Function at 0x18000b470
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x5a8
mov rax, qword [0x1800530b8]
xor rax, rsp
mov qword [rsp + 0x590], rax
cmp qword [rsp + 0x5e0], 0
je 0x18000b4b3
mov rax, qword [rsp + 0x5e0]
mov rcx, qword [0x180054420]
mov qword [rax], rcx
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x180054418], eax
je 0x18000b4ca
mov eax, 0x10dd
jmp 0x18000bd8f
cmp dword [0x18005441c], 0
je 0x18000b4e4
int3
mov dword [rsp + 0x80], 0
mov rax, qword [0x180054430]
mov qword [rsp + 0x70], rax
jmp 0x18000b50a
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
je 0x18000ba41
mov rax, qword [rsp + 0x70]
cmp dword [rax + 8], 0
je 0x18000b569
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x20]
add rcx, 0x20
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x18]
call fcn.180015490
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x18]
mov qword [rax], rcx
jmp 0x18000ba3c
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x20]
mov rdx, qword [rsp + 0x70]
mov rdx, qword [rdx + 0x20]
mov dword [rsp + 0x20], eax
mov r9, qword [rcx + 0x50]
mov r8, qword [rdx + 0x48]
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 0x20]
lea rcx, str.detours:_pbTramp__p__pbRemain_p__pbDetour_p__cbRestore_u_n
call fcn.18000bf90
mov eax, 1
imul rax, rax, 0xb
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x18]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0xa
mov rdx, qword [rsp + 0x70]
mov rdx, qword [rdx + 0x18]
movzx ecx, byte [rdx + rcx]
mov edx, 1
imul rdx, rdx, 9
mov r8, qword [rsp + 0x70]
mov r8, qword [r8 + 0x18]
movzx edx, byte [r8 + rdx]
mov r8d, 1
imul r8, r8, 8
mov r9, qword [rsp + 0x70]
mov r9, qword [r9 + 0x18]
movzx r8d, byte [r9 + r8]
mov r9d, 1
imul r9, r9, 7
mov r10, qword [rsp + 0x70]
mov r10, qword [r10 + 0x18]
movzx r9d, byte [r10 + r9]
mov r10d, 1
imul r10, r10, 6
mov r11, qword [rsp + 0x70]
mov r11, qword [r11 + 0x18]
movzx r10d, byte [r11 + r10]
mov r11d, 1
imul r11, r11, 5
mov rbx, qword [rsp + 0x70]
mov rbx, qword [rbx + 0x18]
movzx ebx, byte [rbx + r11]
mov r11d, 1
imul r11, r11, 4
mov rdi, qword [rsp + 0x70]
mov rdi, qword [rdi + 0x18]
movzx edi, byte [rdi + r11]
mov r11d, 1
imul r11, r11, 3
mov rsi, qword [rsp + 0x70]
mov rsi, qword [rsi + 0x18]
movzx esi, byte [rsi + r11]
mov r11d, 1
imul r11, r11, 2
mov rbp, qword [rsp + 0x70]
mov rbp, qword [rbp + 0x18]
movzx ebp, byte [r11 + rbp]
mov r11d, 1
imul r11, r11, 1
mov r14, qword [rsp + 0x70]
mov r14, qword [r14 + 0x18]
movzx r11d, byte [r14 + r11]
mov r14d, 1
imul r14, r14, 0
mov r15, qword [rsp + 0x70]
mov r15, qword [r15 + 0x18]
movzx r14d, byte [r15 + r14]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], edx
mov dword [rsp + 0x50], r8d
mov dword [rsp + 0x48], r9d
mov dword [rsp + 0x40], r10d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
mov r9d, r11d
mov r8d, r14d
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 0x18]
lea rcx, str.detours:_pbTarget_p:__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x__before__n
call fcn.18000bf90
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x20]
add rax, 0x50
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x20]
add rcx, 0x58
mov rdx, rax
call fcn.180009a20
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x20]
add rax, 0x58
mov rdx, rax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x18]
call fcn.1800099c0
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x20]
mov rdx, qword [rax + 0x48]
mov rcx, qword [rsp + 0x88]
call fcn.180009980
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x20]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x10]
mov qword [rcx], rax
mov eax, 1
imul rax, rax, 0xb
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x18]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0xa
mov rdx, qword [rsp + 0x70]
mov rdx, qword [rdx + 0x18]
movzx ecx, byte [rdx + rcx]
mov edx, 1
imul rdx, rdx, 9
mov rbx, qword [rsp + 0x70]
mov rbx, qword [rbx + 0x18]
movzx edx, byte [rbx + rdx]
mov ebx, 1
imul rbx, rbx, 8
mov rdi, qword [rsp + 0x70]
mov rdi, qword [rdi + 0x18]
movzx ebx, byte [rdi + rbx]
mov edi, 1
imul rdi, rdi, 7
mov rsi, qword [rsp + 0x70]
mov rsi, qword [rsi + 0x18]
movzx edi, byte [rsi + rdi]
mov esi, 1
imul rsi, rsi, 6
mov rbp, qword [rsp + 0x70]
mov rbp, qword [rbp + 0x18]
movzx esi, byte [rsi + rbp]
mov ebp, 1
imul rbp, rbp, 5
mov r8, qword [rsp + 0x70]
mov r8, qword [r8 + 0x18]
movzx ebp, byte [r8 + rbp]
mov r8d, 1
imul r8, r8, 4
mov r9, qword [rsp + 0x70]
mov r9, qword [r9 + 0x18]
movzx r8d, byte [r9 + r8]
mov r9d, 1
imul r9, r9, 3
mov r10, qword [rsp + 0x70]
mov r10, qword [r10 + 0x18]
movzx r9d, byte [r10 + r9]
mov r10d, 1
imul r10, r10, 2
mov r11, qword [rsp + 0x70]
mov r11, qword [r11 + 0x18]
movzx r10d, byte [r11 + r10]
mov r11d, 1
imul r11, r11, 1
mov r14, qword [rsp + 0x70]
mov r14, qword [r14 + 0x18]
movzx r11d, byte [r14 + r11]
mov r14d, 1
imul r14, r14, 0
mov r15, qword [rsp + 0x70]
mov r15, qword [r15 + 0x18]
movzx r14d, byte [r15 + r14]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], edx
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r9d
mov dword [rsp + 0x20], r10d
mov r9d, r11d
mov r8d, r14d
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 0x18]
lea rcx, str.detours:_pbTarget_p:__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x__after__n
call fcn.18000bf90
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x20]
mov ecx, 1
imul rcx, rcx, 0xb
movzx eax, byte [rax + rcx]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x20]
mov edx, 1
imul rdx, rdx, 0xa
movzx ecx, byte [rcx + rdx]
mov rdx, qword [rsp + 0x70]
mov rdx, qword [rdx + 0x20]
mov ebx, 1
imul rbx, rbx, 9
movzx edx, byte [rdx + rbx]
mov rbx, qword [rsp + 0x70]
mov rbx, qword [rbx + 0x20]
mov edi, 1
imul rdi, rdi, 8
movzx ebx, byte [rbx + rdi]
mov rdi, qword [rsp + 0x70]
mov rdi, qword [rdi + 0x20]
mov esi, 1
imul rsi, rsi, 7
movzx edi, byte [rdi + rsi]
mov rsi, qword [rsp + 0x70]
mov rsi, qword [rsi + 0x20]
mov ebp, 1
imul rbp, rbp, 6
movzx esi, byte [rsi + rbp]
mov rbp, qword [rsp + 0x70]
mov rbp, qword [rbp + 0x20]
mov r8d, 1
imul r8, r8, 5
movzx ebp, byte [r8 + rbp]
mov r8, qword [rsp + 0x70]
mov r8, qword [r8 + 0x20]
mov r9d, 1
imul r9, r9, 4
movzx r8d, byte [r8 + r9]
mov r9, qword [rsp + 0x70]
mov r9, qword [r9 + 0x20]
mov r10d, 1
imul r10, r10, 3
movzx r9d, byte [r9 + r10]
mov r10, qword [rsp + 0x70]
mov r10, qword [r10 + 0x20]
mov r11d, 1
imul r11, r11, 2
movzx r10d, byte [r10 + r11]
mov r11, qword [rsp + 0x70]
mov r11, qword [r11 + 0x20]
mov r14d, 1
imul r14, r14, 1
movzx r11d, byte [r11 + r14]
mov r14, qword [rsp + 0x70]
mov r14, qword [r14 + 0x20]
mov r15d, 1
imul r15, r15, 0
movzx r14d, byte [r14 + r15]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], edx
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r9d
mov dword [rsp + 0x20], r10d
mov r9d, r11d
mov r8d, r14d
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 0x20]
lea rcx, [0x18003cef0]
call fcn.18000bf90
jmp 0x18000b4fd
mov rax, qword [0x180054428]
mov qword [rsp + 0x78], rax
jmp 0x18000ba5c
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x18000bbd8
mov dword [rsp + 0xf0], 0x100001
lea rdx, [rsp + 0xc0]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_GetThreadContext
test eax, eax
je 0x18000bbd3
mov rax, qword [0x180054430]
mov qword [rsp + 0x70], rax
jmp 0x18000baac
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
je 0x18000bbd3
mov rax, qword [rsp + 0x70]
cmp dword [rax + 8], 0
je 0x18000bb48
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x20]
cmp qword [rsp + 0x1b8], rax
jb 0x18000bb43
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x20]
add rax, 8
cmp qword [rsp + 0x1b8], rax
jae 0x18000bb43
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x20]
mov rcx, qword [rsp + 0x1b8]
sub rcx, rax
mov rax, rcx
movzx edx, al
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x20]
call fcn.180008d40
movzx eax, al
mov rcx, qword [rsp + 0x70]
add rax, qword [rcx + 0x18]
mov qword [rsp + 0x1b8], rax
lea rdx, [rsp + 0xc0]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_SetThreadContext
jmp 0x18000bbce
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x18]
cmp qword [rsp + 0x1b8], rax
jb 0x18000bbce
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
mov rcx, qword [rsp + 0x70]
add rax, qword [rcx + 0x18]
cmp qword [rsp + 0x1b8], rax
jae 0x18000bbce
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x18]
mov rcx, qword [rsp + 0x1b8]
sub rcx, rax
mov rax, rcx
movzx eax, al
mov edx, eax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x20]
call fcn.180008cd0
cdqe
mov rcx, qword [rsp + 0x70]
add rax, qword [rcx + 0x20]
mov qword [rsp + 0x1b8], rax
lea rdx, [rsp + 0xc0]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_SetThreadContext
jmp 0x18000ba9f
jmp 0x18000ba4f
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x98], rax
mov rax, qword [0x180054430]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
je 0x18000bccf
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
mov r8d, eax
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 0x18]
mov rcx, qword [rsp + 0x98]
call sub.KERNEL32.dll_FlushInstructionCache
mov rax, qword [rsp + 0x70]
cmp dword [rax + 8], 0
je 0x18000bc8e
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x20], 0
je 0x18000bc8e
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x20]
call fcn.1800098a0
mov rax, qword [rsp + 0x70]
mov qword [rax + 0x20], 0
mov dword [rsp + 0x80], 1
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xa0], rax
mov edx, 0x30
mov rcx, qword [rsp + 0xa0]
call fcn.180013324
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x70], rax
jmp 0x18000bbf1
mov qword [0x180054430], 0
cmp dword [rsp + 0x80], 0
je 0x18000bcf2
cmp dword [0x180054414], 0
jne 0x18000bcf2
call fcn.1800098f0
call fcn.18000a300
mov rax, qword [0x180054428]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x18000bd57
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xb0], rax
mov edx, 0x10
mov rcx, qword [rsp + 0xb0]
call fcn.180013324
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x78], rax
jmp 0x18000bd03
mov qword [0x180054428], 0
mov dword [0x180054418], 0
cmp qword [rsp + 0x5e0], 0
je 0x18000bd89
mov rax, qword [rsp + 0x5e0]
mov rcx, qword [0x180054420]
mov qword [rax], rcx
mov eax, dword [0x18005441c]
mov rcx, qword [rsp + 0x590]
xor rcx, rsp
call fcn.180013440
add rsp, 0x5a8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret