Function at 0x14000db6c
Capabilities:
Resume thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x418]
sub rsp, 0x510
mov rax, qword [0x140011008]
xor rax, rsp
mov qword [rbp + 0x400], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1400116c8], eax
je 0x14000dbb7
mov eax, 0x10dd
jmp 0x14000de6b
cmp dword [0x1400116cc], 0
je 0x14000dbca
call fcn.14000da74
jmp 0x14000de65
mov rbx, qword [0x1400116b8]
test rbx, rbx
je 0x14000dce5
mov esi, 0x80000000
cmp dword [rbx + 8], 0
je 0x14000dc4c
mov rdx, qword [rbx + 0x20]
xor edi, edi
cmp byte [rdx + 0x1f], dil
jbe 0x14000dc22
and dword [rsp + 0x20], 0
movsxd rcx, edi
lea r9, [rsp + 0x20]
add rcx, qword [rbx + 0x18]
call fcn.14000e328
cmp dword [rsp + 0x20], 0
mov rdx, rax
jne 0x14000dc22
mov edi, eax
mov rax, qword [rbx + 0x20]
movzx ecx, byte [rax + 0x1f]
sub edi, dword [rbx + 0x20]
cmp edi, ecx
jl 0x14000dbf1
mov rax, qword [rbx + 0x20]
movzx ecx, byte [rax + 0x1f]
cmp edi, ecx
je 0x14000dc43
mov rax, qword [rbx + 0x10]
mov dword [0x1400116cc], 0xd
mov qword [0x1400116a0], rax
mov rax, qword [rbx + 0x18]
jmp 0x14000dcd2
mov rax, qword [rbx + 0x20]
lea rcx, [rax + 0x30]
lea rdx, [rax + 0x28]
mov word [rcx], 0x25ff
lea rax, [rcx + 6]
sub edx, eax
mov dword [rcx + 2], edx
mov rdx, qword [rbx + 0x20]
cmp rdx, rsi
jge 0x14000dc9f
mov rcx, qword [rbx + 0x18]
cmp rdx, rcx
jbe 0x14000dc80
mov rax, rdx
sub rax, rcx
jmp 0x14000dc86
mov rax, rcx
sub rax, rdx
cmp rax, rsi
jl 0x14000dc9f
mov byte [rcx], 0x68
lea rax, [rdx + 0x30]
add rcx, 6
mov dword [rcx - 5], eax
mov byte [rcx - 1], 0xc3
jmp 0x14000dcb7
lea rcx, [rdx + 0x30]
mov rdx, qword [rbx + 0x18]
lea rax, [rdx + 5]
mov byte [rdx], 0xe9
sub ecx, eax
mov dword [rdx + 1], ecx
lea rcx, [rdx + 5]
mov rax, qword [rbx + 0x20]
mov r8, qword [rax + 0x20]
cmp rcx, r8
jae 0x14000dcce
sub r8, rcx
mov dl, 0xcc
call sub.msvcrt.dll_memset
mov rax, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x10]
mov qword [rcx], rax
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000dbdf
mov rdi, qword [0x1400116a8]
jmp 0x14000dd86
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x60], 0x100001
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14000dd83
mov rbx, qword [0x1400116b8]
test rbx, rbx
je 0x14000dd83
mov rdx, qword [rbp + 0x28]
cmp dword [rbx + 8], 0
je 0x14000dd41
mov rcx, qword [rbx + 0x20]
cmp rdx, rcx
jb 0x14000dd7b
lea rax, [rcx + 8]
cmp rdx, rax
jae 0x14000dd7b
sub rdx, rcx
mov qword [rbp + 0x28], rdx
add rdx, qword [rbx + 0x18]
jmp 0x14000dd64
cmp rdx, qword [rbx + 0x18]
jb 0x14000dd7b
mov rax, qword [rbx + 0x20]
movzx ecx, byte [rax + 0x1f]
add rcx, qword [rbx + 0x18]
cmp rdx, rcx
jae 0x14000dd7b
sub rdx, qword [rbx + 0x18]
mov qword [rbp + 0x28], rdx
add rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 8]
mov qword [rbp + 0x28], rdx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rdx, qword [rbp + 0x28]
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000dd1c
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14000dcf1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, qword [0x1400116b8]
mov r14, rax
test rdi, rdi
je 0x14000de20
mov rcx, qword [rdi + 0x20]
mov r8d, dword [rdi + 0x28]
lea r9, [rsp + 0x20]
movzx edx, byte [rcx + 0x1f]
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
movzx r8d, byte [rax + 0x1f]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp dword [rdi + 8], 0
je 0x14000de0d
mov rsi, qword [rdi + 0x20]
test rsi, rsi
je 0x14000de0d
xor edx, edx
mov rbx, rsi
mov rcx, rsi
lea r8d, [rdx + 0x38]
and rbx, 0xffffffffffff0000
call sub.msvcrt.dll_memset
mov rax, qword [rbx + 0x10]
mov qword [rsi + 0x20], rax
mov qword [rbx + 0x10], rsi
and qword [rdi + 0x20], 0
mov rbx, qword [rdi]
mov rcx, rdi
call fcn.14000423c
mov rdi, rbx
test rbx, rbx
jne 0x14000dda4
and qword [0x1400116b8], 0
call fcn.14000d508
mov rdi, qword [0x1400116a8]
test rdi, rdi
je 0x14000de56
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rdi]
mov rcx, rdi
call fcn.14000423c
mov rdi, rbx
test rbx, rbx
jne 0x14000de39
and qword [0x1400116a8], 0
and dword [0x1400116c8], 0
mov eax, dword [0x1400116cc]
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.14000faa0
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret