Function at 0x18010e900
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1801c4240]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
xor edx, edx
mov ecx, 4
xor esi, esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18010ea46
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x18010ea3d
mov esi, 1
mov qword [rsp + 0x68], rbx
cmp dword [rsp + 0x20], 0x10
jb 0x18010e9f4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x18010e9f4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x18010e9f4
mov rax, qword [rdi]
test rax, rax
jne 0x18010e9b8
mov dword [rdi + 8], 0x80
xor edx, edx
mov rcx, qword [0x1801ebde8]
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi], rax
test rax, rax
je 0x18010ea1c
lea rbx, [rdi + 0xc]
jmp 0x18010e9e9
mov ecx, dword [rdi + 8]
lea rbx, [rdi + 0xc]
cmp dword [rbx], ecx
jb 0x18010e9e9
add ecx, ecx
mov r8, rax
mov r9d, ecx
xor edx, edx
mov dword [rdi + 8], ecx
mov rcx, qword [0x1801ebde8]
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x18010ea1c
mov qword [rdi], rax
mov edx, dword [rbx]
mov ecx, dword [rsp + 0x28]
mov dword [rax + rdx*4], ecx
inc dword [rbx]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rbp
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x18010e963
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x18010ea38
mov r8, qword [rdi]
xor esi, esi
test r8, r8
je 0x18010ea38
mov rcx, qword [0x1801ebde8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi], rsi
mov rbx, qword [rsp + 0x68]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180111840
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x18010eb50
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov ebp, r8d
mov qword [rcx], 0
mov r14d, edx
mov qword [rcx + 8], 0
mov rdi, rcx
call fcn.18010e900
test eax, eax
jne 0x18010eb97
mov eax, 9
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rdi], 0
je 0x18010ec10
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rdi + 0xc], ebx
jbe 0x18010ebf8
mov qword [rsp + 0x38], rsi
nop
mov r8, qword [rdi]
xor edx, edx
mov ecx, 0x5a
mov r8d, dword [r8 + rbx*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18010ebec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.18010f020
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x18010ebb0
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rbp, qword [rsp + 0x40]
xor eax, eax
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret