Function at 0x140001070
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x80
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x98], rbx
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], rdi
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x50], rax
xorps xmm0, xmm0
mov r15d, edx
mov rsi, rcx
xor eax, eax
xor edx, edx
mov qword [rbp + 0x40], rax
xor ecx, ecx
mov ebx, r8d
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcessHeaps]
mov ecx, eax
shl rcx, 3
mov edi, eax
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1400010e8
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140002c80
sub rsp, rax
mov ecx, edi
lea r14, [rsp + 0x20]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessHeaps]
mov r13d, eax
test ebx, ebx
je 0x140001226
rdrand eax
mov byte [rsi], al
xor ebx, ebx
rdrand eax
mov byte [rsi + 1], al
rdrand eax
mov byte [rsi + 2], al
rdrand eax
mov byte [rsi + 3], al
rdrand eax
mov byte [rsi + 4], al
rdrand eax
mov byte [rsi + 5], al
rdrand eax
mov byte [rsi + 6], al
rdrand eax
mov byte [rsi + 7], al
rdrand eax
mov byte [rsi + 8], al
rdrand eax
mov byte [rsi + 9], al
rdrand eax
mov byte [rsi + 0xa], al
rdrand eax
mov byte [rsi + 0xb], al
rdrand eax
mov byte [rsi + 0xc], al
rdrand eax
mov byte [rsi + 0xd], al
rdrand eax
mov byte [rsi + 0xe], al
rdrand eax
mov byte [rsi + 0xf], al
mov qword [rbp], 0x1c
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], rbx
mov dword [rbp + 0x18], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14000138a
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x14000138a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp + 0xc], eax
jne 0x140001210
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [rbp + 8]
cmp edx, eax
je 0x140001210
cmp edx, r15d
je 0x140001210
lea rcx, str.___Suspend_ThreadId:__ld_n
call fcn.140001010
mov r8d, dword [rbp + 8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x1400012d5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1400011b8
jmp 0x1400012d5
xor ebx, ebx
mov qword [rbp], 0x1c
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], rbx
mov dword [rbp + 0x18], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14000138a
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x14000138a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp + 0xc], eax
jne 0x1400012c4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [rbp + 8]
cmp edx, eax
je 0x1400012c4
cmp edx, r15d
je 0x1400012c4
lea rcx, str.___Resume_ThreadId:__ld_n
call fcn.140001010
mov r8d, dword [rbp + 8]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x1400012d5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140001270
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13d, r13d
je 0x14000138a
mov r15, r13
nop word [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp qword [r14], rax
je 0x14000137c
xor eax, eax
lea rdi, [rbp + 0x20]
mov ecx, 0x28
lea rdx, [rbp + 0x20]
rep stosb byte [rdi], al
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_HeapWalk]
test eax, eax
je 0x14000137c
nop dword [rax]
test byte [rbp + 0x2e], 4
je 0x14000136b
mov r8d, dword [rbp + 0x28]
mov rax, rbx
mov r9, qword [rbp + 0x20]
mov rdi, rbx
test r8, r8
je 0x14000136b
nop dword [rax]
cmp rax, 0x10
mov rdx, rbx
cmovne rdx, rax
movzx eax, byte [rdx + rsi]
xor al, byte [r9 + rdi]
test dil, 1
je 0x14000135b
xor al, dl
mov byte [r9 + rdi], al
inc rdi
lea rax, [rdx + 1]
cmp rdi, r8
jb 0x140001340
mov rcx, qword [r14]
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapWalk]
test eax, eax
jne 0x140001320
add r14, 8
sub r15, 1
jne 0x1400012f0
mov rcx, qword [rbp + 0x50]
xor rcx, rbp
call fcn.140001e80
mov rbx, qword [rbp + 0x98]
mov rsi, qword [rbp + 0xa0]
mov rdi, qword [rbp + 0xa8]
lea rsp, [rbp + 0x60]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret