Function at 0x18001bade
Capabilities:
Resume thread

Disassembly:
push rax
pushf
mov eax, 0x835f09c4
pushf
not eax
add eax, 0xc91e8123
xor eax, 0x934004e9
rol eax, 0xe
popf
pushf
not eax
add eax, 0xaa7aa54c
xor eax, 0xed41cc8c
rol eax, 0x8d
popf
pushf
not eax
add eax, 0xa49f4cfc
xor eax, 0xba09880e
rol eax, 0x4c
popf
pushf
not eax
add eax, 0xfb40c7b8
xor eax, 0x8f320394
rol eax, 0x7a
popf
cmp eax, 4
jne 0x18001bb41
popf
pop rax
jmp 0x18001be7f
cmp eax, 0
jne 0x18001bb50
popf
pop rax
jmp 0x18001bca9
cmp eax, 3
jne 0x18001bb5f
popf
pop rax
jmp 0x18001be36
cmp eax, 1
jne 0x18001bb6e
popf
pop rax
jmp 0x18001bd80
cmp eax, 0xd
jne 0x18001bb7d
popf
pop rax
jmp 0x18001c27c
cmp eax, 7
jne 0x18001bb8c
popf
pop rax
jmp 0x18001bf97
cmp eax, 0xe
jne 0x18001bb9b
popf
pop rax
jmp 0x18001c30d
cmp eax, 0xb
jne 0x18001bbaa
popf
pop rax
jmp 0x18001c16a
cmp eax, 0xc
jne 0x18001bbb9
popf
pop rax
jmp 0x18001c1da
cmp eax, 8
jne 0x18001bbc8
popf
pop rax
jmp 0x18001bffc
cmp eax, 0x10
jne 0x18001bbd7
popf
pop rax
jmp 0x18001c454
cmp eax, 0x17
jne 0x18001bbe6
popf
pop rax
jmp 0x18001c7a8
cmp eax, 9
jne 0x18001bbf5
popf
pop rax
jmp 0x18001c095
cmp eax, 0x12
jne 0x18001bc04
popf
pop rax
jmp 0x18001c526
cmp eax, 0x18
jne 0x18001bc13
popf
pop rax
jmp 0x18001c834
cmp eax, 0x11
jne 0x18001bc22
popf
pop rax
jmp 0x18001c4e8
cmp eax, 5
jne 0x18001bc31
popf
pop rax
jmp 0x18001bf0c
cmp eax, 0x16
jne 0x18001bc40
popf
pop rax
jmp 0x18001c719
cmp eax, 0xa
jne 0x18001bc4f
popf
pop rax
jmp 0x18001c0d8
cmp eax, 0x14
jne 0x18001bc5e
popf
pop rax
jmp 0x18001c5ea
cmp eax, 0xf
jne 0x18001bc6d
popf
pop rax
jmp 0x18001c3a7
cmp eax, 0x13
jne 0x18001bc7c
popf
pop rax
jmp 0x18001c5a3
cmp eax, 0x15
jne 0x18001bc8b
popf
pop rax
jmp 0x18001c6a6
cmp eax, 2
jne 0x18001bc9a
popf
pop rax
jmp 0x18001bdff
cmp eax, 6
jne 0x18001bca9
popf
pop rax
jmp 0x18001bf92
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov rdi, rcx
mov ebx, r15d
xor eax, eax
mov esi, 0x8a862cc7
pushf
not esi
add esi, 0x877d2bc5
xor esi, 0x83b90e43
rol esi, 0x6d
popf
pushf
not esi
add esi, 0xfecc4d1f
xor esi, 0x80b47d35
rol esi, 0x61
popf
lock cmpxchg dword [0x18000a9c0], esi
je 0x18001bd3a
push rax
pushf
mov eax, 0xa4427e4a
pushf
not eax
add eax, 0x93e1232c
xor eax, 0x854180bf
rol eax, 0xf0
popf
pushf
not eax
add eax, 0xf3969b14
xor eax, 0xcf383035
rol eax, 0x80
popf
jmp 0x18001bb32
push rax
pushf
mov eax, 0x5a629821
pushf
not eax
add eax, 0xeb7ae0a8
xor eax, 0xdd90081e
rol eax, 0xb4
popf
pushf
not eax
add eax, 0xf7807b0b
xor eax, 0x9386f6f5
rol eax, 0xc4
popf
pushf
not eax
add eax, 0xde60d341
xor eax, 0xfc8c8c09
rol eax, 0x87
popf
jmp 0x18001bb32
cmp rbx, 0x20
jae 0x18001bdb9
push rax
pushf
mov eax, 0x24924e72
pushf
not eax
add eax, 0xa86923a9
xor eax, 0xea270df9
rol eax, 0x35
popf
pushf
not eax
add eax, 0xd19e9fc8
xor eax, 0xf7b1618c
rol eax, 0x23
popf
jmp 0x18001bb32
push rax
pushf
mov eax, 0x20a0c67a
pushf
not eax
add eax, 0xefeeb118
xor eax, 0xc576468e
rol eax, 0xc5
popf
pushf
not eax
add eax, 0xa5e2f1ef
xor eax, 0x80a8a622
rol eax, 0x68
popf
pushf
not eax
add eax, 0x95b90880
xor eax, 0xcfeed8a1
rol eax, 0xf1
popf
jmp 0x18001bb32
xor ecx, ecx
jmp 0x18001be7f
mov ecx, esi
push rax
pushf
mov eax, 0xd4cad9d6
pushf
not eax
add eax, 0xbbae1a94
xor eax, 0x98e74fae
rol eax, 0xd2
popf
pushf
not eax
add eax, 0x99cd5b59
xor eax, 0xca10730f
rol eax, 0x94
popf
pushf
not eax
add eax, 0xc6fe1e60
xor eax, 0xc284a36e
rol eax, 0xb8
popf
jmp 0x18001bb32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x18000a9c0], esi
jne 0x18001beda
push rax
pushf
mov eax, 0xfbfa9c4f
pushf
not eax
add eax, 0xbdadb5f6
xor eax, 0xf2f68e6d
rol eax, 3
popf
pushf
not eax
add eax, 0xfd272fe2
xor eax, 0xb4d0f8d9
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xf9c1c8fc
xor eax, 0xa57738ca
rol eax, 0x19
popf
jmp 0x18001bb32
push rax
pushf
mov eax, 0xbb629059
pushf
not eax
add eax, 0xf24d078e
xor eax, 0x852b5ec4
rol eax, 1
popf
pushf
not eax
add eax, 0x83f46db6
xor eax, 0x9c7219d4
rol eax, 0x41
popf
jmp 0x18001bb32
cmp qword [0x18000a9c8], r15
je 0x18001bf5f
push rax
pushf
mov eax, 0x30904d27
pushf
not eax
add eax, 0xc45fe8e2
xor eax, 0xe36ad014
rol eax, 0x34
popf
pushf
not eax
add eax, 0x80ec10d7
xor eax, 0xdc26ad5b
rol eax, 0xc8
popf
pushf
not eax
add eax, 0xecfcc5d9
xor eax, 0xc550ecbe
rol eax, 0xe7
popf
jmp 0x18001bb32
push rax
pushf
mov eax, 0xec48725e
pushf
not eax
add eax, 0xf224a512
xor eax, 0xec0d47b1
rol eax, 7
popf
pushf
not eax
add eax, 0xdcd43dc8
xor eax, 0xf40ebc53
rol eax, 0xd0
popf
jmp 0x18001bb32
test rdi, rdi
jne 0x18001bffc
call fcn.18001e078
mov ebp, eax
jmp 0x18001c834
mov ecx, dword [0x18000aa3c]
mov ebx, r15d
test ecx, ecx
je 0x18001c04f
push rax
pushf
mov eax, 0xfd33bbea
pushf
not eax
add eax, 0xf473884a
xor eax, 0xc646d5e6
rol eax, 0xe3
popf
pushf
not eax
add eax, 0x99618d31
xor eax, 0xba0f93c9
rol eax, 0x54
popf
pushf
not eax
add eax, 0x9047a0e8
xor eax, 0x8d5c2775
rol eax, 0xa5
popf
jmp 0x18001bb32
push rax
pushf
mov eax, 0xcbb19711
pushf
not eax
add eax, 0xd94e35c5
xor eax, 0xaeceff0e
rol eax, 0x3e
popf
pushf
not eax
add eax, 0xab72c495
xor eax, 0xb8655199
rol eax, 0xeb
popf
pushf
not eax
add eax, 0xd01262ae
xor eax, 0xf4247ad5
rol eax, 0x82
popf
jmp 0x18001bb32
mov rdx, qword [0x18000aa30]
mov rax, rdx
nop word [rax + rax]
push rax
pushf
mov eax, 0x3c22d25c
pushf
not eax
add eax, 0x93ce3d67
xor eax, 0xb4c37c13
rol eax, 0xd2
popf
pushf
not eax
add eax, 0xe639ec8c
xor eax, 0xa1d25eeb
rol eax, 0xe6
popf
jmp 0x18001bb32
cmp rdi, qword [rax]
je 0x18001c136
push rax
pushf
mov eax, 0x779cc650
pushf
not eax
add eax, 0xe246edcf
xor eax, 0xc896dbd0
rol eax, 0x40
popf
pushf
not eax
add eax, 0x9031b7e7
xor eax, 0xc91a2a52
rol eax, 0xa9
popf
pushf
not eax
add eax, 0x9a9d47d2
xor eax, 0xe1b83b88
rol eax, 6
popf
pushf
not eax
add eax, 0xd78129fd
xor eax, 0xa6ef2955
rol eax, 0x5c
popf
jmp 0x18001bb32
push rax
pushf
mov eax, 0xbe97e224
pushf
not eax
add eax, 0xeb44797a
xor eax, 0xd739a7df
rol eax, 0x9e
popf
pushf
not eax
add eax, 0x9fd024cf
xor eax, 0xe0f0d8ac
rol eax, 0xef
popf
jmp 0x18001bb32
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x18001c1a7
push rax
pushf
mov eax, 0x5b02ef0f
pushf
not eax
add eax, 0xa2a9cf68
xor eax, 0xa28b66e4
rol eax, 0x3a
popf
pushf
not eax
add eax, 0xbc47e421
xor eax, 0xc8bf2e06
rol eax, 0x50
popf
jmp 0x18001bb32
push rax
pushf
mov eax, 0x4fa3f92d
pushf
not eax
add eax, 0x88884d15
xor eax, 0x85e68a5c
rol eax, 0x74
popf
pushf
not eax
add eax, 0x9348a008
xor eax, 0xf78ccada
rol eax, 0x79
popf
jmp 0x18001bb32
mov ebp, 0xd4f79516
pushf
not ebp
add ebp, 0xd782b466
xor ebp, 0xd39cf808
rol ebp, 0xe0
popf
pushf
not ebp
add ebp, 0xe890558f
xor ebp, 0x9179c4a7
rol ebp, 0xa7
popf
pushf
not ebp
add ebp, 0xae805bcf
xor ebp, 0xadaa6b8b
rol ebp, 0x53
popf
jmp 0x18001c834
cmp ebx, 0xffffffff
je 0x18001c2da
push rax
pushf
mov eax, 0x62835257
pushf
not eax
add eax, 0xcd0911a3
xor eax, 0x8ac8d0cf
rol eax, 0x7b
popf
pushf
not eax
add eax, 0x9f3526c6
xor eax, 0xae9af88f
rol eax, 0x37
popf
pushf
not eax
add eax, 0xb47d0af3
xor eax, 0x812b7c3e
rol eax, 0x8e
popf
pushf
not eax
add eax, 0xaf771721
xor eax, 0xf2bb4312
rol eax, 0x28
popf
jmp 0x18001bb32
push rax
pushf
mov eax, 0x7c6a72ab
pushf
not eax
add eax, 0xf1e04bb4
xor eax, 0x8b0b9c15
rol eax, 0x2d
popf
pushf
not eax
add eax, 0x9eff3dc1
xor eax, 0xce5b7df1
rol eax, 0x87
popf
jmp 0x18001bb32
mov eax, ebx
imul r8, rax, 0x38
test byte [r8 + rdx + 0x20], 2
jne 0x18001c374
push rax
pushf
mov eax, 0xf5351a76
pushf
not eax
add eax, 0xc0b00cd2
xor eax, 0xcadbf734
rol eax, 0x6b
popf
pushf
not eax
add eax, 0x8fa880b8
xor eax, 0xfe76223a
rol eax, 0x94
popf
pushf
not eax
add eax, 0xe35eb081
xor eax, 0xe2556644
rol eax, 0xed
popf
pushf
not eax
add eax, 0xd753e270
xor eax, 0x89c2876f
rol eax, 0x4b
popf
jmp 0x18001bb32
push rax
pushf
mov eax, 0x7f361aab
pushf
not eax
add eax, 0xf9c6510c
xor eax, 0xbfcbc220
rol eax, 0x43
popf
pushf
not eax
add eax, 0xcaf2233a
xor eax, 0xa0129733
rol eax, 0x38
popf
jmp 0x18001bb32
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.18002d15c
mov edx, esi
mov ecx, ebx
call fcn.1800282fc
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x18001c3fb
push rax
pushf
mov eax, 0xf642a79d
pushf
not eax
add eax, 0xa568e99a
xor eax, 0x9f16cd53
rol eax, 0x40
popf
pushf
not eax
add eax, 0xf934b943
xor eax, 0xc9002c93
rol eax, 0xf2
popf
jmp 0x18001bb32
push rax
pushf
mov eax, 0xbbdcea6e
pushf
not eax
add eax, 0xd814d095
xor eax, 0xd1641a85
rol eax, 0x8b
popf
pushf
not eax
add eax, 0xed54f6b6
xor eax, 0x9a835b04
rol eax, 0xef
popf
pushf
not eax
add eax, 0xde034831
xor eax, 0xae167203
rol eax, 0xac
popf
pushf
not eax
add eax, 0xc63f7b7e
xor eax, 0xf357e859
rol eax, 0x11
popf
jmp 0x18001bb32
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18001c4a2
push rax
pushf
mov eax, 0xf3a41fc0
pushf
not eax
add eax, 0xd153a7b6
xor eax, 0xf4b36bbc
rol eax, 0x10
popf
pushf
not eax
add eax, 0xf4549dc7
xor eax, 0xae6e190e
rol eax, 0x38
popf
pushf
not eax
add eax, 0x9f11955c
xor eax, 0xfa6b0dee
rol eax, 0x37
popf
jmp 0x18001bb32
push rax
pushf
mov eax, 0x66d243dd
pushf
not eax
add eax, 0xea554d3d
xor eax, 0x8785ce51
rol eax, 0xef
popf
pushf
not eax
add eax, 0xd73791e8
xor eax, 0xc0f3ae32
rol eax, 0x3d
popf
pushf
not eax
add eax, 0x9cb8c38a
xor eax, 0xc67a5f4f
rol eax, 0x8f
popf
jmp 0x18001bb32
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop dword [rax]
push rax
pushf
mov eax, 0x54cb4593
pushf
not eax
add eax, 0xc5b4ff47
xor eax, 0x8363cf63
rol eax, 0x40
popf
pushf
not eax
add eax, 0x8627cf1d
xor eax, 0x929d585e
rol eax, 0x20
popf
jmp 0x18001bb32
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
jmp 0x18001c52f
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18001c570
push rax
pushf
mov eax, 0xf4b5b16a
pushf
not eax
add eax, 0xe9c0adce
xor eax, 0xfecab0a6
rol eax, 0x82
popf
pushf
not eax
add eax, 0xcd195bcc
xor eax, 0x9e182c77
rol eax, 0xfa
popf
jmp 0x18001bb32
push rax
pushf
mov eax, 0x151b5b78
pushf
not eax
add eax, 0xbdf3b323
xor eax, 0xd89de577
rol eax, 0x9b
popf
pushf
not eax
add eax, 0xa3e43553
xor eax, 0xb8620794
rol eax, 0xbf
popf
jmp 0x18001bb32
mov rcx, rax
jmp 0x18001c5a7
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
jmp 0x18001c5b1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0x37439ac4
pushf
not eax
add eax, 0xe1191b18
xor eax, 0xb734d859
rol eax, 0x65
popf
pushf
not eax
add eax, 0x97fad412
xor eax, 0xebcfd2ce
rol eax, 0xc6
popf
jmp 0x18001bb32
add rbx, 4
sub rsi, 1
jne 0x18001c64d
push rax
pushf
mov eax, 0x86b96bac
pushf
not eax
add eax, 0xae7793c8
xor eax, 0xbeca528d
rol eax, 0xb5
popf
pushf
not eax
add eax, 0xeb05b3be
xor eax, 0xbc7cce49
rol eax, 0xfc
popf
pushf
not eax
add eax, 0x91b1c0f7
xor eax, 0xa59f85a0
rol eax, 0xf9
popf
pushf
not eax
add eax, 0xa12845b8
xor eax, 0xdfb25fac
rol eax, 0xbd
popf
jmp 0x18001bb32
push rax
pushf
mov eax, 0xbb5404c0
pushf
not eax
add eax, 0xad3a857e
xor eax, 0x9666515c
rol eax, 0x2f
popf
pushf
not eax
add eax, 0xa0b1a3ea
xor eax, 0xa94ebe16
rol eax, 0x7a
popf
pushf
not eax
add eax, 0x856f978d
xor eax, 0xbcc3deab
rol eax, 0x33
popf
pushf
not eax
add eax, 0x8f0ca456
xor eax, 0x8712d381
rol eax, 0x5c
popf
jmp 0x18001bb32
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x18000a9c8]
jmp 0x18001c6b5
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18001c834
mov ebp, 0x57089af1
pushf
not ebp
add ebp, 0xc1df7620
xor ebp, 0xd792defb
rol ebp, 0x51
popf
pushf
not ebp
add ebp, 0x951c42b7
xor ebp, 0x824fb074
rol ebp, 0x4a
popf
pushf
not ebp
add ebp, 0xdda7f2b8
xor ebp, 0xdfc68a81
rol ebp, 0x9f
popf
jmp 0x18001c834
mov ebp, 0xa31bcf69
pushf
not ebp
add ebp, 0xd35930fb
xor ebp, 0xa72404fb
rol ebp, 0x72
popf
pushf
not ebp
add ebp, 0x91eaa051
xor ebp, 0xcc36fb0c
rol ebp, 0x34
popf
pushf
not ebp
add ebp, 0xc3a91b27
xor ebp, 0xe705493e
rol ebp, 0x99
popf
pushf
not ebp
add ebp, 0xc96e9857
xor ebp, 0xbfca31a1
rol ebp, 0xa8
popf
push rax
pushf
mov eax, 0xcea057f2
pushf
not eax
add eax, 0xf1c7b2b2
xor eax, 0xe24917a2
rol eax, 0x74
popf
pushf
not eax
add eax, 0xd0a51af0
xor eax, 0xfec9046b
rol eax, 0x3e
popf
jmp 0x18001bb32
xchg dword [0x18000a9c0], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret