Function at 0x180001493
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x528
mov r15d, r8d
mov dword [rsp + 0x2c], edx
xorps xmm0, xmm0
mov qword [rsp + 0x30], rcx
movups xmmword [rcx], xmm0
mov ecx, 4
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13d, 9
cmp rax, 0xffffffffffffffff
je 0x1800017c0
mov rbp, rax
lea rdx, [rsp + 0x50]
mov dword [rdx], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1800017b7
mov r14, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rbx, [rsp + 0x50]
cmp dword [rsp + 0x50], 0x10
jb 0x1800015a9
mov edi, dword [rsp + 0x5c]
call r14
cmp edi, eax
jne 0x1800015a9
mov edi, dword [rsp + 0x58]
call r12
cmp edi, eax
je 0x1800015a9
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsi]
test rax, rax
je 0x18000156c
mov r9d, dword [rsi + 8]
cmp dword [rsi + 0xc], r9d
jb 0x180001599
add r9d, r9d
mov dword [rsi + 8], r9d
shl r9, 2
mov rcx, qword [0x180065758]
xor edx, edx
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x180001799
mov qword [rsi], rax
jmp 0x180001599
mov dword [rsi + 8], 0x80
mov rcx, qword [0x180065758]
mov r8d, 0x200
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, qword [rsp + 0x30]
mov qword [rsi], rax
test rax, rax
je 0x1800017b7
mov ecx, dword [rsp + 0x58]
mov edx, dword [rsi + 0xc]
lea edi, [rdx + 1]
mov dword [rsi + 0xc], edi
mov dword [rax + rdx*4], ecx
mov dword [rsp + 0x50], 0x1c
mov rcx, rbp
mov rdx, rbx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180001505
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
mov rsi, qword [rsp + 0x30]
jne 0x180001799
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsi]
xor r13d, r13d
test rax, rax
je 0x1800017c0
cmp dword [rsi + 0xc], 0
je 0x1800017c0
xor r12d, r12d
mov ecx, dword [rsp + 0x2c]
mov edx, ecx
inc edx
mov dword [rsp + 0x3c], edx
cmove ecx, r12d
mov qword [rsp + 0x40], rcx
mov r8d, dword [rax + r12*4]
mov ecx, 0x5a
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
je 0x180001781
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [rsp + 0x80], 0x100001
mov qword [rsp + 0x48], rsi
mov rcx, rsi
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x180001776
mov eax, dword [rsp + 0x3c]
cmp dword [rsp + 0x2c], 0xffffffff
jne 0x18000166f
mov eax, dword [0x18006576c]
cmp dword [rsp + 0x40], eax
jae 0x180001776
mov r14d, eax
mov r13, qword [rsp + 0x40]
cmp r15d, 1
sete bl
mov r9, qword [0x180065760]
imul rcx, r13, 0x38
mov dl, byte [r9 + rcx + 0x20]
test dl, 2
sete al
xor al, bl
jne 0x18000176a
lea r8, [r9 + rcx]
mov rsi, qword [rsp + 0x148]
cmp r15d, 1
jne 0x1800016ec
mov ebp, dword [r9 + rcx + 0x24]
and ebp, 0xf
test ebp, ebp
je 0x18000176a
mov rdi, qword [r8]
lea rbx, [r9 + rcx]
add rbx, 0x30
xor edx, edx
movzx eax, byte [rbx + rdx - 8]
add rax, rdi
cmp rax, rsi
je 0x180001737
inc rdx
cmp rbp, rdx
jne 0x1800016d5
jmp 0x18000176a
test dl, 1
je 0x1800016fd
mov rbp, qword [r8]
lea rax, [rbp - 5]
cmp rax, rsi
je 0x18000174d
mov ebp, dword [r9 + rcx + 0x24]
and ebp, 0xf
test ebp, ebp
je 0x18000172b
lea rdi, [r9 + rcx]
add rdi, 0x30
mov rbx, qword [rdi - 0x20]
xor edx, edx
movzx eax, byte [rdi + rdx]
add rax, rbx
cmp rax, rsi
je 0x180001744
inc rdx
cmp rbp, rdx
jne 0x180001717
cmp rsi, qword [r9 + rcx + 8]
jne 0x18000176a
mov rbp, qword [r8]
jmp 0x18000174d
movzx ebp, byte [rdx + r8 + 0x30]
add rbp, qword [r9 + rcx + 0x10]
jmp 0x18000174d
movzx ebp, byte [rdx + r8 + 0x28]
add rbp, qword [r8]
test rbp, rbp
je 0x18000176a
mov qword [rsp + 0x148], rbp
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
inc r13
cmp r13, r14
jne 0x180001681
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r12
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + 0xc]
cmp r12, rax
jae 0x1800017d7
mov rax, qword [rcx]
jmp 0x180001612
mov r8, qword [rsi]
test r8, r8
je 0x1800017b7
mov rcx, qword [0x180065758]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsi], 0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r13d
add rsp, 0x528
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r13d, r13d
jmp 0x1800017c0