Function at 0x140002340
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x14000f040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 7], xmm1
mov r8d, 7
lea rdx, [0x14000a8a0]
lea rcx, [rbp - 9]
call fcn.140006e20
lea rcx, [rbp - 9]
call fcn.140001580
mov ebx, eax
mov dword [rbp - 0x61], eax
mov rdx, qword [rbp + 0xf]
cmp rdx, 7
jbe 0x1400023e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400023e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000286c
call fcn.1400083f0
test ebx, ebx
jne 0x140002411
lea rdx, str.Vanguard_is_not_running._Please_run_it_first.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140006a30
mov rcx, rax
lea rdx, [0x140006c10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14000287e
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov qword [rbp - 0x51], rax
test rax, rax
jne 0x140002468
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, [0x14000a910]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140006810
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400069f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000287e
xor edx, edx
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x1400024c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, [0x14000a918]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140006810
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400069f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000287e
mov dword [rbp - 0x49], 0x1c
lea rdx, [rbp - 0x49]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x140002514
lea rdx, [0x14000a928]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140006a30
mov rcx, rax
lea rdx, [0x140006c10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000287e
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
xor r15d, r15d
mov qword [rbp + 0x27], r15
movdqu xmmword [rbp - 0x21], xmm1
xor r13d, r13d
mov qword [rbp - 0x11], r13
movdqu xmmword [rbp - 9], xmm1
xor r14d, r14d
mov qword [rbp - 0x59], r14
mov qword [rbp + 7], r14
mov rdi, qword [rbp + 0x1f]
mov rbx, qword [rbp - 0x19]
mov rsi, qword [rbp - 1]
nop dword [rax + rax]
mov eax, dword [rbp - 0x61]
cmp dword [rbp - 0x3d], eax
jne 0x140002676
mov r8d, dword [rbp - 0x41]
xor edx, edx
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov r14, rax
mov qword [rbp - 0x69], rax
test rax, rax
je 0x140002653
mov qword [rbp - 0x29], 0
lea rdx, [rbp - 0x29]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
test eax, eax
je 0x140002625
cmp rdi, r15
je 0x1400025ac
mov qword [rdi], r14
add rdi, 8
mov qword [rbp + 0x1f], rdi
jmp 0x1400025c4
lea r8, [rbp - 0x69]
mov rdx, rdi
lea rcx, [rbp + 0x17]
call fcn.140007670
mov r15, qword [rbp + 0x27]
mov rdi, qword [rbp + 0x1f]
cmp rbx, r13
je 0x1400025da
mov rax, qword [rbp - 0x29]
mov qword [rbx], rax
add rbx, 8
mov qword [rbp - 0x19], rbx
jmp 0x1400025f2
lea r8, [rbp - 0x29]
mov rdx, rbx
lea rcx, [rbp - 0x21]
call fcn.140007670
mov r13, qword [rbp - 0x11]
mov rbx, qword [rbp - 0x19]
cmp rsi, qword [rbp - 0x59]
je 0x140002607
mov eax, dword [rbp - 0x41]
mov dword [rsi], eax
add rsi, 4
mov qword [rbp - 1], rsi
jmp 0x140002676
lea r8, [rbp - 0x41]
mov rdx, rsi
lea rcx, [rbp - 9]
call fcn.1400079a0
mov rax, qword [rbp + 7]
mov qword [rbp - 0x59], rax
mov rsi, qword [rbp - 1]
jmp 0x140002676
lea rdx, [0x14000a928]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140006a30
mov rcx, rax
lea rdx, [0x140006c10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002676
lea rdx, str.Failed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140006a30
mov rcx, rax
lea rdx, [0x140006c10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [rbp - 0x49]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140002550
mov qword [rbp - 0x69], r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov qword [rbp - 0x29], rsi
mov r13, 0xffffffffffffffff
mov r12, qword [rbp + 0x17]
sub rdi, r12
sar rdi, 3
mov r14, qword [rbp - 0x21]
test rdi, rdi
je 0x1400027ab
mov rbx, r12
mov rax, r14
sub rax, r12
mov r12, rax
nop
mov qword [rbp - 0x29], 0
lea rdx, [rbp - 0x29]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
test eax, eax
je 0x14000271e
mov r14, qword [rbp - 0x29]
sub r14, qword [r12 + rbx]
je 0x140002741
cmp r14, r13
jae 0x140002741
test rsi, rsi
je 0x140002716
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, r14
mov rsi, qword [rbx]
jmp 0x14000274a
lea rdx, str.Failed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140006a30
mov rcx, rax
lea rdx, [0x140006c10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 8
sub rdi, 1
jne 0x1400026e0
mov qword [rbp - 0x29], rsi
test rsi, rsi
mov r12, qword [rbp + 0x17]
je 0x1400027a7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x14000279e
mov rdx, qword [0x14000f950]
cmp rdx, qword [0x14000f958]
je 0x14000278c
mov qword [rdx], rsi
add qword [0x14000f950], 8
jmp 0x1400027a7
lea r8, [rbp - 0x29]
lea rcx, [0x14000f948]
call fcn.140007670
jmp 0x1400027a7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rbp - 0x21]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400027f5
mov rax, qword [rbp - 0x59]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400083f0
nop
test r14, r14
je 0x14000283e
mov rdx, qword [rbp - 0x69]
sub rdx, r14
sar rdx, 3
lea rdx, [rdx*8]
mov rax, r14
cmp rdx, 0x1000
jb 0x140002835
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002835
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.1400083f0
nop
test r12, r12
je 0x14000287e
sub r15, r12
and r15, 0xfffffffffffffff8
mov rax, r12
cmp r15, 0x1000
jb 0x140002873
add r15, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002873
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r15
mov rcx, r12
call fcn.1400083f0
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400083d0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret