Function at 0x140123570
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x538
mov r15d, r8d
mov dword [rsp + 0x2c], edx
mov rax, qword [0x1403295b8]
xor rax, rsp
mov qword [rsp + 0x530], rax
xorps xmm0, xmm0
mov qword [rsp + 0x30], rcx
movups xmmword [rcx], xmm0
mov ecx, 4
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13d, 9
cmp rax, 0xffffffffffffffff
je 0x14012392b
mov rbp, rax
mov dword [rsp + 0x60], Ordinal_32
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x140123922
mov r14, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rbx, [rsp + 0x60]
jmp 0x140123657
mov dword [rsi + 8], 0x80
mov rcx, qword [0x140335678]
mov r8d, 0x200
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, qword [rsp + 0x30]
mov qword [rsi], rax
test rax, rax
je 0x140123922
mov ecx, dword [rsp + 0x68]
mov edx, dword [rsi + 0xc]
lea edi, [rdx + 1]
mov dword [rsi + 0xc], edi
mov dword [rax + rdx*4], ecx
nop word cs:[rax + rax]
mov dword [rsp + 0x60], Ordinal_32
mov rcx, rbp
mov rdx, rbx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
je 0x1401236bd
cmp dword [rsp + 0x60], 0x10
jb 0x140123640
mov edi, dword [rsp + 0x6c]
call r14
cmp edi, eax
jne 0x140123640
mov edi, dword [rsp + 0x68]
call r12
cmp edi, eax
je 0x140123640
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsi]
test rax, rax
je 0x1401235f8
mov r9d, dword [rsi + 8]
cmp dword [rsi + 0xc], r9d
jb 0x140123625
add r9d, r9d
mov dword [rsi + 8], r9d
shl r9, 2
mov rcx, qword [0x140335678]
xor edx, edx
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x140123904
mov qword [rsi], rax
jmp 0x140123625
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
mov rsi, qword [rsp + 0x30]
jne 0x140123904
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r13d, r13d
cmp qword [rsi], 0
je 0x14012392b
mov rcx, rsi
cmp dword [rsi + 0xc], 0
je 0x14012392b
xor esi, esi
mov eax, dword [rsp + 0x2c]
mov edx, eax
inc edx
mov dword [rsp + 0x3c], edx
cmove eax, esi
mov qword [rsp + 0x40], rax
imul rax, rax, 0x38
add rax, 0x30
mov qword [rsp + 0x50], rax
jmp 0x140123744
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x58]
inc rsi
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + 0xc]
cmp rsi, rax
jae 0x140123952
mov rax, qword [rcx]
mov r8d, dword [rax + rsi*4]
mov ecx, 0x5a
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
je 0x140123730
mov rdi, rax
mov qword [rsp + 0x58], rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [rsp + 0x90], 0x100001
mov qword [rsp + 0x48], rdi
mov rcx, rdi
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140123720
mov eax, dword [rsp + 0x3c]
cmp dword [rsp + 0x2c], 0xffffffff
jne 0x1401237a1
mov eax, dword [0x14033568c]
cmp dword [rsp + 0x40], eax
jae 0x140123720
mov r12d, eax
mov r9, qword [0x140335680]
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x40]
jmp 0x1401237e0
inc r13
add r14, 0x38
cmp r13, r12
je 0x140123720
imul rcx, r13, 0x38
mov edi, r15d
test r15d, r15d
je 0x14012380b
cmp r15d, 1
jne 0x140123800
mov edi, 1
jmp 0x14012380b
mov edi, dword [r9 + rcx + 0x20]
shr edi, 2
and edi, 1
mov ebp, dword [r9 + rcx + 0x20]
bt ebp, 1
mov edx, edi
sbb edx, 0
je 0x1401237d0
lea r8, [r9 + rcx]
mov rdx, qword [rsp + 0x158]
test edi, edi
je 0x14012385a
mov ebp, dword [r9 + rcx + 0x24]
and rbp, 0xf
je 0x1401237d0
mov rdi, qword [r8]
lea rbx, [r9 + r14]
xor esi, esi
nop
movzx eax, byte [rbx + rsi - 8]
add rax, rdi
cmp rax, rdx
je 0x1401238bc
inc rsi
cmp rbp, rsi
jne 0x140123840
jmp 0x1401237d0
test bpl, 1
je 0x14012386c
mov rbp, qword [r8]
lea rax, [rbp - 5]
cmp rax, rdx
je 0x1401238c5
mov ebp, dword [r9 + rcx + 0x24]
and rbp, 0xf
je 0x1401238a4
mov rbx, qword [r9 + rcx + 0x10]
lea rdi, [r9 + r14]
xor esi, esi
nop word cs:[rax + rax]
movzx eax, byte [rdi + rsi]
add rax, rbx
cmp rax, rdx
je 0x1401238f2
inc rsi
cmp rbp, rsi
jne 0x140123890
cmp rdx, qword [r9 + rcx + 8]
jne 0x1401237d0
mov rbp, qword [r8]
test rbp, rbp
jne 0x1401238ce
jmp 0x1401237d0
movzx ebp, byte [rsi + rbx]
add rbp, qword [r9 + rcx + 0x10]
test rbp, rbp
je 0x1401237d0
mov qword [rsp + 0x158], rbp
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov r9, qword [0x140335680]
jmp 0x1401237d0
movzx ebp, byte [rsi + rdi - 8]
add rbp, qword [r8]
test rbp, rbp
jne 0x1401238ce
jmp 0x1401237d0
mov r8, qword [rsi]
test r8, r8
je 0x140123922
mov rcx, qword [0x140335678]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsi], 0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.140141380
mov eax, r13d
add rsp, 0x538
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r13d, r13d
jmp 0x14012392b