
add rbp, 0xfffffffffffffffb
mov esi, 0x5ba051ec
cmp rbp, rax
je 0x18002161a
mov esi, 0x9a27aa3f
jmp 0x18002161a
cmp esi, 0xb4586866
je 0x180021776
cmp esi, 0xdae10ad6
je 0x1800217ae
cmp esi, 0x1c561b6
jne 0x18002161a
mov esi, 0x345dda06
cmp rax, qword [rcx + 8]
je 0x18002161a
mov esi, 0xdae10ad6
jmp 0x18002161a
cmp esi, 0x1cf6bf70
je 0x1800217ba
cmp esi, 0x345dda06
jne 0x1800217ca
mov rbx, qword [rcx]
mov esi, 0x3914ed33
jmp 0x18002161a
mov dword [rsp + 0x58], edx
mov esi, dword [rcx + 0x24]
mov ebp, esi
xor ebp, 0xfffffff0
and ebp, esi
mov edi, dword [rsp + 0x58]
mov esi, 0xb4586866
cmp edi, ebp
jb 0x18002161a
mov esi, 0x1c561b6
jmp 0x18002161a
mov esi, 0x952fbfc9
xor edx, edx
jmp 0x18002161a
mov rbp, qword [rsp + 0x48]
movzx ebx, byte [rcx + rbp + 0x28]
add rbx, qword [rcx]
mov esi, 0x3914ed33
jmp 0x18002161a
mov esi, 0x3914ed33
mov rbx, qword [rsp + 0x38]
jmp 0x18002161a
mov rbp, qword [rcx + 0x10]
mov edi, dword [rsp + 0x58]
mov qword [rsp + 0x48], rdi
mov rdi, qword [rsp + 0x48]
movzx edi, byte [rcx + rdi + 0x30]
add rdi, r15
add rdi, rbp
sub rdi, r15
mov esi, 0x48c8423a
cmp rdi, rax
je 0x18002161a
mov esi, 0x1cf6bf70
jmp 0x18002161a
mov esi, 0x3914ed33
xor ebx, ebx
jmp 0x18002161a
mov edx, dword [rsp + 0x58]
inc edx
mov esi, 0x952fbfc9
jmp 0x18002161a
cmp esi, 0x3914ed33
jne 0x18002161a
mov eax, 0xde6a946e
jmp 0x180021376
mov eax, 0x8bb25ae2
mov r12d, 1
jmp 0x180021376
mov qword [rsp + 0x88], rbx
cmp qword [rsp + 0x88], 0
mov eax, 0xb56e0213
mov ecx, 0x5ea51e85
cmove eax, ecx
jmp 0x180021376
mov eax, 0xb7167c0a
jmp 0x180021376
cmp dword [rsp + 0x24], 0
mov eax, 0x8f7c9e20
mov ecx, 0xc3832c0e
cmove eax, ecx
jmp 0x180021376
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x88]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x98]
lea rdx, [rsp + 0xd0]
mov esi, r10d
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov r10d, esi
mov r9d, dword [rsp + 0x70]
mov r8d, dword [rsp + 0x78]
mov eax, 0x5ea51e85
jmp 0x180021376
mov eax, 0x8bb25ae2
xor r12d, r12d
jmp 0x180021376
mov dword [rsp + 0x50], r12d
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax + 0x20]
shr eax, 1
mov ecx, eax
xor cl, 0x7e
movzx ecx, cl
and ecx, eax
mov eax, dword [rsp + 0x50]
cmp eax, ecx
mov eax, 0xc3ae686a
mov ecx, 0x8e748c
cmove eax, ecx
jmp 0x180021376
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x60]
mov esi, 0x16bf29e8
xor edx, edx
cmp esi, 0xba909da
jg 0x1800218ec
cmp esi, 0x893ee84a
je 0x18002192b
cmp esi, 0x970f720c
je 0x180021959
cmp esi, 0x24ceeaf
jne 0x1800218c7
jmp 0x1800217d6
cmp esi, 0xba909db
je 0x180021981
cmp esi, 0x6ce87f58
je 0x180021991
cmp esi, 0x16bf29e8
jne 0x1800218c7
mov dword [rsp + 0x38], edx
mov esi, dword [rcx + 0x24]
and esi, 0xf
mov ebp, dword [rsp + 0x38]
cmp ebp, esi
mov esi, 0x6ce87f58
mov ebp, 0x893ee84a
cmovb esi, ebp
jmp 0x1800218c7
mov rbp, qword [rcx]
mov esi, dword [rsp + 0x38]
mov qword [rsp + 0x48], rsi
mov rsi, qword [rsp + 0x48]
movzx esi, byte [rcx + rsi + 0x28]
add rsi, rbp
cmp rsi, rax
mov esi, 0xba909db
mov ebp, 0x970f720c
cmove esi, ebp
jmp 0x1800218c7
mov rbp, qword [rsp + 0x48]
movzx ebx, byte [rcx + rbp + 0x30]
movabs rbp, 0x946fb12409ff123f
add rbx, rbp
add rbx, qword [rcx + 0x10]
sub rbx, rbp
mov esi, 0x24ceeaf
jmp 0x1800218c7
mov edx, dword [rsp + 0x38]
inc edx
mov esi, 0x16bf29e8
jmp 0x1800218c7
mov esi, 0x24ceeaf
xor ebx, ebx
jmp 0x1800218c7
cmp dword [rsp + 0x50], 0
mov eax, 0x4915b02
mov ecx, 0x51576e0e
cmove eax, ecx
jmp 0x180021376
mov dword [rsp + 0x2c], r13d
mov eax, 0xf6b62902
mov r14d, r10d
jmp 0x180021376
mov eax, 0x65f2cabe
mov esi, 9
jmp 0x1800211ea
mov rax, qword [rsp + 0xb0]
cmp qword [rax], 0
mov eax, 0x45633057
mov ecx, 0x65f2cabe
cmove eax, ecx
xor esi, esi
jmp 0x1800211ea
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xe531fdc0
mov esi, dword [rsp + 0xc0]
mov edi, dword [rsp + 0xbc]
jmp 0x1800211ea
cmp eax, 0x65f2cabe
jne 0x1800211ea
mov rcx, qword [rsp + 0x5a0]
xor rcx, rsp
call fcn.180026fa0
mov eax, esi
add rsp, 0x5a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret