Function at 0x140002180
Capabilities:
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x348
movsxd r12, dword [rdx + 0x3c]
mov rbp, rcx
add r12, rdx
lea rcx, [0x14000b080]
mov rdi, rdx
mov edx, 0x1abedc6c
call sym.m_GetProcAddressEx
mov r8d, dword [r12 + 0x50]
mov rcx, qword [rbp]
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
call rax
mov qword [rsp + 0x68], rax
mov r10, rax
test rax, rax
je 0x140002220
mov eax, dword [r12 + 0x34]
mov dword [r12 + 0x34], r10d
mov edx, 0x11712a10
lea rcx, [0x14000b080]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x40], eax
call sym.m_GetProcAddressEx
mov r9d, dword [r12 + 0x54]
mov rcx, qword [rbp]
mov r8, rdi
mov qword [rsp + 0x20], 0
mov rdx, qword [rsp + 0x68]
mov r13, rax
call rax
test eax, eax
jne 0x140002240
xor eax, eax
add rsp, 0x348
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rdi
call sym.GetRelocAddress32_void_
mov r8, rax
mov ebx, eax
shr r8, 0x20
cmp word [r12 + 6], 0
mov dword [rsp + 0x54], r8d
je 0x140002220
lea rsi, [r12 + 0x18]
mov qword [rsp + 0x48], r8
xor r14d, r14d
xor r15d, r15d
mov qword [rsp + 0x390], rbp
mov rbp, r12
mov r12, qword [rsp + 0x390]
jmp 0x140002295
movzx eax, word [rbp + 6]
add r14, 1
cmp eax, r14d
jle 0x1400022e8
movzx eax, word [rbp + 0x14]
lea rdx, [r14 + r14*4]
add rax, rsi
lea rdx, [rax + rdx*8]
mov eax, dword [rdx + 0xc]
cmp ebx, eax
jb 0x1400022b6
mov ecx, dword [rdx + 8]
add ecx, eax
cmp ebx, ecx
cmovb r15, rdx
mov r8d, dword [rdx + 0x14]
mov r9d, dword [rdx + 0x10]
mov edx, eax
mov rcx, qword [r12]
add rdx, qword [rsp + 0x68]
mov qword [rsp + 0x20], 0
add r8, rdi
call r13
test eax, eax
jne 0x140002288
jmp 0x140002220
mov qword [rsp + 0x390], r12
mov r10, qword [rsp + 0x38]
mov r12, rbp
mov r8, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x390]
test r15, r15
je 0x140002220
mov esi, dword [rsp + 0x40]
mov eax, r10d
xor ebx, ebx
sub eax, esi
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
test r8d, r8d
je 0x14000243c
mov qword [rsp + 0x58], r12
mov esi, ebx
mov qword [rsp + 0x40], r13
nop dword [rax]
mov ecx, dword [r15 + 0x14]
mov eax, esi
lea r12d, [rsi + 8]
lea r8, [rdi + rcx]
lea r13, [r8 + rax]
mov eax, dword [r13 + 4]
sub rax, 8
shr rax, 1
test eax, eax
je 0x1400024e0
mov dword [rsp + 0x50], esi
xor r14d, r14d
mov rsi, rdi
mov rdi, r13
mov r13d, eax
mov rax, rcx
jmp 0x140002387
mov r14d, eax
mov eax, dword [r15 + 0x14]
mov ecx, r12d
add r12d, 2
add rcx, rsi
add rcx, rax
cmp byte [rcx + 1], 0xf
jbe 0x14000240d
movzx ebx, word [rcx]
mov eax, dword [rdi]
mov edx, 0x328cff03
lea rcx, [0x14000b080]
mov dword [rsp + 0x70], 0
and ebx, 0xfff
add rbx, qword [rsp + 0x68]
add rbx, rax
call sym.m_GetProcAddressEx
mov rcx, qword [rbp]
mov r8, qword [rsp + 0x38]
mov rdx, rbx
mov qword [rsp + 0x20], 0
mov r9d, 4
call rax
mov eax, dword [rsp + 0x48]
mov rcx, qword [rbp]
mov r9d, 4
add dword [rsp + 0x70], eax
mov r8, qword [rsp + 0x38]
mov rdx, rbx
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x40]
call rax
lea eax, [r14 + 1]
cmp r13d, eax
jne 0x140002380
mov rdi, rsi
mov esi, dword [rsp + 0x50]
lea esi, [rsi + r14*2 + 0xa]
mov eax, dword [rsp + 0x54]
cmp esi, eax
jb 0x140002340
mov r12, qword [rsp + 0x58]
mov r13, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
xor eax, eax
mov ecx, 0x59
lea rbx, [rsp + 0x70]
mov rdx, rbx
rep stosq qword [rdi], rax
mov rcx, qword [rbp + 8]
mov dword [rdi], 0
mov dword [rsp + 0x70], 0x10000b
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x140002220
mov edx, dword [rsp + 0x114]
mov rcx, qword [rbp]
mov r9d, 4
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x68]
add rdx, 8
call r13
test eax, eax
je 0x140002220
mov eax, dword [r12 + 0x28]
add eax, dword [rsp + 0x68]
mov rdx, rbx
mov dword [rsp + 0x120], eax
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
test eax, eax
je 0x140002220
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
jmp 0x140002222
mov esi, r12d
jmp 0x140002426