Function at 0x1400017f0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
movdqa xmm0, xmmword [0x140005ad0]
movdqu xmmword [rbp - 0x31], xmm0
movsd xmm0, qword [str.vgc.exe]
movsd qword [rbp - 0x41], xmm0
mov eax, dword [0x140005828]
mov dword [rbp - 0x39], eax
movzx eax, word [0x14000582c]
mov word [rbp - 0x35], ax
xor edi, edi
mov word [rbp - 0x33], di
lea rcx, [rbp - 0x41]
call fcn.1400011d0
mov r14d, eax
mov dword [rbp - 0x69], eax
mov rdx, qword [rbp - 0x29]
cmp rdx, 7
jbe 0x1400018a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400018a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003dfc
test r14d, r14d
je 0x140001cd8
mov r8d, r14d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rbp - 0x51], rax
test rax, rax
jne 0x140001908
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Failed_to_open_process_with_error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400023e0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400025c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140001cfb
xor edx, edx
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp - 0x49], rax
cmp rax, 0xffffffffffffffff
je 0x140001caa
mov dword [rbp - 0x41], 0x1c
lea rdx, [rbp - 0x41]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x140001c85
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov r15, rdi
mov qword [rbp - 9], rdi
movdqu xmmword [rbp - 1], xmm1
mov r12, rdi
mov qword [rbp + 0xf], rdi
movdqu xmmword [rbp + 0x17], xmm1
mov r13, rdi
mov qword [rbp + 0x27], rdi
mov rbx, qword [rbp - 0x11]
mov rdi, qword [rbp + 7]
mov rsi, qword [rbp + 0x1f]
cmp dword [rbp - 0x35], r14d
jne 0x140001a70
mov r8d, dword [rbp - 0x39]
xor edx, edx
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov r14, rax
mov qword [rbp - 0x61], rax
test rax, rax
je 0x140001a49
mov qword [rbp - 0x21], 0
lea rdx, [rbp - 0x21]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
test eax, eax
je 0x140001a40
cmp rbx, r15
je 0x1400019cc
mov qword [rbx], r14
add rbx, 8
mov qword [rbp - 0x11], rbx
jmp 0x1400019e4
lea r8, [rbp - 0x61]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.140002e50
mov r15, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
cmp rdi, r12
je 0x1400019fa
mov rax, qword [rbp - 0x21]
mov qword [rdi], rax
add rdi, 8
mov qword [rbp + 7], rdi
jmp 0x140001a12
lea r8, [rbp - 0x21]
mov rdx, rdi
lea rcx, [rbp - 1]
call fcn.140002e50
mov r12, qword [rbp + 0xf]
mov rdi, qword [rbp + 7]
cmp rsi, r13
je 0x140001a26
mov eax, dword [rbp - 0x39]
mov dword [rsi], eax
add rsi, 4
mov qword [rbp + 0x1f], rsi
jmp 0x140001a6c
lea r8, [rbp - 0x39]
mov rdx, rsi
lea rcx, [rbp + 0x17]
call fcn.140003180
mov r13, qword [rbp + 0x27]
mov rsi, qword [rbp + 0x1f]
jmp 0x140001a6c
lea rdx, str.Failed_to_query_cycle_time_for_thread.
jmp 0x140001a50
lea rdx, str.Failed_to_open_thread.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140002600
lea rdx, [0x1400027e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r14d, dword [rbp - 0x69]
lea rdx, [rbp - 0x41]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140001972
mov qword [rbp - 0x59], r13
mov qword [rbp - 0x61], r12
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov r13, rbx
mov r12, qword [rbp - 0x19]
sub r13, r12
sar r13, 3
mov r14, qword [rbp + 0x17]
test r13, r13
je 0x140001b7f
mov rdi, r12
mov rax, qword [rbp - 1]
sub rax, r12
mov r12, rax
nop dword [rax]
nop word [rax + rax]
mov qword [rbp - 0x21], 0
lea rdx, [rbp - 0x21]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
test eax, eax
je 0x140001b3b
mov rax, qword [rbp - 0x21]
cmp qword [rdi + r12], rax
jne 0x140001b6b
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x140001b32
lea rdx, str.Thread
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140002600
mov rcx, rax
mov edx, dword [r14 + rsi*4]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._suspended_due_to_no_active_cycle_delta.
call fcn.140002600
jmp 0x140001b5b
lea rdx, str.Failed_to_suspend_thread
jmp 0x140001b42
lea rdx, str.Failed_to_query_cycle_time_for_thread
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140002600
mov edx, dword [r14 + rsi*4]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400027e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
inc rsi
add rdi, 8
cmp rsi, r13
jb 0x140001ad0
mov r12, qword [rbp - 0x19]
mov rdi, r12
cmp r12, rbx
je 0x140001b99
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 8
cmp rdi, rbx
jne 0x140001b87
test r14, r14
je 0x140001be2
mov rdx, qword [rbp - 0x59]
sub rdx, r14
sar rdx, 2
lea rdx, [rdx*4]
mov rax, r14
cmp rdx, 0x1000
jb 0x140001bd9
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001bd9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.140003dfc
nop
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x140001c2c
mov rdx, qword [rbp - 0x61]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c26
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c26
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003dfc
nop
test r12, r12
je 0x140001c6c
sub r15, r12
and r15, 0xfffffffffffffff8
mov rax, r12
cmp r15, 0x1000
jb 0x140001c61
add r15, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c61
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r15
mov rcx, r12
call fcn.140003dfc
mov rbx, qword [rbp - 0x51]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001cfb
lea rdx, str.Failed_to_get_thread_snapshot.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140002600
mov rcx, rax
lea rdx, [0x1400027e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x140001c70
lea rdx, str.Failed_to_create_thread_snapshot.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140002600
mov rcx, rax
lea rdx, [0x1400027e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001cfb
lea rdx, str.Could_not_find_process:_vgc.exe
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140002600
mov rcx, rax
lea rdx, [0x1400027e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140003b60
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret