Function at 0x18016e9b4
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push rax
pushf
mov eax, 0xe75e33e6
pushf
not eax
add eax, 0xff597a9a
xor eax, 0xddf46ac5
rol eax, 0x58
popf
pushf
not eax
add eax, 0xd6ec3974
xor eax, 0xbf7dfafe
rol eax, 0xb5
popf
pushf
not eax
add eax, 0xf8da6c3c
xor eax, 0xe19e8041
rol eax, 0xff
popf
cmp eax, 4
jne 0x18016ea04
popf
pop rax
jmp 0x18016eda5
cmp eax, 0
jne 0x18016ea13
popf
pop rax
jmp 0x18016eb3f
cmp eax, 3
jne 0x18016ea22
popf
pop rax
jmp 0x18016ed0d
cmp eax, 1
jne 0x18016ea31
popf
pop rax
jmp 0x18016ec02
cmp eax, 0xd
jne 0x18016ea40
popf
pop rax
jmp 0x18016f23b
cmp eax, 7
jne 0x18016ea4f
popf
pop rax
jmp 0x18016ef44
cmp eax, 0xe
jne 0x18016ea5e
popf
pop rax
jmp 0x18016f2e4
cmp eax, 0xb
jne 0x18016ea6d
popf
pop rax
jmp 0x18016f1bc
cmp eax, 0xc
jne 0x18016ea7c
popf
pop rax
jmp 0x18016f1fa
cmp eax, 8
jne 0x18016ea8b
popf
pop rax
jmp 0x18016f01b
cmp eax, 0x10
jne 0x18016ea9a
popf
pop rax
jmp 0x18016f3fe
cmp eax, 2
jne 0x18016eaa9
popf
pop rax
jmp 0x18016ecbe
cmp eax, 9
jne 0x18016eab8
popf
pop rax
jmp 0x18016f066
cmp eax, 0x12
jne 0x18016eac7
popf
pop rax
jmp 0x18016f4ce
cmp eax, 6
jne 0x18016ead6
popf
pop rax
jmp 0x18016eed6
cmp eax, 0x11
jne 0x18016eae5
popf
pop rax
jmp 0x18016f469
cmp eax, 5
jne 0x18016eaf4
popf
pop rax
jmp 0x18016ee3e
cmp eax, 0x15
jne 0x18016eb03
popf
pop rax
jmp 0x18016f62d
cmp eax, 0xa
jne 0x18016eb12
popf
pop rax
jmp 0x18016f10d
cmp eax, 0x14
jne 0x18016eb21
popf
pop rax
jmp 0x18016f59a
cmp eax, 0xf
jne 0x18016eb30
popf
pop rax
jmp 0x18016f347
cmp eax, 0x13
jne 0x18016eb3f
popf
pop rax
jmp 0x18016f577
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x180040280]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov r14d, edx
mov rbx, rcx
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
xor edx, edx
mov ebp, r8d
lea ecx, [rsi + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18016ebbc
push rax
pushf
mov eax, 0xcafa4a4e
pushf
not eax
add eax, 0xcaa8674c
xor eax, 0xc6483c2a
rol eax, 0xc8
popf
pushf
not eax
add eax, 0x890dafdf
xor eax, 0xa2ecd8a1
rol eax, 0x3e
popf
jmp 0x18016e9f5
push rax
pushf
mov eax, 0xe2904236
pushf
not eax
add eax, 0xa69063d0
xor eax, 0xc6ab412c
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xe469db1a
xor eax, 0xdfe2c05f
rol eax, 0xdf
popf
pushf
not eax
add eax, 0xacd7032e
xor eax, 0xd1a7b720
rol eax, 5
popf
jmp 0x18016e9f5
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x18016ec65
push rax
pushf
mov eax, 0xe27077ad
pushf
not eax
add eax, 0xf30b4f4b
xor eax, 0xf0b32181
rol eax, 0x73
popf
pushf
not eax
add eax, 0x994e7448
xor eax, 0xcab7b05b
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xf47c33c8
xor eax, 0xae369262
rol eax, 0x5c
popf
jmp 0x18016e9f5
push rax
pushf
mov eax, 0x821eac16
pushf
not eax
add eax, 0xb8ac145c
xor eax, 0xce1ec634
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xa3413404
xor eax, 0x8954bf14
rol eax, 0x1d
popf
pushf
not eax
add eax, 0x916e9c64
xor eax, 0xb43f17b6
rol eax, 0x2b
popf
pushf
not eax
add eax, 0xa8d1c7d9
xor eax, 0x85578579
rol eax, 0xf9
popf
jmp 0x18016e9f5
nop word [rax + rax]
push rax
pushf
mov eax, 0xeb3aeda0
pushf
not eax
add eax, 0xb01e4120
xor eax, 0xa5efee8b
rol eax, 0x40
popf
pushf
not eax
add eax, 0xafc1169e
xor eax, 0xa893fa95
rol eax, 0x84
popf
pushf
not eax
add eax, 0xfd920814
xor eax, 0x9b17e449
rol eax, 0x1e
popf
jmp 0x18016e9f5
cmp dword [rsp + 0x20], 0x10
jb 0x18016ed71
push rax
pushf
mov eax, 0x9caddd91
pushf
not eax
add eax, 0x97ff5745
xor eax, 0xcfb42459
rol eax, 0xc2
popf
pushf
not eax
add eax, 0xd7e6751c
xor eax, 0xf6ff9457
rol eax, 0x61
popf
pushf
not eax
add eax, 0xcf296f85
xor eax, 0xe4fd2e14
rol eax, 0
popf
pushf
not eax
add eax, 0xb1b75dcc
xor eax, 0xa67faa9c
rol eax, 0x29
popf
jmp 0x18016e9f5
push rax
pushf
mov eax, 0xd0b5cd05
pushf
not eax
add eax, 0x8878a168
xor eax, 0xefc7597f
rol eax, 0xf8
popf
pushf
not eax
add eax, 0xd56af06f
xor eax, 0xb8134ae1
rol eax, 0x73
popf
jmp 0x18016e9f5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x18016ede4
push rax
pushf
mov eax, 0xacd89bf1
pushf
not eax
add eax, 0xd08132e5
xor eax, 0xc5ab110b
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xb7222755
xor eax, 0xf325be53
rol eax, 0x97
popf
jmp 0x18016e9f5
push rax
pushf
mov eax, 0xdd2f4e83
pushf
not eax
add eax, 0x8d6e9859
xor eax, 0xe07dfcad
rol eax, 0xb5
popf
pushf
not eax
add eax, 0x8df1ab11
xor eax, 0xaaad2b2f
rol eax, 0x66
popf
pushf
not eax
add eax, 0x90d2fb34
xor eax, 0xf956bdb0
rol eax, 0x85
popf
pushf
not eax
add eax, 0xe6db4816
xor eax, 0xf9563b45
rol eax, 0x4a
popf
jmp 0x18016e9f5
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x18016eea3
push rax
pushf
mov eax, 0x29ceca73
pushf
not eax
add eax, 0xc730a1f3
xor eax, 0xa3765677
rol eax, 0xb7
popf
pushf
not eax
add eax, 0xbb796c33
xor eax, 0xddc055b0
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xc142e33d
xor eax, 0xc2334b2f
rol eax, 0x8b
popf
pushf
not eax
add eax, 0xf24260d1
xor eax, 0xfb1269c6
rol eax, 0x7b
popf
jmp 0x18016e9f5
push rax
pushf
mov eax, 0x115cd582
pushf
not eax
add eax, 0xd52e3ecc
xor eax, 0xbba64757
rol eax, 0x89
popf
pushf
not eax
add eax, 0xe5069bd6
xor eax, 0xf6aa53e5
rol eax, 0xb8
popf
jmp 0x18016e9f5
mov rdx, qword [rbx]
test rdx, rdx
jne 0x18016ef11
push rax
pushf
mov eax, 0x1145d51e
pushf
not eax
add eax, 0xce50ee4c
xor eax, 0xb6bb907a
rol eax, 0x73
popf
pushf
not eax
add eax, 0xda7413e9
xor eax, 0x93bbb664
rol eax, 0xe6
popf
jmp 0x18016e9f5
push rax
pushf
mov eax, 0x249b3d01
pushf
not eax
add eax, 0xa67584e9
xor eax, 0xf13a2d0a
rol eax, 0x8c
popf
pushf
not eax
add eax, 0xb99e7ea9
xor eax, 0xb2a7a79a
rol eax, 0xcd
popf
jmp 0x18016e9f5
mov dword [rbx + 8], 0x80
mov r8d, 0xfd10c2b2
pushf
not r8d
add r8d, 0xeaad1464
xor r8d, 0xedb3b695
rol r8d, 0xa6
popf
pushf
not r8d
add r8d, 0xb5fc6366
xor r8d, 0xb38f25a7
rol r8d, 0xc4
popf
pushf
not r8d
add r8d, 0x951a26b1
xor r8d, 0xfc2e2a8f
rol r8d, 0xd5
popf
mov rcx, qword [0x180041560]
jmp 0x18016efa4
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x18016efe8
push rax
pushf
mov eax, 0xf604777a
pushf
not eax
add eax, 0x940360b8
xor eax, 0xfa3a17e8
rol eax, 0x22
popf
pushf
not eax
add eax, 0x9ca450e9
xor eax, 0xfd9055b3
rol eax, 0xfe
popf
jmp 0x18016e9f5
push rax
pushf
mov eax, 0xd3a9a097
pushf
not eax
add eax, 0xd92f41c2
xor eax, 0x8d351021
rol eax, 0xef
popf
pushf
not eax
add eax, 0xe2e30ead
xor eax, 0x8a5a4a54
rol eax, 0x31
popf
jmp 0x18016e9f5
jmp 0x18016f1fa
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x18016f0b4
push rax
pushf
mov eax, 0xb520e3f5
pushf
not eax
add eax, 0x92919e44
xor eax, 0xee164c1f
rol eax, 0x81
popf
pushf
not eax
add eax, 0x94db4487
xor eax, 0x871c172d
rol eax, 0x81
popf
pushf
not eax
add eax, 0xee6f41b1
xor eax, 0xb44cc01d
rol eax, 0xa6
popf
jmp 0x18016e9f5
push rax
pushf
mov eax, 0xe5978e86
pushf
not eax
add eax, 0xe7961f2d
xor eax, 0xb431240b
rol eax, 0xbf
popf
pushf
not eax
add eax, 0xea26d065
xor eax, 0xe45e9d70
rol eax, 0x13
popf
pushf
not eax
add eax, 0xe100b3f7
xor eax, 0x99fcba44
rol eax, 0xde
popf
pushf
not eax
add eax, 0x9212b812
xor eax, 0xcad53f67
rol eax, 0xe2
popf
jmp 0x18016e9f5
mov rcx, qword [0x180041560]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
jmp 0x18016f122
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x18016f189
push rax
pushf
mov eax, 0xd97d176b
pushf
not eax
add eax, 0xd7e2070c
xor eax, 0xb9bc5cd3
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xfdb70386
xor eax, 0xe2b3d1e0
rol eax, 0xa7
popf
pushf
not eax
add eax, 0xb833843e
xor eax, 0xa9ae021e
rol eax, 0xbb
popf
pushf
not eax
add eax, 0xe2639945
xor eax, 0x954de1c2
rol eax, 0x59
popf
jmp 0x18016e9f5
push rax
pushf
mov eax, 0x276033be
pushf
not eax
add eax, 0x9ef183c0
xor eax, 0xd8bfa97e
rol eax, 0xc5
popf
pushf
not eax
add eax, 0xa3ffeeb0
xor eax, 0xbe20be82
rol eax, 0x3e
popf
jmp 0x18016e9f5
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
push rax
pushf
mov eax, 0x153bd67
pushf
not eax
add eax, 0xaf95928c
xor eax, 0xbe3f1690
rol eax, 0x69
popf
pushf
not eax
add eax, 0x9acffb32
xor eax, 0x9d489312
rol eax, 0x22
popf
jmp 0x18016e9f5
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
jmp 0x18016f205
inc dword [rbx + 0xc]
push rax
pushf
mov eax, 0x6469ee1e
pushf
not eax
add eax, 0xa2e09b18
xor eax, 0xa7b5339c
rol eax, 0xd5
popf
pushf
not eax
add eax, 0xb2ff5863
xor eax, 0xc64c1ff5
rol eax, 0x3f
popf
jmp 0x18016e9f5
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x18016f28b
push rax
pushf
mov eax, 0xce7b57a4
pushf
not eax
add eax, 0xd0217edb
xor eax, 0xf55a5947
rol eax, 0x3a
popf
pushf
not eax
add eax, 0x8ca0e9c8
xor eax, 0xd8ccf7ce
rol eax, 0xe7
popf
jmp 0x18016e9f5
push rax
pushf
mov eax, 0x861296b5
pushf
not eax
add eax, 0xaca36c68
xor eax, 0xf5be6cf8
rol eax, 0xee
popf
pushf
not eax
add eax, 0xbc6de88d
xor eax, 0x98329950
rol eax, 0xc5
popf
pushf
not eax
add eax, 0x849dca2a
xor eax, 0x8ca0f562
rol eax, 0x51
popf
pushf
not eax
add eax, 0x85be2205
xor eax, 0x8093b973
rol eax, 0x58
popf
jmp 0x18016e9f5
mov rcx, rdi
jmp 0x18016f2e8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0x2466cded
pushf
not eax
add eax, 0x84375fe2
xor eax, 0xfc4442d2
rol eax, 0xab
popf
pushf
not eax
add eax, 0xba048952
xor eax, 0x9e3e4671
rol eax, 0x33
popf
pushf
not eax
add eax, 0x9888c9bb
xor eax, 0xab526237
rol eax, 0x21
popf
pushf
not eax
add eax, 0xfb1bf55f
xor eax, 0xa0ae9b13
rol eax, 0x53
popf
jmp 0x18016e9f5
cmp qword [rbx], rsi
je 0x18016f3a5
push rax
pushf
mov eax, 0x6175bece
pushf
not eax
add eax, 0xc6d7b554
xor eax, 0xad29f81e
rol eax, 0x7d
popf
pushf
not eax
add eax, 0x83d35e5e
xor eax, 0x8a9713f9
rol eax, 0x1f
popf
pushf
not eax
add eax, 0xa75b27bd
xor eax, 0x91bb9bf8
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xb1393b8d
xor eax, 0xc35ede1d
rol eax, 0x5c
popf
jmp 0x18016e9f5
push rax
pushf
mov eax, 0xba738bc9
pushf
not eax
add eax, 0xaa9f7283
xor eax, 0xe322e03e
rol eax, 0x39
popf
pushf
not eax
add eax, 0xa6d0b5a8
xor eax, 0xee9abe0b
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xaf0fc3e0
xor eax, 0xec543798
rol eax, 0xe1
popf
pushf
not eax
add eax, 0x91200611
xor eax, 0xb8f98757
rol eax, 2
popf
jmp 0x18016e9f5
cmp dword [rbx + 0xc], esi
jbe 0x18016f436
push rax
pushf
mov eax, 0xbe1fe820
pushf
not eax
add eax, 0xfa287c68
xor eax, 0x9434718b
rol eax, 0x38
popf
pushf
not eax
add eax, 0xace0c209
xor eax, 0xe0388703
rol eax, 0x7b
popf
jmp 0x18016e9f5
push rax
pushf
mov eax, 0xb2780c9e
pushf
not eax
add eax, 0xabe16d7d
xor eax, 0x9dda2e2d
rol eax, 0xa3
popf
pushf
not eax
add eax, 0xabbc2103
xor eax, 0x8361a967
rol eax, 0x8a
popf
jmp 0x18016e9f5
nop dword [rax]
nop dword [rax + rax]
push rax
pushf
mov eax, 0x7fb28f0b
pushf
not eax
add eax, 0xceeb61d0
xor eax, 0xf4cd9512
rol eax, 0xce
popf
pushf
not eax
add eax, 0x96cb6baf
xor eax, 0xc7f7c9a1
rol eax, 0x84
popf
pushf
not eax
add eax, 0x8bdb7b91
xor eax, 0xff1c365d
rol eax, 0xd7
popf
pushf
not eax
add eax, 0xecde31d9
xor eax, 0x820af9ca
rol eax, 0xb7
popf
jmp 0x18016e9f5
mov rax, qword [rbx]
xor edx, edx
mov ecx, esi
mov r8d, dword [rax + rcx*4]
lea ecx, [rdx + 0x5a]
jmp 0x18016f4dd
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18016f544
push rax
pushf
mov eax, 0xfc64768e
pushf
not eax
add eax, 0x836b2a64
xor eax, 0xa39d69f5
rol eax, 0x21
popf
pushf
not eax
add eax, 0xe367b167
xor eax, 0xb7a45df0
rol eax, 0xd5
popf
pushf
not eax
add eax, 0xe38b108a
xor eax, 0xb14b3c0b
rol eax, 0xfc
popf
pushf
not eax
add eax, 0x816e7724
xor eax, 0x99d590be
rol eax, 0x7e
popf
jmp 0x18016e9f5
push rax
pushf
mov eax, 0x91a773d2
pushf
not eax
add eax, 0x850f4bbd
xor eax, 0x8cebe33e
rol eax, 2
popf
pushf
not eax
add eax, 0x9e986527
xor eax, 0xa06d91d5
rol eax, 0x11
popf
jmp 0x18016e9f5
mov rcx, rax
jmp 0x18016f57b
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.1800fa522
mov rcx, rdi
jmp 0x18016f593
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18016f59a
inc esi
cmp esi, dword [rbx + 0xc]
jb 0x18016f5fa
push rax
pushf
mov eax, 0xae0605c3
pushf
not eax
add eax, 0x9a14aeaf
xor eax, 0xdc249e75
rol eax, 0xa6
popf
pushf
not eax
add eax, 0xf26357f5
xor eax, 0xaf24c2ad
rol eax, 0xbc
popf
pushf
not eax
add eax, 0xeaff1a14
xor eax, 0xd2ba4a79
rol eax, 0xaa
popf
pushf
not eax
add eax, 0xc11ce249
xor eax, 0x9d7a6935
rol eax, 0x89
popf
jmp 0x18016e9f5
push rax
pushf
mov eax, 0x8a87bc95
pushf
not eax
add eax, 0xaf086df6
xor eax, 0x9282d2a6
rol eax, 0xfd
popf
pushf
not eax
add eax, 0xc12873fd
xor eax, 0xea202784
rol eax, 0x6e
popf
jmp 0x18016e9f5
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800e8c52
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret