Function at 0x180006760
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x518
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x18000c338], eax
je 0x180006787
mov eax, 0x10dd
add rsp, 0x518
ret
cmp dword [0x18000c33c], 0
je 0x1800067a3
call fcn.1800065e0
mov eax, dword [0x18000c33c]
add rsp, 0x518
ret
mov qword [rsp + 0x530], rbx
mov rbx, qword [0x18000c350]
mov qword [rsp + 0x510], rbp
mov qword [rsp + 0x508], rsi
mov qword [rsp + 0x500], rdi
mov qword [rsp + 0x4f8], r12
mov qword [rsp + 0x4f0], r13
xor r13d, r13d
mov r12d, r13d
test rbx, rbx
je 0x18000684e
cmp dword [rbx + 8], r12d
je 0x18000680e
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
movzx r8d, byte [rdx + 0x36]
add rdx, 0x20
call fcn.1800048d0
mov r11, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
mov qword [r11], rax
jmp 0x180006846
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov byte [rcx], 0xff
mov byte [rcx + 1], 0x25
add rdx, 0x48
lea rax, [rcx + 6]
add rcx, 6
sub edx, eax
mov dword [rcx - 4], edx
mov rdx, qword [rbx + 0x20]
mov rdx, qword [rdx + 0x40]
call fcn.180006040
mov r11, qword [rbx + 0x10]
mov rax, qword [rbx + 0x20]
mov qword [r11], rax
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1800067e5
mov rdi, qword [0x18000c348]
test rdi, rdi
je 0x1800069b1
nop
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1800069a5
mov rbx, qword [0x18000c350]
test rbx, rbx
je 0x1800069a5
mov rcx, qword [rsp + 0x118]
cmp dword [rbx + 8], r12d
je 0x18000691c
mov r8, qword [rbx + 0x20]
cmp rcx, r8
jb 0x180006999
lea rax, [r8 + 8]
cmp rcx, rax
jae 0x180006999
movzx r9d, byte [rsp + 0x118]
mov edx, r13d
mov rcx, r13
sub r9b, r8b
nop dword [rax]
movzx eax, byte [r8 + rcx + 0x38]
shr al, 3
cmp al, r9b
je 0x1800068ec
inc edx
inc rcx
cmp edx, 8
jb 0x1800068d0
xor al, al
jmp 0x1800068f4
movzx eax, byte [rcx + r8 + 0x38]
and al, 7
mov rcx, qword [rdi + 8]
movzx eax, al
lea rdx, [rsp + 0x20]
add rax, qword [rbx + 0x18]
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rsp + 0x118]
jmp 0x180006999
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jb 0x180006999
mov r8, qword [rbx + 0x20]
movzx eax, byte [r8 + 0x36]
add rax, rdx
cmp rcx, rax
jae 0x180006999
movzx r9d, byte [rsp + 0x118]
mov edx, r13d
mov rcx, r13
sub r9b, byte [rbx + 0x18]
nop dword [rax]
movzx eax, byte [r8 + rcx + 0x38]
and al, 7
cmp al, r9b
je 0x18000696c
inc edx
inc rcx
cmp edx, 8
jb 0x180006950
mov eax, r13d
jmp 0x180006975
movzx eax, byte [rcx + r8 + 0x38]
shr eax, 3
mov rcx, qword [rdi + 8]
cdqe
lea rdx, [rsp + 0x20]
add rax, r8
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rsp + 0x118]
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180006897
mov rdi, qword [rdi]
test rdi, rdi
jne 0x180006860
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rsi, qword [0x18000c350]
mov rbp, rax
test rsi, rsi
je 0x180006a65
nop word [rax + rax]
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x180006a42
movzx edx, byte [rcx + 0x36]
mov r8d, dword [rsi + 0x28]
mov rcx, qword [rsi + 0x18]
lea r9, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r11, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x18]
movzx r8d, byte [r11 + 0x36]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp dword [rsi + 8], r13d
je 0x180006a42
mov rdi, qword [rsi + 0x20]
xor r8d, r8d
lea edx, [r8 + 0x50]
mov rbx, rdi
mov rcx, rdi
and rbx, 0xffffffffffff0000
call fcn.1800049b0
mov rax, qword [rbx + 0x10]
mov qword [rdi + 0x40], rax
mov qword [rbx + 0x10], rdi
mov qword [rsi + 0x20], r13
mov r12d, 1
mov rbx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, rbx
test rbx, rbx
jne 0x1800069d0
mov rsi, qword [rsp + 0x508]
mov rbp, qword [rsp + 0x510]
test r12d, r12d
mov r12, qword [rsp + 0x4f8]
mov qword [0x18000c350], r13
je 0x180006a97
cmp dword [0x18000c334], r13d
jne 0x180006a97
call fcn.1800064b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, qword [0x18000c320]
mov rdi, rax
test rbx, rbx
je 0x180006ae7
nop dword [rax]
lea r9, [rsp + 0x528]
mov edx, 0x10000
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, 0x10000
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x180006ab0
mov rdi, qword [0x18000c348]
test rdi, rdi
je 0x180006b26
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, rbx
test rbx, rbx
jne 0x180006af3
mov rdi, qword [rsp + 0x500]
mov rbx, qword [rsp + 0x530]
mov eax, dword [0x18000c33c]
mov qword [0x18000c348], r13
mov dword [0x18000c338], r13d
mov r13, qword [rsp + 0x4f0]
add rsp, 0x518
ret