Function at 0x18000f1b0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x528
mov edi, r8d
mov dword [rsp + 0x2c], edx
mov rsi, rcx
mov rax, qword [0x18001c500]
xor rax, rsp
mov qword [rsp + 0x520], rax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov ecx, 4
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, 9
cmp rax, 0xffffffffffffffff
je 0x18000f54c
mov r14, rax
mov dword [rsp + 0x50], 0x1c
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x18000f543
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r15, [rsp + 0x50]
jmp 0x18000f287
mov dword [rsi + 8], 0x80
mov rcx, qword [0x18001c910]
mov r8d, 0x200
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsi], rax
test rax, rax
je 0x18000f543
mov ecx, dword [rsp + 0x58]
mov edx, dword [rsi + 0xc]
lea r8d, [rdx + 1]
mov dword [rsi + 0xc], r8d
mov dword [rax + rdx*4], ecx
nop
mov dword [rsp + 0x50], 0x1c
mov rcx, r14
mov rdx, r15
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x18000f2eb
cmp dword [rsp + 0x50], 0x10
jb 0x18000f270
mov r13d, dword [rsp + 0x5c]
call rbx
cmp r13d, eax
jne 0x18000f270
mov r13d, dword [rsp + 0x58]
call r12
cmp r13d, eax
je 0x18000f270
mov rax, qword [rsi]
test rax, rax
je 0x18000f235
mov r9d, dword [rsi + 8]
cmp dword [rsi + 0xc], r9d
jb 0x18000f25d
add r9d, r9d
mov dword [rsi + 8], r9d
shl r9, 2
mov rcx, qword [0x18001c910]
xor edx, edx
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x18000f525
mov qword [rsi], rax
jmp 0x18000f25d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x18000f525
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
cmp qword [rsi], 0
je 0x18000f54c
cmp dword [rsi + 0xc], 0
je 0x18000f54c
xor r12d, r12d
mov eax, dword [rsp + 0x2c]
mov ecx, eax
inc ecx
mov dword [rsp + 0x3c], ecx
cmove eax, r12d
mov qword [rsp + 0x40], rax
imul rax, rax, 0x38
add rax, 0x30
mov qword [rsp + 0x48], rax
jmp 0x18000f358
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r12
mov eax, dword [rsi + 0xc]
cmp r12, rax
jae 0x18000f572
mov rax, qword [rsi]
mov r8d, dword [rax + r12*4]
mov ecx, 0x5a
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
je 0x18000f349
mov r15, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [rsp + 0x80], 0x100001
mov rcx, r15
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x18000f340
mov eax, dword [rsp + 0x3c]
cmp dword [rsp + 0x2c], 0xffffffff
jne 0x18000f3ab
mov eax, dword [0x18001c924]
cmp dword [rsp + 0x40], eax
jae 0x18000f340
mov ebp, eax
mov rax, qword [0x18001c918]
mov rbx, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
mov qword [rsp + 0x30], r15
jmp 0x18000f3f0
mov rsi, r15
mov r15, qword [rsp + 0x30]
nop word cs:[rax + rax]
inc r13
add rbx, 0x38
cmp r13, rbp
je 0x18000f340
imul rcx, r13, 0x38
mov r9d, edi
test edi, edi
je 0x18000f41d
cmp edi, 1
jne 0x18000f410
mov r9d, 1
jmp 0x18000f41d
mov r9d, dword [rax + rcx + 0x20]
shr r9d, 2
and r9d, 1
mov r10d, dword [rax + rcx + 0x20]
bt r10d, 1
mov edx, r9d
sbb edx, 0
je 0x18000f3e0
lea r8, [rax + rcx]
mov rdx, qword [rsp + 0x148]
test r9d, r9d
je 0x18000f47b
mov r9d, dword [rax + rcx + 0x24]
and r9, 0xf
je 0x18000f3e0
mov r10, qword [r8]
lea r8, [rax + rbx]
xor r11d, r11d
nop word cs:[rax + rax]
movzx r14d, byte [r8 + r11 - 8]
add r14, r10
cmp r14, rdx
je 0x18000f4d5
inc r11
cmp r9, r11
jne 0x18000f460
jmp 0x18000f3e0
test r10b, 1
je 0x18000f48d
mov r9, qword [r8]
lea r10, [r9 - 5]
cmp r10, rdx
je 0x18000f4df
mov r15, rsi
mov r9d, dword [rax + rcx + 0x24]
and r9, 0xf
je 0x18000f4c5
mov r11, qword [rax + rcx + 0x10]
lea r10, [rax + rbx]
xor r14d, r14d
nop word [rax + rax]
movzx esi, byte [r10 + r14]
add rsi, r11
cmp rsi, rdx
je 0x18000f4e9
inc r14
cmp r9, r14
jne 0x18000f4b0
cmp rdx, qword [rax + rcx + 8]
jne 0x18000f3cb
mov r9, qword [r8]
jmp 0x18000f4f2
movzx r9d, byte [r11 + r8]
add r9, qword [rax + rcx + 0x10]
test r9, r9
jne 0x18000f503
jmp 0x18000f3e0
movzx r9d, byte [r14 + r10 - 8]
add r9, qword [r8]
mov rsi, r15
mov r15, qword [rsp + 0x30]
test r9, r9
je 0x18000f3e0
mov qword [rsp + 0x148], r9
mov rcx, r15
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rax, qword [0x18001c918]
jmp 0x18000f3e0
mov r8, qword [rsi]
test r8, r8
je 0x18000f543
mov rcx, qword [0x18001c910]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsi], 0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.1800143c0
mov eax, ebp
add rsp, 0x528
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ebp, ebp
jmp 0x18000f54c