Function at 0x18002bc30
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x180131db0], eax
je 0x18002bc4c
mov eax, 0x10dd
jmp 0x18002bd6b
mov rax, qword [0x180131da0]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18002bcf3
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x18002bcc2
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x18002bcc2
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.18002b9e0
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x18002bc58
mov qword [0x180131da0], 0
call fcn.18002b320
mov rax, qword [0x180131d90]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18002bd54
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x18002bd0f
mov qword [0x180131d90], 0
mov dword [0x180131db0], 0
xor eax, eax
add rsp, 0x68
ret

Function at 0x18002c300
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x180131db4], 0
je 0x18002c31d
mov eax, dword [0x180131db4]
jmp 0x18002c3e3
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp qword [rsp + 0x50], rax
jne 0x18002c331
xor eax, eax
jmp 0x18002c3e3
mov ecx, 0x10
call qword [sym.imp.MSVCR120.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18002c39c
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x18002c381
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x180131db4], eax
mov qword [0x180131d88], 0
mov eax, dword [rsp + 0x20]
jmp 0x18002c3e3
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x18002c3b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x18002c35b
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x180131d90]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x180131d90], rax
xor eax, eax
add rsp, 0x48
ret