Function at 0x140001070
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x80
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x98], rbx
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], rdi
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x50], rax
xorps xmm0, xmm0
mov r12d, edx
mov rsi, rcx
xor eax, eax
xor edx, edx
mov qword [rbp + 0x40], rax
xor ecx, ecx
mov ebx, r8d
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcessHeaps]
mov ecx, eax
shl rcx, 3
mov edi, eax
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1400010e8
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140002b80
sub rsp, rax
mov ecx, edi
lea r14, [rsp + 0x20]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessHeaps]
mov r13d, eax
test ebx, ebx
je 0x140001251
xor ebx, ebx
mov ecx, ebx
mov edx, ebx
nop word [rax + rax]
rdrand eax
mov byte [rdx + rsi], al
lea rdx, [rdx + 0x10]
rdrand eax
mov byte [rdx + rsi - 0xf], al
add ecx, 0x10
rdrand eax
mov byte [rdx + rsi - 0xe], al
rdrand eax
mov byte [rdx + rsi - 0xd], al
rdrand eax
mov byte [rdx + rsi - 0xc], al
rdrand eax
mov byte [rdx + rsi - 0xb], al
rdrand eax
mov byte [rdx + rsi - 0xa], al
rdrand eax
mov byte [rdx + rsi - 9], al
rdrand eax
mov byte [rdx + rsi - 8], al
rdrand eax
mov byte [rdx + rsi - 7], al
rdrand eax
mov byte [rdx + rsi - 6], al
rdrand eax
mov byte [rdx + rsi - 5], al
rdrand eax
mov byte [rdx + rsi - 4], al
rdrand eax
mov byte [rdx + rsi - 3], al
rdrand eax
mov byte [rdx + rsi - 2], al
rdrand eax
mov byte [rdx + rsi - 1], al
cmp ecx, 0x10
jb 0x140001120
mov qword [rbp], 0x1c
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], rbx
mov dword [rbp + 0x18], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400013ac
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1400013ac
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp + 0xc], eax
jne 0x14000123b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [rbp + 8]
cmp edx, eax
je 0x14000123b
cmp edx, r12d
je 0x14000123b
lea rcx, str.___Suspend_ThreadId:__ld_n
call fcn.140001010
mov r8d, dword [rbp + 8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x140001303
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1400011e3
jmp 0x140001303
xor ebx, ebx
mov qword [rbp], 0x1c
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], rbx
mov dword [rbp + 0x18], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400013ac
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1400013ac
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp + 0xc], eax
jne 0x1400012f2
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [rbp + 8]
cmp edx, eax
je 0x1400012f2
cmp edx, r12d
je 0x1400012f2
lea rcx, str.___Resume_ThreadId:__ld_n
call fcn.140001010
mov r8d, dword [rbp + 8]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x140001303
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1400012a0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13d, r13d
je 0x1400013ac
mov r15, r13
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp qword [r14], rax
je 0x14000139e
xor eax, eax
lea rdi, [rbp + 0x20]
mov ecx, 0x28
lea rdx, [rbp + 0x20]
rep stosb byte [rdi], al
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_HeapWalk]
test eax, eax
je 0x14000139e
test byte [rbp + 0x2e], 4
je 0x14000138d
mov r9d, dword [rbp + 0x28]
mov rax, rbx
mov r10, qword [rbp + 0x20]
mov rdi, rbx
test r9, r9
je 0x14000138d
nop word [rax + rax]
cmp rax, 0x10
lea r8, [r10 + rdi]
mov rdx, rbx
cmovne rdx, rax
movzx eax, byte [rdx + rsi]
xor al, byte [r8]
test dil, 1
je 0x14000137e
xor al, dl
inc rdi
mov byte [r8], al
lea rax, [rdx + 1]
cmp rdi, r9
jb 0x140001360
mov rcx, qword [r14]
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapWalk]
test eax, eax
jne 0x140001341
add r14, 8
sub r15, 1
jne 0x140001318
mov rcx, qword [rbp + 0x50]
xor rcx, rbp
call fcn.140001ea0
mov rbx, qword [rbp + 0x98]
mov rsi, qword [rbp + 0xa0]
mov rdi, qword [rbp + 0xa8]
lea rsp, [rbp + 0x60]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret