Function at 0x140018f00
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0xd60
xor edi, edi
xor bl, bl
mov r14, r9
mov r13d, r8d
mov r12, rcx
mov ebp, edi
mov byte [rsp + 0x50], bl
test rdx, rdx
jne 0x140018f55
mov r8, rcx
lea rcx, [rsp + 0xd98]
mov edx, 0x410
call sym.ProcessHacker.exe_PhOpenThreadProcess
mov ebp, eax
test eax, eax
js 0x14001957b
mov byte [rsp + 0x50], 1
xor edx, edx
mov rcx, r12
mov qword [rsp + 0xd90], rsi
mov qword [rsp + 0xda0], r15
call qword [sym.imp.ntdll.dll_NtSuspendThread]
mov r15, qword [rsp + 0xdb0]
test eax, eax
movzx ecx, bl
mov edx, 1
cmovns ecx, edx
mov dword [rsp + 0x58], ecx
test r13b, 0x10
je 0x1400190af
mov rcx, qword [0x1400d62b8]
test rcx, rcx
je 0x1400190b6
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 0x28
lea rax, [rsp + 0xb70]
mov dword [rsp + 0x78], edx
xor r9d, r9d
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x54]
xor r8d, r8d
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1a0]
mov dword [rsp + 0x28], 0x999921a8
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x7c], 0x3d
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x1400190af
xor eax, eax
mov ebx, edi
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rax
cmp dword [rsp + 0x54], eax
jbe 0x1400190af
lea rdi, [rsp + 0xb70]
nop dword [rax]
mov rax, qword [rdi]
lea rcx, [rsp + 0xa0]
mov rdx, r15
mov qword [rsp + 0xa0], rax
call r14
test al, al
je 0x140019542
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x54]
jb 0x140019080
xor edi, edi
mov rcx, qword [0x1400d62b8]
test r13b, 2
je 0x14001932b
mov dword [rsp + 0x6d0], 0x10001f
test rcx, rcx
je 0x140019124
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 0x10
lea rax, [rsp + 0x6a0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x190]
mov dword [rsp + 0x28], 0x999921a0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x60], r12
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov ebp, eax
jmp 0x140019137
lea rdx, [rsp + 0x6a0]
mov rcx, r12
call qword [sym.imp.ntdll.dll_NtGetContextThread]
mov ebp, eax
test ebp, ebp
js 0x14001932b
lea rcx, [rsp + 0x1b0]
xor edx, edx
mov r8d, 0x108
call fcn.14009e740
mov rax, qword [rsp + 0x798]
mov dword [rsp + 0x1bc], 3
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x738]
mov dword [rsp + 0x1ec], 3
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x740]
mov dword [rsp + 0x1dc], 3
mov qword [rsp + 0x1d0], rax
nop word [rax + rax]
cmp qword [0x1400d8470], 0
mov rbx, qword [rsp + 0xd98]
je 0x14001932b
mov rdi, qword [0x1400d84d8]
mov rsi, qword [0x1400d8488]
lock bts qword [0x1400d8478], 0
jae 0x1400191ec
lea rcx, [0x1400d8478]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x6a0]
xor edi, edi
lea r9, [rsp + 0x1b0]
mov r8, r12
mov rdx, rbx
mov ecx, 0x8664
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [0x1400d8470]
mov ebx, eax
or rcx, 0xffffffffffffffff
lock xadd qword [0x1400d8478], rcx
test cl, 2
je 0x14001926e
mov rax, qword [0x1400d8478]
test al, 2
je 0x14001926e
test al, 4
jne 0x14001926e
test al, 1
jne 0x14001926e
lea rdx, [rax + 4]
lock cmpxchg qword [0x1400d8478], rdx
jne 0x14001926e
lea rcx, [0x1400d8478]
call fcn.14001eb50
test bl, bl
je 0x14001932b
mov rax, qword [rsp + 0x1b0]
test rax, rax
je 0x14001932b
cmp rax, 0xffffffffffffffff
je 0x14001932b
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x1c0]
lea rcx, [rsp + 0x208]
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x1d0]
mov rdx, r15
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x160], rax
mov rax, qword [rcx]
mov qword [rsp + 0x168], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x170], rax
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x178], rax
mov rax, qword [rcx + 0x18]
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x180], rax
call r14
test al, al
jne 0x1400191b0
jmp 0x140019542
test r13b, 1
je 0x140019542
lea r8, [rsp + 0x3d0]
mov r9d, 0x2cc
mov edx, 0x1d
mov rcx, r12
mov dword [rsp + 0x3d0], 0x1003f
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
mov ebp, eax
test eax, eax
js 0x140019542
lea rcx, [rsp + 0x2c0]
xor edx, edx
mov r8d, 0x108
call fcn.14009e740
mov eax, dword [rsp + 0x488]
mov dword [rsp + 0x2cc], 3
mov qword [rsp + 0x2c0], rax
mov eax, dword [rsp + 0x494]
mov dword [rsp + 0x2fc], 3
mov qword [rsp + 0x2f0], rax
mov eax, dword [rsp + 0x484]
mov dword [rsp + 0x2ec], 3
mov qword [rsp + 0x2e0], rax
nop
cmp qword [0x1400d8470], 0
mov rbx, qword [rsp + 0xd98]
je 0x140019542
mov rdi, qword [0x1400d84d8]
mov rsi, qword [0x1400d8488]
lock bts qword [0x1400d8478], 0
jae 0x14001940c
lea rcx, [0x1400d8478]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
xor eax, eax
lea r9, [rsp + 0x2c0]
mov r8, r12
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3d0]
mov rdx, rbx
mov ecx, 0x14c
mov qword [rsp + 0x20], rax
call qword [0x1400d8470]
or rcx, 0xffffffffffffffff
mov ebx, eax
lock xadd qword [0x1400d8478], rcx
test cl, 2
je 0x14001948a
mov rax, qword [0x1400d8478]
test al, 2
je 0x14001948a
test al, 4
jne 0x14001948a
test al, 1
jne 0x14001948a
lea rdx, [rax + 4]
lock cmpxchg qword [0x1400d8478], rdx
jne 0x14001948a
lea rcx, [0x1400d8478]
call fcn.14001eb50
test bl, bl
je 0x140019542
mov rax, qword [rsp + 0x2c0]
test rax, rax
je 0x140019542
cmp rax, 0xffffffffffffffff
je 0x140019542
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x2d0]
lea rcx, [rsp + 0x318]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x2e0]
mov rdx, r15
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x2f0]
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x110], rax
mov rax, qword [rcx]
mov qword [rsp + 0x118], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x120], rax
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x128], rax
mov rax, qword [rcx + 0x18]
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0x130], rax
call r14
test al, al
jne 0x1400193d0
cmp byte [rsp + 0x58], 0
mov r15, qword [rsp + 0xda0]
mov rsi, qword [rsp + 0xd90]
je 0x140019564
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntdll.dll_NtResumeThread]
cmp byte [rsp + 0x50], 0
je 0x140019579
mov rcx, qword [rsp + 0xd98]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebp
mov rbx, qword [rsp + 0xda8]
add rsp, 0xd60
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret