Function at 0x140041124
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2d8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x240], xmm6
mov qword [rbp + 0x238], 0xfffffffffffffffe
mov byte [rbp + 0x237], dl
and qword [rbp + 0x208], 0
mov qword [rbp + 0x220], rcx
mov rax, qword [rcx]
mov qword [rbp + 0x200], rax
mov ecx, 0x4000
call fcn.14005cb00
lea r15, [rbp + 0x208]
mov rcx, r15
mov rdx, rax
call fcn.140017316
xor esi, esi
mov edi, 0x4000
push 5
pop r12
lea r13, [rbp + 0x160]
mov r14d, 0x1000
cmp esi, 0x14
je 0x140041290
mov rdx, qword [rbp + 0x208]
mov ecx, r12d
mov r8d, edi
mov r9, r13
call fcn.140014484
mov ebx, eax
cmp eax, 0xc0000023
je 0x1400411d3
cmp ebx, 0xc0000004
jne 0x1400411fd
mov edi, dword [rbp + 0x160]
add edi, r14d
mov rcx, r15
xor edx, edx
call fcn.140017316
mov rcx, rdi
call fcn.14005cb00
mov rcx, r15
mov rdx, rax
call fcn.140017316
inc esi
jmp 0x1400411a4
test ebx, ebx
js 0x140041290
mov r12, qword [rbp + 0x208]
mov rcx, qword [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov esi, eax
mov rcx, qword [rbp + 0x220]
cmp dword [r12 + 0x50], esi
je 0x1400412f9
mov eax, dword [r12]
add r12, rax
test rax, rax
jne 0x140041222
mov dword [rsp + 0x20], 2
lea rdx, str.process_types::SYSTEM_PROCESS_INFORMATION_Traits____cdecl_crashpad::_anonymous_namespace_::GetProcessInformation_HANDLE__std::unique_ptr_uint8_t_______Traits__crashpad::process_types::internal::Traits64_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_process_reader_win.cc
lea rcx, [rbp + 0x40]
push 0x70
pop r9
call fcn.14004b54e
lea rdx, str.process
lea rcx, [rbp + 0x40]
call fcn.140002bc9
mov rcx, rax
mov edx, esi
call fcn.14000f1d2
lea rdx, str._not_found
mov rcx, rax
call fcn.140002bc9
lea rcx, [rbp + 0x40]
call fcn.14004ba62
jmp 0x1400412d2
mov dword [rsp + 0x20], 2
lea rdx, str.process_types::SYSTEM_PROCESS_INFORMATION_Traits____cdecl_crashpad::_anonymous_namespace_::GetProcessInformation_HANDLE__std::unique_ptr_uint8_t_______Traits__crashpad::process_types::internal::Traits64_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_process_reader_win.cc
lea rcx, [rbp + 0x40]
push 0x5e
pop r9
call fcn.14004b54e
lea rcx, [rbp + 0x40]
mov dword [rcx + 0x100], ebx
lea rdx, [0x140096c81]
call fcn.140002bc9
lea rcx, [rbp + 0x40]
call fcn.1400149d0
lea rcx, [rbp + 0x208]
call fcn.14000a7ae
movaps xmm6, xmmword [rbp + 0x240]
add rsp, 0x2d8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rax, [rcx + 0x98]
mov qword [rbp + 0x1e0], rax
lea rax, [rcx + 0x140]
mov qword [rbp + 0x218], rax
xorps xmm6, xmm6
lea rbx, [rbp + 0x40]
lea r15, [rbp - 0x48]
xor r14d, r14d
cmp r14d, dword [r12 + 4]
jae 0x1400412d2
mov eax, r14d
imul rdi, rax, 0x50
and qword [rbp + 0x160], 0
mov byte [rbp + 0x168], 0
lea rax, [rbp + 0x170]
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax], xmm6
mov qword [rbp + 0x1a0], 0xf
movups xmmword [rax + 0x5c], xmm6
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
lea r9, [r12 + rdi + 0x128]
mov rax, qword [r9 + 8]
mov qword [rbp + 0x1a8], rax
mov dword [rbp + 8], 0x30
lea rax, [rbp + 0x10]
movups xmmword [rax], xmm6
and dword [rax + 0x10], 0
movups xmmword [rax + 0x18], xmm6
lea rcx, [rbp - 0x28]
push 0x4a
pop rdx
lea r8, [rbp + 8]
call fcn.140014900
mov esi, eax
test eax, eax
js 0x1400414e3
mov r13, qword [rbp - 0x28]
mov qword [rbp + 0x210], r13
test r13, r13
je 0x140041d3e
mov rax, qword [rbp + 0x220]
mov bl, byte [rax + 0x170]
mov rax, qword [rbp + 0x1a8]
mov rcx, qword gs:[0x30]
cmp rax, qword [rcx + 0x48]
jne 0x14004152f
and dword [rbp + 0x1d0], 0
mov edx, 0x4d0
lea rcx, [rbp + 0x170]
call fcn.140032c12
mov byte [rbp + 0x168], 1
mov rcx, qword [rbp + 0x170]
add rcx, qword [rbp + 0x160]
call section..text
lea rax, [r12 + rdi]
add rax, 0x100
mov dword [rbp + 0x1d4], 0x20
mov eax, dword [rax + 0x38]
mov dword [rbp + 0x1d8], eax
mov rcx, qword [rbp + 0x210]
and qword [rsp + 0x20], 0
xor edx, edx
lea r8, [rbp - 0x28]
push 0x30
pop r9
call fcn.140014551
mov esi, eax
test eax, eax
js 0x1400415be
mov rdx, qword [rbp - 0x20]
mov qword [rbp + 0x1b0], rdx
mov qword [rbp + 0x1b8], 0x1788
mov rcx, qword [rbp + 0x1e0]
push 0x38
pop r8
lea r9, [rbp + 8]
call fcn.14000cf84
test al, al
lea r9, [rbp + 0x40]
je 0x1400418af
cmp byte [rbp + 0x237], 0
je 0x14004182b
mov rdx, qword [rbp + 8]
mov qword [rbp + 0x1b0], rdx
mov qword [rbp + 0x1b8], 0xf98
mov rcx, qword [rbp + 0x1e0]
push 0x1c
pop r8
call fcn.14000cf84
mov esi, dword [rbp + 0x44]
mov ebx, dword [rbp + 0x48]
test al, al
mov eax, 0
cmove rsi, rax
cmove rbx, rax
lea r9, [rbp + 0x40]
jmp 0x140041833
mov dword [rsp + 0x20], 2
mov rcx, rbx
lea rdx, str.HANDLE___cdecl_crashpad::_anonymous_namespace_::OpenThread_const_process_types::SYSTEM_THREAD_INFORMATION_Traits_____Traits__crashpad::process_types::internal::Traits64_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_process_reader_win.cc
push 0x7f
pop r9
call fcn.14004b54e
mov dword [rbp + 0x140], esi
mov rcx, rbx
lea rdx, [0x1400979ae]
call fcn.140002bc9
mov rcx, rbx
call fcn.1400149d0
and qword [rbp + 0x210], 0
jmp 0x140041d3e
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x140041609
test bl, bl
je 0x140041654
test eax, eax
jne 0x140041654
mov dword [rsp + 0x20], 1
lea rcx, [rbp + 0x40]
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::FillThreadContextAndSuspendCount_HANDLE__ProcessReaderWin::Thread___crashpad::ProcessSuspensionState__bool___Traits__crashpad::process_types::internal::Traits64_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0xa0
call fcn.14004b54e
lea rcx, [rbp + 0x40]
lea rdx, str.Thread
call fcn.140002bc9
mov rdx, qword [rbp + 0x1a8]
mov rcx, rax
call fcn.14000aad6
mov rcx, rax
lea rdx, str._should_be_suspended__but_previous_suspend_count_is
call fcn.140002bc9
mov rcx, rax
xor edx, edx
call fcn.14000f1d2
lea rcx, [rbp + 0x40]
call fcn.14004ba62
xor eax, eax
jmp 0x140041659
mov dword [rsp + 0x20], 2
lea rcx, [rbp + 0x40]
lea rdx, str.void___cdecl_crashpad::ProcessReaderWin::ReadThreadData_bool___Traits__crashpad::process_types::internal::Traits64_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0x1aa
call fcn.14004b54e
mov dword [rbp + 0x140], esi
lea rsi, [rbp + 0x40]
mov rcx, rsi
lea rdx, [0x140097993]
call fcn.140002bc9
mov rcx, rsi
call fcn.1400149d0
jmp 0x140041d3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rsp + 0x20], 2
lea rcx, [rbp + 0x40]
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::FillThreadContextAndSuspendCount_HANDLE__ProcessReaderWin::Thread___crashpad::ProcessSuspensionState__bool___Traits__crashpad::process_types::internal::Traits64_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0x9b
call fcn.14004b54e
mov dword [rbp + 0x140], esi
lea rsi, [rbp + 0x40]
mov rcx, rsi
lea rdx, [0x1400979d5]
call fcn.140002bc9
jmp 0x140041d36
movzx ecx, bl
sub eax, ecx
mov dword [rbp + 0x1d0], eax
cmp byte [rbp + 0x237], 0
je 0x1400416f9
mov edx, 0x2cc
lea rcx, [rbp + 0x170]
call fcn.140032c12
mov byte [rbp + 0x168], 1
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x170]
lea rdx, [rcx + rax]
mov dword [rcx + rax], 0x10001f
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
jne 0x140041b22
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rsp + 0x20], 2
lea rcx, [rbp + 0x40]
lea rdx, str.bool___cdecl_crashpad::ProcessReaderWin::ThreadContext::InitializeWow64_HANDLE_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0xe3
call fcn.14004b54e
mov dword [rbp + 0x140], esi
lea rsi, [rbp + 0x40]
mov rcx, rsi
lea rdx, [0x140095d6c]
call fcn.140002bc9
jmp 0x140041d36
mov ecx, 0x800
call fcn.14003a461
test al, al
je 0x140041adf
mov eax, dword [0x1400c50c0]
mov ecx, dword [0x1400c3824]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140041da9
mov rbx, qword [0x1400c50b8]
test rbx, rbx
je 0x140041d3e
and qword [rbp + 8], 0
and dword [rbp - 0x28], 0
mov qword [rsp + 0x20], 0x800
xor ecx, ecx
mov edx, 0x10005f
lea r8, [rbp + 8]
lea r9, [rbp - 0x28]
call rbx
test eax, eax
jne 0x140041776
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140041cf0
mov edx, dword [rbp - 0x28]
lea rcx, [rbp + 0x170]
call fcn.140032c12
mov rax, qword [0x1400c50b8]
mov rcx, qword [rbp + 0x170]
mov qword [rsp + 0x20], 0x800
mov edx, 0x10005f
lea r8, [rbp + 8]
lea r9, [rbp - 0x28]
call rax
test eax, eax
je 0x140041ca8
mov rdx, qword [rbp + 8]
mov rax, rdx
sub rax, qword [rbp + 0x170]
mov qword [rbp + 0x160], rax
mov byte [rbp + 0x168], 1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x140041b22
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rsp + 0x20], 2
lea rcx, [rbp + 0x40]
lea rdx, str.bool___cdecl_crashpad::ProcessReaderWin::ThreadContext::InitializeXState_HANDLE__ULONG64_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0x10d
call fcn.14004b54e
mov dword [rbp + 0x140], esi
lea rsi, [rbp + 0x40]
mov rcx, rsi
lea rdx, [0x140095d71]
call fcn.140002bc9
jmp 0x140041d36
mov rsi, qword [rbp + 0x10]
mov rbx, qword [rbp + 0x18]
mov qword [rbp + 0x1c0], rbx
mov rax, rsi
sub rax, rbx
jae 0x1400418a8
mov dword [rsp + 0x20], 2
mov rcx, r9
lea rdx, str.void___cdecl_crashpad::ProcessReaderWin::ReadThreadData_bool___Traits__crashpad::process_types::internal::Traits64_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0x1ca
call fcn.14004b54e
lea rdi, [rbp + 0x40]
mov rcx, rdi
lea rdx, str.invalid_stack_range:
call fcn.140002bc9
mov rcx, rax
mov rdx, rsi
call fcn.14000aad6
mov rcx, rax
lea rdx, [0x14009fc19]
call fcn.140002bc9
mov rcx, rax
mov rdx, rbx
call fcn.14000aad6
mov rcx, rdi
call fcn.14004ba62
xor eax, eax
mov qword [rbp + 0x1c8], rax
mov eax, dword [0x1400c50d0]
mov ecx, dword [0x1400c3824]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140041d62
mov rax, qword [0x1400c50c8]
test rax, rax
je 0x1400419a4
mov rcx, qword [rbp + 0x210]
lea rdx, [rbp + 0x148]
call rax
mov esi, eax
test eax, eax
js 0x140041941
mov rdx, qword [rbp + 0x148]
mov qword [rbp - 0x48], rdx
lea rdi, [rbp - 0x58]
mov rcx, rdi
call fcn.14000a784
lea rsi, [rbp + 0x40]
mov rcx, rsi
mov rdx, rdi
call fcn.14004c790
lea rcx, [rbp + 0x188]
mov rdx, rsi
call fcn.14000a456
mov rcx, rsi
call fcn.1400049ea
mov rcx, r15
call fcn.1400188ee
jmp 0x1400419a4
mov dword [rsp + 0x20], 1
lea rcx, [rbp + 0x40]
lea rdx, str.void___cdecl_crashpad::ProcessReaderWin::ReadThreadData_bool___Traits__crashpad::process_types::internal::Traits64_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0x1db
call fcn.14004b54e
lea r13, [rbp + 0x40]
mov rcx, r13
lea rdx, str.GetThreadDescription:
call fcn.140002bc9
mov rbx, rax
mov rdi, r15
mov rcx, r15
mov edx, esi
call fcn.14004b438
mov rcx, rbx
mov rdx, rdi
call fcn.140003113
mov rcx, rdi
call fcn.1400049ea
mov rcx, r13
call fcn.14004ba62
mov rax, qword [rbp + 0x220]
mov rbx, qword [rax + 0x148]
cmp rbx, qword [rax + 0x150]
je 0x1400419de
mov rcx, rbx
lea rdx, [rbp + 0x160]
call fcn.1400424de
mov rax, qword [rbp + 0x220]
sub qword [rax + 0x148], 0xffffffffffffff80
jmp 0x140041d3e
mov rsi, rbx
mov rax, qword [rbp + 0x218]
sub rsi, qword [rax]
sar rsi, 7
lea r13, [rsi + 1]
mov rdx, rsi
shr rdx, 1
movabs rcx, 0x1ffffffffffffff
mov rax, rcx
sub rax, rdx
add rdx, rsi
cmp rdx, r13
cmovbe rdx, r13
cmp rsi, rax
cmova rdx, rcx
mov qword [rbp + 0x1e8], rdx
mov rcx, rdx
call fcn.14001f83b
mov rcx, rax
call fcn.14000358a
mov qword [rbp + 0x228], rax
shl rsi, 7
mov rax, qword [rbp + 0x228]
lea rdi, [rax + rsi]
add rax, rsi
add rax, 0x80
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x1f8], rax
mov rcx, rdi
lea rdx, [rbp + 0x160]
call fcn.1400424de
mov rax, qword [rbp + 0x220]
mov rsi, qword [rax + 0x140]
cmp qword [rax + 0x148], rbx
je 0x140041b7e
mov qword [rbp + 0x1f8], rdi
mov rcx, rsi
mov rdx, rbx
mov r8, qword [rbp + 0x228]
mov r9, qword [rbp + 0x218]
call fcn.14004256e
mov rax, qword [rbp + 0x220]
mov rdx, qword [rax + 0x148]
mov rax, qword [rbp + 0x228]
mov qword [rbp + 0x1f8], rax
mov rcx, rbx
mov r8, qword [rbp + 0x1f0]
mov r9, qword [rbp + 0x218]
call fcn.14004256e
jmp 0x140041bef
mov edx, 0x4d0
lea rcx, [rbp + 0x170]
call fcn.140032c12
mov byte [rbp + 0x168], 1
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x170]
lea rdx, [rcx + rax]
mov dword [rcx + rax + 0x30], 0x10001f
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140041c5d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x140041419
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rsp + 0x20], 2
lea rcx, [rbp + 0x40]
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::FillThreadContextAndSuspendCount_HANDLE__ProcessReaderWin::Thread___crashpad::ProcessSuspensionState__bool___Traits__crashpad::process_types::internal::Traits64_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0xbf
call fcn.14004b54e
mov dword [rbp + 0x140], esi
lea rsi, [rbp + 0x40]
mov rcx, rsi
lea rdx, [0x1400979c8]
call fcn.140002bc9
jmp 0x140041d36
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], rdi
mov rcx, qword [rbp + 0x228]
mov qword [rbp + 0x40], rcx
mov rax, qword [rbp + 0x218]
mov qword [rbp + 0x50], rax
cmp rsi, rbx
lea r13, [rbp + 0x40]
je 0x140041bd8
mov rcx, qword [rbp + 0x228]
mov qword [rbp + 0x200], rcx
mov rdx, rsi
call fcn.1400424de
mov eax, 0x80
mov rcx, qword [rbp + 0x200]
add rcx, rax
add rsi, rax
cmp rsi, rbx
jne 0x140041bb2
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x40], rcx
mov rcx, r13
call fcn.140042600
mov r13, qword [rbp + 0x150]
mov r8, qword [rbp + 0x218]
mov rcx, qword [r8]
test rcx, rcx
mov rsi, qword [rbp + 0x220]
je 0x140041c27
mov rdx, qword [rsi + 0x148]
call fcn.140042492
mov rcx, qword [rsi + 0x140]
mov rdx, qword [rsi + 0x150]
sub rdx, rcx
call fcn.140002fda
mov rcx, qword [rbp + 0x228]
mov qword [rsi + 0x140], rcx
shl r13, 7
add r13, rcx
mov qword [rsi + 0x148], r13
mov rax, qword [rbp + 0x1e8]
shl rax, 7
add rax, rcx
mov qword [rsi + 0x150], rax
jmp 0x140041d3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rsp + 0x20], 2
lea rcx, [rbp + 0x40]
lea rdx, str.bool___cdecl_crashpad::ProcessReaderWin::ThreadContext::InitializeNative_HANDLE_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0xd7
call fcn.14004b54e
mov dword [rbp + 0x140], esi
lea rsi, [rbp + 0x40]
mov rcx, rsi
lea rdx, [0x140095d71]
call fcn.140002bc9
jmp 0x140041d36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rsp + 0x20], 2
lea rcx, [rbp + 0x40]
lea rdx, str.bool___cdecl_crashpad::ProcessReaderWin::ThreadContext::InitializeXState_HANDLE__ULONG64_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0x106
call fcn.14004b54e
mov dword [rbp + 0x140], esi
lea rsi, [rbp + 0x40]
mov rcx, rsi
lea rdx, str.InitializeContext2___initializing
call fcn.140002bc9
jmp 0x140041d36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rsp + 0x20], 2
lea rcx, [rbp + 0x40]
lea rdx, str.bool___cdecl_crashpad::ProcessReaderWin::ThreadContext::InitializeXState_HANDLE__ULONG64_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0xfc
call fcn.14004b54e
mov dword [rbp + 0x140], esi
lea rsi, [rbp + 0x40]
mov rcx, rsi
lea rdx, str.InitializeContext2___getting_required_size
call fcn.140002bc9
mov rcx, rsi
call fcn.14004bba4
lea rcx, [rbp + 0x210]
call fcn.1400119c6
lea rcx, [rbp + 0x160]
call fcn.1400424bc
inc r14d
lea rbx, [rbp + 0x40]
jmp 0x140041323
lea rcx, [0x1400c50d0]
call fcn.140052d98
cmp dword [0x1400c50d0], 0xffffffff
jne 0x1400418d4
lea rcx, [0x1400a05ca]
lea rdx, str.::GetThreadDescription
xor r8d, r8d
call fcn.140013c90
mov qword [0x1400c50c8], rax
lea rcx, [0x1400c50d0]
call fcn.140052e30
jmp 0x1400418d4
lea rcx, [0x1400c50c0]
call fcn.140052d98
cmp dword [0x1400c50c0], 0xffffffff
jne 0x140041730
lea rcx, [0x1400a05ca]
lea rdx, str.::InitializeContext2
xor r8d, r8d
call fcn.140013c90
mov qword [0x1400c50b8], rax
lea rcx, [0x1400c50c0]
call fcn.140052e30
jmp 0x140041730