Function at 0x1800ebf64
Capabilities:
Resume thread

Disassembly:
push rax
pushf
mov eax, 0xbaefa191
pushf
not eax
add eax, 0xd61ddf72
xor eax, 0xf95336cb
rol eax, 0x2c
popf
pushf
not eax
add eax, 0xd4e7d257
xor eax, 0xe8905222
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xa0f18595
xor eax, 0xb44c3f87
rol eax, 0x96
popf
cmp eax, 4
jne 0x1800ebfb4
popf
pop rax
jmp 0x1800ec324
cmp eax, 0
jne 0x1800ebfc3
popf
pop rax
jmp 0x1800ec0e0
cmp eax, 3
jne 0x1800ebfd2
popf
pop rax
jmp 0x1800ec2a1
cmp eax, 1
jne 0x1800ebfe1
popf
pop rax
jmp 0x1800ec18f
cmp eax, 0xd
jne 0x1800ebff0
popf
pop rax
jmp 0x1800ec7e2
cmp eax, 7
jne 0x1800ebfff
popf
pop rax
jmp 0x1800ec4ed
cmp eax, 0xe
jne 0x1800ec00e
popf
pop rax
jmp 0x1800ec850
cmp eax, 0xb
jne 0x1800ec01d
popf
pop rax
jmp 0x1800ec6e1
cmp eax, 0xc
jne 0x1800ec02c
popf
pop rax
jmp 0x1800ec74e
cmp eax, 8
jne 0x1800ec03b
popf
pop rax
jmp 0x1800ec551
cmp eax, 0x10
jne 0x1800ec04a
popf
pop rax
jmp 0x1800ec8c5
cmp eax, 2
jne 0x1800ec059
popf
pop rax
jmp 0x1800ec1f5
cmp eax, 9
jne 0x1800ec068
popf
pop rax
jmp 0x1800ec5e5
cmp eax, 0x12
jne 0x1800ec077
popf
pop rax
jmp 0x1800ec9b5
cmp eax, 6
jne 0x1800ec086
popf
pop rax
jmp 0x1800ec3fe
cmp eax, 0x11
jne 0x1800ec095
popf
pop rax
jmp 0x1800ec91f
cmp eax, 5
jne 0x1800ec0a4
popf
pop rax
jmp 0x1800ec37c
cmp eax, 0x13
jne 0x1800ec0b3
popf
pop rax
jmp 0x1800eca00
cmp eax, 0xa
jne 0x1800ec0c2
popf
pop rax
jmp 0x1800ec693
cmp eax, 0x14
jne 0x1800ec0d1
popf
pop rax
jmp 0x1800eca5b
cmp eax, 0xf
jne 0x1800ec0e0
popf
pop rax
jmp 0x1800ec8ae
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, ecx
mov ecx, dword [0x180042e3c]
mov ebx, edi
test ecx, ecx
je 0x1800ec149
push rax
pushf
mov eax, 0xf45996d8
pushf
not eax
add eax, 0xc91da143
xor eax, 0xdbfbdc4e
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xdc10e30c
xor eax, 0xaa7e2ec8
rol eax, 0x6e
popf
pushf
not eax
add eax, 0xcd254264
xor eax, 0xe3b87508
rol eax, 0x2a
popf
jmp 0x1800ebfa5
push rax
pushf
mov eax, 0xf410630
pushf
not eax
add eax, 0xf6e7f923
xor eax, 0xb9987e61
rol eax, 0xc1
popf
pushf
not eax
add eax, 0x8216977d
xor eax, 0xc1138220
rol eax, 0xa6
popf
pushf
not eax
add eax, 0xd400e211
xor eax, 0xb1e1c48f
rol eax, 0x6d
popf
jmp 0x1800ebfa5
mov rax, qword [0x180042e30]
add rax, 0x20
nop
push rax
pushf
mov eax, 0xb92bfac8
pushf
not eax
add eax, 0x954bde7f
xor eax, 0xd5aebe49
rol eax, 0x4c
popf
pushf
not eax
add eax, 0x9b1261a9
xor eax, 0xb9ca3036
rol eax, 0xa4
popf
pushf
not eax
add eax, 0xd85302f3
xor eax, 0x9a66d0ba
rol eax, 0xcc
popf
pushf
not eax
add eax, 0x9e2ea052
xor eax, 0x9a364727
rol eax, 0xe2
popf
jmp 0x1800ebfa5
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x1800ec247
push rax
pushf
mov eax, 0x6c2fb39d
pushf
not eax
add eax, 0xff0bb6c3
xor eax, 0xdc90fbce
rol eax, 0x52
popf
pushf
not eax
add eax, 0xe390f79a
xor eax, 0xc01f599a
rol eax, 0x47
popf
pushf
not eax
add eax, 0x917f94d7
xor eax, 0x928b96b7
rol eax, 0xc9
popf
jmp 0x1800ebfa5
push rax
pushf
mov eax, 0xcf095172
pushf
not eax
add eax, 0xf8efe382
xor eax, 0xf217a95d
rol eax, 0xae
popf
pushf
not eax
add eax, 0xf1257fde
xor eax, 0x8bb7d9e8
rol eax, 0xdb
popf
pushf
not eax
add eax, 0xa94c1192
xor eax, 0x827bfd17
rol eax, 0xd3
popf
pushf
not eax
add eax, 0xaaff8326
xor eax, 0x8a0896e9
rol eax, 0xe0
popf
jmp 0x1800ebfa5
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x1800ec2f1
push rax
pushf
mov eax, 0x75c8ffb4
pushf
not eax
add eax, 0xadaea1ae
xor eax, 0x98624581
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xfc91153e
xor eax, 0xdd3dc1ec
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xf4431e4a
xor eax, 0xaccd6321
rol eax, 0x91
popf
jmp 0x1800ebfa5
push rax
pushf
mov eax, 0xe819bbaa
pushf
not eax
add eax, 0x9ab685f4
xor eax, 0x8991d87b
rol eax, 0xfb
popf
pushf
not eax
add eax, 0x85f025ca
xor eax, 0xf4173d38
rol eax, 0x92
popf
jmp 0x1800ebfa5
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x1800ec3cb
push rax
pushf
mov eax, 0xec33cd06
pushf
not eax
add eax, 0xc7e9ffcb
xor eax, 0xb654560e
rol eax, 0x70
popf
pushf
not eax
add eax, 0xea715c18
xor eax, 0xa141bc3d
rol eax, 0x21
popf
pushf
not eax
add eax, 0xf9f2fed6
xor eax, 0xb0245ac9
rol eax, 0x7f
popf
jmp 0x1800ebfa5
push rax
pushf
mov eax, 0x2687dfa9
pushf
not eax
add eax, 0xedaa8082
xor eax, 0x9485b123
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xee4ea86d
xor eax, 0x9a8f9671
rol eax, 0x2f
popf
jmp 0x1800ebfa5
mov r8d, edi
lea rcx, [rsp + 0x20]
test esi, esi
mov edx, 0xdcee4d48
pushf
not edx
add edx, 0xcc86eb70
xor edx, 0xedd6372a
rol edx, 0x68
popf
pushf
not edx
add edx, 0x86afe579
xor edx, 0xdf0383a8
rol edx, 0x6f
popf
pushf
not edx
add edx, 0xcf2281df
xor edx, 0xdeccf1a3
rol edx, 0x27
popf
setne r8b
call fcn.18016e93f
mov r8d, dword [0x180042e3c]
cmp ebx, r8d
jae 0x1800ec4a7
push rax
pushf
mov eax, 0x2191e0de
pushf
not eax
add eax, 0xc3f61095
xor eax, 0xe2679031
rol eax, 0x8a
popf
pushf
not eax
add eax, 0xa5a68939
xor eax, 0x810532c9
rol eax, 6
popf
pushf
not eax
add eax, 0xd38123aa
xor eax, 0xe8295f64
rol eax, 0xd5
popf
jmp 0x1800ebfa5
push rax
pushf
mov eax, 0x89163ee8
pushf
not eax
add eax, 0xd5f828ae
xor eax, 0xce331952
rol eax, 0xd
popf
pushf
not eax
add eax, 0x8592c19f
xor eax, 0xcd641e3b
rol eax, 0x9d
popf
pushf
not eax
add eax, 0xebcf98d2
xor eax, 0xeebc1ee2
rol eax, 0x4e
popf
jmp 0x1800ebfa5
nop word [rax + rax]
push rax
pushf
mov eax, 0x9dcc0a6a
pushf
not eax
add eax, 0xf518ccaf
xor eax, 0xb5b1af1e
rol eax, 0x3d
popf
pushf
not eax
add eax, 0xebbcfd51
xor eax, 0xd6c69b90
rol eax, 0xb
popf
pushf
not eax
add eax, 0xe303533a
xor eax, 0x886715a6
rol eax, 0xe9
popf
pushf
not eax
add eax, 0xc309be12
xor eax, 0xb58e26f1
rol eax, 0x20
popf
jmp 0x1800ebfa5
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x180042e30]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x1800ec5b2
push rax
pushf
mov eax, 0xcf93bbc9
pushf
not eax
add eax, 0xb8f37cce
xor eax, 0xd95a3177
rol eax, 0x55
popf
pushf
not eax
add eax, 0x91a5a3db
xor eax, 0x937250a7
rol eax, 2
popf
pushf
not eax
add eax, 0xc3b68a5f
xor eax, 0x827ebb56
rol eax, 0x1e
popf
jmp 0x1800ebfa5
push rax
pushf
mov eax, 0x9a77fa0e
pushf
not eax
add eax, 0x86414189
xor eax, 0xc41eb82c
rol eax, 0x1f
popf
pushf
not eax
add eax, 0x9b34cc77
xor eax, 0x8349accb
rol eax, 0xb3
popf
jmp 0x1800ebfa5
mov edx, esi
mov ecx, ebx
call fcn.180156116
mov edi, eax
test eax, eax
jne 0x1800ec63a
push rax
pushf
mov eax, 0x397d7031
pushf
not eax
add eax, 0xe35063e0
xor eax, 0xae2cd5d7
rol eax, 0x5a
popf
pushf
not eax
add eax, 0xd089ef75
xor eax, 0x8b71be41
rol eax, 0x1b
popf
pushf
not eax
add eax, 0xb4add61d
xor eax, 0xe3f513d8
rol eax, 0x8a
popf
jmp 0x1800ebfa5
push rax
pushf
mov eax, 0x1bb975cb
pushf
not eax
add eax, 0xeb173cfe
xor eax, 0xd52d1800
rol eax, 0x3c
popf
pushf
not eax
add eax, 0xdbca502e
xor eax, 0xfc5dc323
rol eax, 0x34
popf
pushf
not eax
add eax, 0xa077abfa
xor eax, 0xcf216217
rol eax, 0x43
popf
pushf
not eax
add eax, 0xdb67daf1
xor eax, 0xcd50aabe
rol eax, 0xf1
popf
jmp 0x1800ebfa5
mov r8d, dword [0x180042e3c]
push rax
pushf
mov eax, 0xa448cc1d
pushf
not eax
add eax, 0xaf874346
xor eax, 0xbe078a23
rol eax, 0x2e
popf
pushf
not eax
add eax, 0x94329576
xor eax, 0x905357a2
rol eax, 0xf9
popf
pushf
not eax
add eax, 0x93f9fca7
xor eax, 0x88f0daa7
rol eax, 0xb5
popf
jmp 0x1800ebfa5
inc ebx
cmp ebx, r8d
jb 0x1800ec71b
push rax
pushf
mov eax, 0x1373306d
pushf
not eax
add eax, 0xf7f61fd9
xor eax, 0x95bd7863
rol eax, 0x32
popf
pushf
not eax
add eax, 0xdee1e43f
xor eax, 0x82c01f20
rol eax, 0x1d
popf
jmp 0x1800ebfa5
push rax
pushf
mov eax, 0xd71b775c
pushf
not eax
add eax, 0x949016b5
xor eax, 0xf2327e84
rol eax, 0x8d
popf
pushf
not eax
add eax, 0xab9c80fa
xor eax, 0xcf60f719
rol eax, 0xc0
popf
jmp 0x1800ebfa5
cmp qword [rsp + 0x20], 0
je 0x1800ec7af
push rax
pushf
mov eax, 0x55b98b92
pushf
not eax
add eax, 0x97d24971
xor eax, 0xc8705aae
rol eax, 0x23
popf
pushf
not eax
add eax, 0xa0929633
xor eax, 0xc80928c5
rol eax, 0x41
popf
pushf
not eax
add eax, 0x876362d6
xor eax, 0xdc95f47b
rol eax, 0x24
popf
pushf
not eax
add eax, 0xe137a713
xor eax, 0xdc170eb8
rol eax, 0x4d
popf
jmp 0x1800ebfa5
push rax
pushf
mov eax, 0x55b0590e
pushf
not eax
add eax, 0x83b00271
xor eax, 0x9da3ede7
rol eax, 0x36
popf
pushf
not eax
add eax, 0xf58b3ff6
xor eax, 0xd41f3ce4
rol eax, 0x78
popf
jmp 0x1800ebfa5
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800ec81d
push rax
pushf
mov eax, 0x425c7183
pushf
not eax
add eax, 0x9478841d
xor eax, 0x9bfcf624
rol eax, 0xee
popf
pushf
not eax
add eax, 0xbbf54240
xor eax, 0x82c64fc7
rol eax, 0x92
popf
jmp 0x1800ebfa5
push rax
pushf
mov eax, 0x7f4552f1
pushf
not eax
add eax, 0xc24fb2f0
xor eax, 0xa3c7f973
rol eax, 0xaf
popf
pushf
not eax
add eax, 0x91f45a0d
xor eax, 0xbead69b5
rol eax, 0x60
popf
jmp 0x1800ebfa5
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
push rax
pushf
mov eax, 0xbf2d97be
pushf
not eax
add eax, 0xc312a8d1
xor eax, 0xd33deb37
rol eax, 0xc0
popf
pushf
not eax
add eax, 0x9524be2e
xor eax, 0xbd7d9f8f
rol eax, 0xeb
popf
pushf
not eax
add eax, 0xae3304f8
xor eax, 0xfcd6c92e
rol eax, 0x89
popf
jmp 0x1800ebfa5
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
jmp 0x1800ec8b7
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800ec91f
mov rcx, rax
jmp 0x1800ec8c9
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
jmp 0x1800ec8d3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0xbfac0702
pushf
not eax
add eax, 0xa7575c4b
xor eax, 0x98a3b01f
rol eax, 0x16
popf
pushf
not eax
add eax, 0xd91df72e
xor eax, 0xb1e2be8c
rol eax, 0x72
popf
pushf
not eax
add eax, 0xc84aa184
xor eax, 0x8e69d610
rol eax, 0x44
popf
jmp 0x1800ebfa5
add rbx, 4
sub rbp, 1
jne 0x1800ec982
push rax
pushf
mov eax, 0xa1b7ced0
pushf
not eax
add eax, 0xf1913f83
xor eax, 0xc43b89fb
rol eax, 0xa4
popf
pushf
not eax
add eax, 0x99c9b18c
xor eax, 0xba1e5ebe
rol eax, 0xed
popf
pushf
not eax
add eax, 0xed86b57b
xor eax, 0xa9aeec6d
rol eax, 0x76
popf
pushf
not eax
add eax, 0xe0e575b1
xor eax, 0x96f25093
rol eax, 0x3f
popf
jmp 0x1800ebfa5
push rax
pushf
mov eax, 0xc10521f1
pushf
not eax
add eax, 0xd9ae1994
xor eax, 0x9ee3c50d
rol eax, 0xf4
popf
pushf
not eax
add eax, 0xd3dd790a
xor eax, 0xa8ea1456
rol eax, 0xf0
popf
jmp 0x1800ebfa5
mov rbp, qword [rsp + 0x40]
push rax
pushf
mov eax, 0x8b8de0f0
pushf
not eax
add eax, 0xca37f03a
xor eax, 0xb3f5ba58
rol eax, 0x9f
popf
pushf
not eax
add eax, 0xbedf6ec8
xor eax, 0xc178da81
rol eax, 0x90
popf
pushf
not eax
add eax, 0xe9c839c3
xor eax, 0x928a006b
rol eax, 0x89
popf
jmp 0x1800ebfa5
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180041538]
jmp 0x1800eca0f
call qword [sym.imp.KERNEL32.dll_HeapFree]
push rax
pushf
mov eax, 0xac09c4c6
pushf
not eax
add eax, 0xfb8460d3
xor eax, 0x995fe20d
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xb5ea7a71
xor eax, 0xdb5fa5a8
rol eax, 0xd9
popf
pushf
not eax
add eax, 0xab889497
xor eax, 0xb536fa17
rol eax, 0x6c
popf
jmp 0x1800ebfa5
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret