Function at 0x14009b033
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push rax
pushf
mov eax, 0x70e9d8e9
pushf
not eax
add eax, 0xab3cb6c6
xor eax, 0xdbe80760
rol eax, 0x66
popf
pushf
not eax
add eax, 0xb3fee5eb
xor eax, 0x90cb850d
rol eax, 0xfe
popf
pushf
not eax
add eax, 0x95006d58
xor eax, 0x9f9f8068
rol eax, 0xec
popf
cmp eax, 4
jne 0x14009b083
popf
pop rax
jmp 0x14009b424
cmp eax, 0
jne 0x14009b092
popf
pop rax
jmp 0x14009b1be
cmp eax, 3
jne 0x14009b0a1
popf
pop rax
jmp 0x14009b3b2
cmp eax, 1
jne 0x14009b0b0
popf
pop rax
jmp 0x14009b2ba
cmp eax, 0xd
jne 0x14009b0bf
popf
pop rax
jmp 0x14009b965
cmp eax, 7
jne 0x14009b0ce
popf
pop rax
jmp 0x14009b622
cmp eax, 0xe
jne 0x14009b0dd
popf
pop rax
jmp 0x14009ba34
cmp eax, 0xb
jne 0x14009b0ec
popf
pop rax
jmp 0x14009b8c0
cmp eax, 0xc
jne 0x14009b0fb
popf
pop rax
jmp 0x14009b8fe
cmp eax, 8
jne 0x14009b10a
popf
pop rax
jmp 0x14009b745
cmp eax, 0x10
jne 0x14009b119
popf
pop rax
jmp 0x14009bb02
cmp eax, 2
jne 0x14009b128
popf
pop rax
jmp 0x14009b350
cmp eax, 9
jne 0x14009b137
popf
pop rax
jmp 0x14009b7a3
cmp eax, 0x12
jne 0x14009b146
popf
pop rax
jmp 0x14009bbf8
cmp eax, 6
jne 0x14009b155
popf
pop rax
jmp 0x14009b58e
cmp eax, 0x11
jne 0x14009b164
popf
pop rax
jmp 0x14009bba6
cmp eax, 5
jne 0x14009b173
popf
pop rax
jmp 0x14009b4d0
cmp eax, 0x15
jne 0x14009b182
popf
pop rax
jmp 0x14009bd90
cmp eax, 0xa
jne 0x14009b191
popf
pop rax
jmp 0x14009b824
cmp eax, 0x14
jne 0x14009b1a0
popf
pop rax
jmp 0x14009bcea
cmp eax, 0xf
jne 0x14009b1af
popf
pop rax
jmp 0x14009ba84
cmp eax, 0x13
jne 0x14009b1be
popf
pop rax
jmp 0x14009bcc7
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140013240]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov r14d, edx
mov rbx, rcx
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
xor edx, edx
mov ebp, r8d
lea ecx, [rsi + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14009b261
push rax
pushf
mov eax, 0xe866f8dc
pushf
not eax
add eax, 0x9b23560e
xor eax, 0xf4c0b391
rol eax, 0x43
popf
pushf
not eax
add eax, 0x9b78a08e
xor eax, 0x9ac826ea
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xdc6c189a
xor eax, 0xf72cb4a5
rol eax, 0xc1
popf
pushf
not eax
add eax, 0xddf6ded8
xor eax, 0xffbb3922
rol eax, 9
popf
jmp 0x14009b074
push rax
pushf
mov eax, 0x72af4f65
pushf
not eax
add eax, 0xccc1ed91
xor eax, 0x93467263
rol eax, 0x9c
popf
pushf
not eax
add eax, 0xadcc38ae
xor eax, 0xeaa72d2b
rol eax, 0x92
popf
pushf
not eax
add eax, 0xf865ba7f
xor eax, 0xf874f00b
rol eax, 0x43
popf
pushf
not eax
add eax, 0xc15c10a2
xor eax, 0xd7182ec1
rol eax, 0x8c
popf
jmp 0x14009b074
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x14009b31d
push rax
pushf
mov eax, 0xdfd4f4a6
pushf
not eax
add eax, 0xa59b684f
xor eax, 0xaa647bab
rol eax, 7
popf
pushf
not eax
add eax, 0xfba22608
xor eax, 0xcc6732ae
rol eax, 0xf1
popf
pushf
not eax
add eax, 0xcf69ae40
xor eax, 0xa16fe04d
rol eax, 0x4f
popf
jmp 0x14009b074
push rax
pushf
mov eax, 0x668abe38
pushf
not eax
add eax, 0xa473c5e8
xor eax, 0xa5bef328
rol eax, 0x3c
popf
pushf
not eax
add eax, 0xfdcd4674
xor eax, 0x8447b72b
rol eax, 0x75
popf
jmp 0x14009b074
nop word [rax + rax]
push rax
pushf
mov eax, 0x59cc9a5f
pushf
not eax
add eax, 0xb5463ee3
xor eax, 0xe55dd810
rol eax, 0x26
popf
pushf
not eax
add eax, 0xf81bcf5f
xor eax, 0xb88d7daf
rol eax, 5
popf
pushf
not eax
add eax, 0xfb27233f
xor eax, 0x85b2ba97
rol eax, 0xae
popf
pushf
not eax
add eax, 0x99f6566c
xor eax, 0xf58a6c14
rol eax, 0x50
popf
jmp 0x14009b074
cmp dword [rsp + 0x20], 0x10
jb 0x14009b3f0
push rax
pushf
mov eax, 0xbac1c72e
pushf
not eax
add eax, 0x95cff067
xor eax, 0xf9d0360e
rol eax, 0x4d
popf
pushf
not eax
add eax, 0x8ae49058
xor eax, 0xc6edcbfc
rol eax, 0xee
popf
jmp 0x14009b074
push rax
pushf
mov eax, 0xcb218b88
pushf
not eax
add eax, 0xf0a74884
xor eax, 0xa5e87429
rol eax, 0x23
popf
pushf
not eax
add eax, 0xc9d08d9c
xor eax, 0xc60a4707
rol eax, 0x6d
popf
jmp 0x14009b074
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x14009b489
push rax
pushf
mov eax, 0xba727f6d
pushf
not eax
add eax, 0x8ab08471
xor eax, 0x9dbff36a
rol eax, 0x63
popf
pushf
not eax
add eax, 0xe11705ff
xor eax, 0xa4e82652
rol eax, 0x8f
popf
pushf
not eax
add eax, 0x9b610625
xor eax, 0xda383495
rol eax, 0
popf
pushf
not eax
add eax, 0xd0a46d90
xor eax, 0x95ce63d7
rol eax, 0xb3
popf
jmp 0x14009b074
push rax
pushf
mov eax, 0xd2b629d4
pushf
not eax
add eax, 0xb4d56835
xor eax, 0xbda48d26
rol eax, 0
popf
pushf
not eax
add eax, 0xa6579e23
xor eax, 0x8b855f5a
rol eax, 0x55
popf
pushf
not eax
add eax, 0x8130062d
xor eax, 0xca566256
rol eax, 0xc7
popf
jmp 0x14009b074
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x14009b535
push rax
pushf
mov eax, 0x566bd274
pushf
not eax
add eax, 0xf26453fb
xor eax, 0xa6e70913
rol eax, 0xe4
popf
pushf
not eax
add eax, 0x9ed46d2c
xor eax, 0xace1e10c
rol eax, 0x72
popf
pushf
not eax
add eax, 0xe71f3a78
xor eax, 0xc84be866
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xcb67f811
xor eax, 0xa8f7edd3
rol eax, 0x53
popf
jmp 0x14009b074
push rax
pushf
mov eax, 0x831951d1
pushf
not eax
add eax, 0x9f62e8e3
xor eax, 0xbc2c4fa2
rol eax, 0xdc
popf
pushf
not eax
add eax, 0xdbef00da
xor eax, 0xbe53bc5e
rol eax, 0xd1
popf
pushf
not eax
add eax, 0xfa0047fc
xor eax, 0xd24c722a
rol eax, 0xc8
popf
pushf
not eax
add eax, 0xa5044568
xor eax, 0xf88998fe
rol eax, 0xf8
popf
jmp 0x14009b074
mov rdx, qword [rbx]
test rdx, rdx
jne 0x14009b5dc
push rax
pushf
mov eax, 0xee4a7280
pushf
not eax
add eax, 0xb34a0344
xor eax, 0xaa14cfc1
rol eax, 0xaa
popf
pushf
not eax
add eax, 0xeb15410f
xor eax, 0xbb2164ea
rol eax, 0xfd
popf
pushf
not eax
add eax, 0xd60cdb35
xor eax, 0xa529d0bd
rol eax, 0x8e
popf
jmp 0x14009b074
push rax
pushf
mov eax, 0x9b46a78f
pushf
not eax
add eax, 0xc04466d9
xor eax, 0xe174a42f
rol eax, 0x32
popf
pushf
not eax
add eax, 0xcc7958d4
xor eax, 0xbf654277
rol eax, 0xd5
popf
pushf
not eax
add eax, 0xe3176681
xor eax, 0xc7fb2e00
rol eax, 0x9b
popf
jmp 0x14009b074
mov dword [rbx + 8], 0x80
mov r8d, 0x36b24cca
pushf
not r8d
add r8d, 0xe8be62da
xor r8d, 0xc019c384
rol r8d, 0x3a
popf
pushf
not r8d
add r8d, 0xa344a0da
xor r8d, 0xbf9d2322
rol r8d, 9
popf
pushf
not r8d
add r8d, 0xaffed98d
xor r8d, 0xed2995f6
rol r8d, 0x89
popf
mov rcx, qword [0x140013388]
jmp 0x14009b682
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x14009b6ec
push rax
pushf
mov eax, 0xf46900f1
pushf
not eax
add eax, 0x8a4aa511
xor eax, 0xee842740
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xfb555f52
xor eax, 0xc5b3fa65
rol eax, 0xca
popf
pushf
not eax
add eax, 0xa6af24d3
xor eax, 0xf6ed84ef
rol eax, 0xee
popf
pushf
not eax
add eax, 0xdb106657
xor eax, 0xe00f64d1
rol eax, 0x43
popf
jmp 0x14009b074
push rax
pushf
mov eax, 0x4873553
pushf
not eax
add eax, 0x9a3fa6a7
xor eax, 0xc751ee27
rol eax, 0x2c
popf
pushf
not eax
add eax, 0xef3ded35
xor eax, 0xd70bc13b
rol eax, 0xb5
popf
pushf
not eax
add eax, 0xc8148096
xor eax, 0xcc706a67
rol eax, 0x14
popf
pushf
not eax
add eax, 0xbb07ab4d
xor eax, 0xf210ea77
rol eax, 0x9d
popf
jmp 0x14009b074
jmp 0x14009b8fe
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x14009b7f1
push rax
pushf
mov eax, 0xa1354f3d
pushf
not eax
add eax, 0x9f3788e7
xor eax, 0xd8c14da2
rol eax, 0xfa
popf
pushf
not eax
add eax, 0x862668dd
xor eax, 0xda903e2b
rol eax, 0xd1
popf
pushf
not eax
add eax, 0xa92757ae
xor eax, 0x9ed85176
rol eax, 0x23
popf
jmp 0x14009b074
push rax
pushf
mov eax, 0x6a774d16
pushf
not eax
add eax, 0x96ee4de6
xor eax, 0xdf61ec5c
rol eax, 0xf0
popf
pushf
not eax
add eax, 0xb9b047dd
xor eax, 0xd51c54c6
rol eax, 0xc7
popf
jmp 0x14009b074
mov rcx, qword [0x140013388]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
jmp 0x14009b839
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x14009b88d
push rax
pushf
mov eax, 0x67bfcdbe
pushf
not eax
add eax, 0x89869e93
xor eax, 0xac575cd4
rol eax, 0x17
popf
pushf
not eax
add eax, 0xe9f760d6
xor eax, 0xb50336d1
rol eax, 0xe9
popf
pushf
not eax
add eax, 0xfb4fef37
xor eax, 0x93f237fd
rol eax, 0x19
popf
jmp 0x14009b074
push rax
pushf
mov eax, 0x8491464a
pushf
not eax
add eax, 0xcb6d7046
xor eax, 0xbe5034ca
rol eax, 0x60
popf
pushf
not eax
add eax, 0xe2b7ec19
xor eax, 0xebebcee7
rol eax, 0xab
popf
jmp 0x14009b074
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
push rax
pushf
mov eax, 0xe6e8ce60
pushf
not eax
add eax, 0xf75e4ef3
xor eax, 0x9089a3dc
rol eax, 0x33
popf
pushf
not eax
add eax, 0xd9536fb1
xor eax, 0xbebf67cf
rol eax, 0x4d
popf
jmp 0x14009b074
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
jmp 0x14009b909
inc dword [rbx + 0xc]
push rax
pushf
mov eax, 0xafa13131
pushf
not eax
add eax, 0x9e448478
xor eax, 0xea8b505d
rol eax, 0x3a
popf
pushf
not eax
add eax, 0xeb0480a6
xor eax, 0x82335a8e
rol eax, 0xbc
popf
pushf
not eax
add eax, 0xbe3e77d6
xor eax, 0xc9b974ca
rol eax, 0xfc
popf
pushf
not eax
add eax, 0x9672aaba
xor eax, 0xa6f5f42a
rol eax, 0x18
popf
jmp 0x14009b074
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x14009b9db
push rax
pushf
mov eax, 0x2dd4d68b
pushf
not eax
add eax, 0x9b6409d9
xor eax, 0x984ea49c
rol eax, 0x73
popf
pushf
not eax
add eax, 0x80ee1193
xor eax, 0xa26803c1
rol eax, 0x52
popf
pushf
not eax
add eax, 0xc188deeb
xor eax, 0xf66095bd
rol eax, 0x58
popf
pushf
not eax
add eax, 0x83016d67
xor eax, 0xd64b669b
rol eax, 0x19
popf
jmp 0x14009b074
push rax
pushf
mov eax, 0xd7fb53db
pushf
not eax
add eax, 0xd2da9386
xor eax, 0x95b3b58e
rol eax, 0xe5
popf
pushf
not eax
add eax, 0x86227edc
xor eax, 0xcf6ffca6
rol eax, 0xa5
popf
pushf
not eax
add eax, 0xc5f3213b
xor eax, 0x8bc537ae
rol eax, 0xf
popf
pushf
not eax
add eax, 0x81c6d05d
xor eax, 0xc7f6296d
rol eax, 0x91
popf
jmp 0x14009b074
mov rcx, rdi
jmp 0x14009ba38
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0x268743de
pushf
not eax
add eax, 0xf70e1f72
xor eax, 0xe12bd9d2
rol eax, 0x53
popf
pushf
not eax
add eax, 0xf4d69ac2
xor eax, 0xf2d05edf
rol eax, 0x73
popf
pushf
not eax
add eax, 0xf93fca36
xor eax, 0xbd0f494a
rol eax, 0x83
popf
jmp 0x14009b074
cmp qword [rbx], rsi
je 0x14009bacf
push rax
pushf
mov eax, 0x36e30163
pushf
not eax
add eax, 0xb55f5a0d
xor eax, 0xcc2b5d1d
rol eax, 0xe1
popf
pushf
not eax
add eax, 0xe71df63b
xor eax, 0xdac6e8a9
rol eax, 0x52
popf
pushf
not eax
add eax, 0xfe48e04f
xor eax, 0xf4277daa
rol eax, 0x6e
popf
jmp 0x14009b074
push rax
pushf
mov eax, 0x2e374b27
pushf
not eax
add eax, 0xcdf8b248
xor eax, 0xfe3a2818
rol eax, 0x21
popf
pushf
not eax
add eax, 0xadc1c694
xor eax, 0xfccb2823
rol eax, 0x88
popf
jmp 0x14009b074
cmp dword [rbx + 0xc], esi
jbe 0x14009bb4d
push rax
pushf
mov eax, 0x6c813aa8
pushf
not eax
add eax, 0xf984b8d6
xor eax, 0x814f1bcb
rol eax, 0xfa
popf
pushf
not eax
add eax, 0xb88bc060
xor eax, 0xd926895e
rol eax, 0x32
popf
pushf
not eax
add eax, 0xd083b3c6
xor eax, 0xb2afcdd5
rol eax, 0x4d
popf
jmp 0x14009b074
push rax
pushf
mov eax, 0xeba91c2
pushf
not eax
add eax, 0x94cf95cc
xor eax, 0xe5fd5f15
rol eax, 0xdb
popf
pushf
not eax
add eax, 0xa5b70415
xor eax, 0xcb7e2339
rol eax, 0x32
popf
pushf
not eax
add eax, 0xc03d0e26
xor eax, 0xf1915100
rol eax, 0x26
popf
pushf
not eax
add eax, 0xf527490a
xor eax, 0x87e96957
rol eax, 0xc
popf
jmp 0x14009b074
nop dword [rax]
nop dword [rax + rax]
push rax
pushf
mov eax, 0x5f1656
pushf
not eax
add eax, 0x80391fa7
xor eax, 0xcea2b9df
rol eax, 0xe8
popf
pushf
not eax
add eax, 0x90da2d5e
xor eax, 0xae915b53
rol eax, 0xaa
popf
pushf
not eax
add eax, 0xc3dedf66
xor eax, 0xe0c2e0c3
rol eax, 0x3e
popf
jmp 0x14009b074
mov r8, qword [rbx]
xor edx, edx
mov eax, esi
lea ecx, [rdx + 0x5a]
mov r8d, dword [r8 + rax*4]
jmp 0x14009bc07
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x14009bc6e
push rax
pushf
mov eax, 0xf526338
pushf
not eax
add eax, 0xd1b81d6f
xor eax, 0xce1bfefc
rol eax, 0x15
popf
pushf
not eax
add eax, 0x8270a3f5
xor eax, 0xafc67181
rol eax, 0xa4
popf
pushf
not eax
add eax, 0xcc8f117e
xor eax, 0xb26afc8c
rol eax, 0x95
popf
pushf
not eax
add eax, 0xedaf7e47
xor eax, 0xa8f18acd
rol eax, 0xbc
popf
jmp 0x14009b074
push rax
pushf
mov eax, 0xb5c8be57
pushf
not eax
add eax, 0x8b372e22
xor eax, 0xd051752b
rol eax, 0x80
popf
pushf
not eax
add eax, 0xd1f961d8
xor eax, 0x8a989bd2
rol eax, 0xde
popf
pushf
not eax
add eax, 0xbfb6bd39
xor eax, 0xf67ecb2c
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xea6f2dbf
xor eax, 0xb43e57aa
rol eax, 0x8b
popf
jmp 0x14009b074
mov rcx, rax
jmp 0x14009bccb
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.14008434e
mov rcx, rdi
jmp 0x14009bce3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14009bcea
inc esi
cmp esi, dword [rbx + 0xc]
jb 0x14009bd37
push rax
pushf
mov eax, 0x55061b90
pushf
not eax
add eax, 0xc1bb7e4e
xor eax, 0xd992a295
rol eax, 0x6d
popf
pushf
not eax
add eax, 0xdc0f2fcd
xor eax, 0x829ebfed
rol eax, 0xe6
popf
pushf
not eax
add eax, 0x9a9771c4
xor eax, 0xf56f606a
rol eax, 0xb3
popf
jmp 0x14009b074
push rax
pushf
mov eax, 0xc8f33dd8
pushf
not eax
add eax, 0xa94155cc
xor eax, 0x9b033124
rol eax, 0x93
popf
pushf
not eax
add eax, 0xc7f8416f
xor eax, 0xbad41fcc
rol eax, 0x18
popf
pushf
not eax
add eax, 0xe2c440c9
xor eax, 0xcaedeb92
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xe0d42cf7
xor eax, 0x8665743e
rol eax, 0xdb
popf
jmp 0x14009b074
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14007ea5e
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret