Function at 0x41067190
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6c0
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rsp + 0x710], rbx
mov rax, qword [0x41359af8]
xor rax, rsp
mov qword [rsp + 0x6b8], rax
mov r12d, r8d
mov rbx, rdx
mov r15, rcx
test r8d, r8d
jle 0x41067747
cmp dword [rcx + 0x28], 0
je 0x41067747
lea rcx, [rsp + 0x60]
call fcn.41176a40
mov qword [rsp + 0x68], rax
mov byte [rax + 0x49], 1
mov rax, qword [rsp + 0x68]
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x68]
mov qword [rax], rax
mov rax, qword [rsp + 0x68]
mov qword [rax + 0x10], rax
xor edi, edi
mov qword [rsp + 0x70], rdi
mov r14, qword [r15 + 0x30]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r13, rax
lea r8, [rsp + 0x60]
lea rdx, [0x410670b0]
mov rcx, r14
call qword [sym.imp.dbghelp.dll_EnumerateLoadedModules64]
test eax, eax
jne 0x410672c4
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x80], rcx
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x50], xmm0
mov rax, qword [rax]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x90], xmm0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x60]
call fcn.41066b00
mov rcx, qword [rsp + 0x68]
call fcn.41210d60
xor eax, eax
jmp 0x41067749
test rbx, rbx
jne 0x410673d8
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp r13, rax
jne 0x4106730b
xor edx, edx
mov r8d, 0x4d0
lea rcx, [rsp + 0x1c0]
call fcn.412121c0
mov dword [rsp + 0x1f0], 0x10000b
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
jmp 0x410673ee
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov r8d, 0x4d0
lea rcx, [rsp + 0x1c0]
call fcn.412121c0
mov dword [rsp + 0x1f0], 0x10000b
lea rdx, [rsp + 0x1c0]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x410673ee
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x80], rcx
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x50], xmm0
mov rax, qword [rax]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x90], xmm0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x60]
call fcn.41066b00
mov rcx, qword [rsp + 0x68]
call fcn.41210d60
xor eax, eax
jmp 0x41067749
lea rcx, [rsp + 0x1c0]
mov rdx, rbx
mov r8d, 0x4d0
call fcn.41217500
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rsp + 0xb0]
call fcn.412121c0
mov r11, qword [rsp + 0x2b8]
mov qword [rsp + 0xb0], r11
mov dword [rsp + 0xbc], 3
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0xdc], 3
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0xec], 3
mov ebp, edi
test r12d, r12d
jle 0x410676db
nop
nop
nop
mov qword [rsp + 0x40], rdi
mov rax, qword [sym.imp.dbghelp.dll_SymGetModuleBase64]
mov qword [rsp + 0x38], rax
mov rax, qword [sym.imp.dbghelp.dll_SymFunctionTableAccess64]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
mov r8, r13
mov rdx, r14
mov ecx, 0x8664
call qword [sym.imp.dbghelp.dll_StackWalk64]
test eax, eax
je 0x410676db
cmp qword [rsp + 0xd0], 0
je 0x410676db
mov rdx, qword [rsp + 0xb0]
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymGetModuleBase64]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rdx + 8]
mov r8, rdx
cmp byte [rcx + 0x49], 0
jne 0x410674f9
cmp dword [rcx + 0x18], eax
jae 0x410674ed
mov rcx, qword [rcx + 0x10]
jmp 0x410674f3
mov r8, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x49], 0
je 0x410674e2
mov qword [rsp + 0x88], r8
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x80], rcx
cmp r8, rdx
je 0x41067523
cmp eax, dword [r8 + 0x18]
jb 0x41067523
lea rcx, [rsp + 0x80]
jmp 0x41067540
mov qword [rsp + 0x98], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x90]
lea r8, [rsp + 0x50]
mov rax, qword [rcx]
mov qword [r8], rax
mov rax, qword [rcx + 8]
mov qword [r8 + 8], rax
mov rsi, rdx
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x4106756a
lea rax, [rsp + 0x60]
cmp rbx, rax
je 0x41067574
call fcn.41211d60
mov rdx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x58]
cmp rdi, rsi
je 0x41067625
test rbx, rbx
jne 0x4106758c
call fcn.41211d60
cmp rdi, qword [rbx + 8]
jne 0x41067597
call fcn.41211d60
lea rdx, [rdi + 0x20]
mov qword [rsp + 0x6b0], 0xf
xor edi, edi
mov qword [rsp + 0x6a8], rdi
mov byte [rsp + 0x698], dil
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x690]
call fcn.41001b20
nop
lea rbx, [rsp + 0x698]
cmp qword [rsp + 0x6b0], 0x10
cmovae rbx, qword [rsp + 0x698]
mov rcx, r15
call fcn.410034f0
mov rdx, rax
mov rcx, rbx
call fcn.41239ff0
test eax, eax
je 0x41067638
cmp qword [rsp + 0x6b0], 0x10
jb 0x4106761e
mov rcx, qword [rsp + 0x698]
call fcn.41210d60
mov rdx, qword [rsp + 0x68]
jmp 0x41067627
mov rdx, qword [rsp + 0x68]
jmp 0x41067627
xor edi, edi
add ebp, 1
cmp ebp, r12d
jge 0x410676e0
jmp 0x41067460
cmp qword [rsp + 0x6b0], 0x10
jb 0x41067650
mov rcx, qword [rsp + 0x698]
call fcn.41210d60
mov qword [rsp + 0x6b0], 0xf
mov qword [rsp + 0x6a8], rdi
mov byte [rsp + 0x698], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x50], rcx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x90], xmm0
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x60]
call fcn.41066b00
mov rcx, qword [rsp + 0x68]
call fcn.41210d60
mov eax, 1
jmp 0x41067749
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x90], xmm0
mov rax, qword [rdx]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x60]
call fcn.41066b00
mov rcx, qword [rsp + 0x68]
call fcn.41210d60
xor eax, eax
jmp 0x41067749
xor eax, eax
mov rcx, qword [rsp + 0x6b8]
xor rcx, rsp
call fcn.41211b80
mov rbx, qword [rsp + 0x710]
add rsp, 0x6c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret