Function at 0x140049660
Capabilities:
Create process memory minidump
Enumerate threads
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
movaps xmmword [rsp + 0x240], xmm7
movaps xmmword [rsp + 0x230], xmm6
mov qword [rsp + 0x38], rcx
mov rax, qword [0x14019d018]
xor rax, rsp
mov qword [rsp + 0x228], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
mov ecx, 4
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
test rax, rax
je 0x14004975c
mov rdi, rax
xorps xmm0, xmm0
lea rdx, [rsp + 0x40]
movups xmmword [rdx + 4], xmm0
mov qword [rdx + 0x14], 0
mov dword [rdx], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x140049753
lea rbx, [rsp + 0x40]
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r12, qword [sym.imp.KERNEL32.dll_OpenThread]
mov r13, qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x40], 0x10
jb 0x14004973c
cmp dword [rsp + 0x48], esi
je 0x14004973c
mov ebp, dword [rsp + 0x4c]
call r15
cmp ebp, eax
jne 0x14004973c
mov r8d, dword [rsp + 0x48]
mov ecx, 2
xor edx, edx
call r12
test rax, rax
je 0x14004973c
mov rbp, rax
mov rcx, rax
call r13
mov rcx, rbp
call r14
mov dword [rsp + 0x40], 0x1c
mov rcx, rdi
mov rdx, rbx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x140049701
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x1401ab464], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r13d, eax
movabs rbp, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x210]
mov qword [rsi + 0x10], rbp
movaps xmm6, xmmword [0x140174f60]
movaps xmmword [rsi], xmm6
mov rcx, rsi
call fcn.140050470
mov ecx, 0x2711
mov rdx, rsi
call fcn.140053ae0
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x1400497c2
mov rax, qword [rsp + 0x218]
test rax, rax
je 0x140049ad6
lea rax, str.handler
lea r8, [rsp + 0x200]
mov qword [r8], rax
mov qword [r8 + 8], 7
lea rsi, [rsp + 0x210]
lea rbx, [rsp + 0x40]
mov rcx, rsi
mov rdx, rbx
call fcn.140052510
mov rcx, rsi
mov rdx, rbx
call fcn.140050640
mov rcx, rbx
call fcn.1400505d0
mov rcx, rsi
call fcn.140075050
test al, al
jne 0x140049831
lea rcx, [rsp + 0x210]
call fcn.1400761f0
test al, al
je 0x140049ad6
lea rsi, [rsp + 0x1e0]
mov qword [rsi + 0x10], rbp
movaps xmmword [rsi], xmm6
lea rdx, [0x14017c8e5]
lea r12, [rsp + 0x1b8]
mov rcx, r12
mov r8d, edi
call fcn.140076200
lea r8, str.mmcrashpad_handler_
xor ebp, ebp
mov rcx, r12
xor edx, edx
call fcn.14004428c
movups xmm0, xmmword [rax]
lea rcx, [rsp + 0x180]
movaps xmmword [rcx], xmm0
mov rdx, qword [rax + 0x10]
mov qword [rcx + 0x10], rdx
mov qword [rax + 0x10], rbp
xorps xmm7, xmm7
movups xmmword [rax], xmm7
lea rdx, str..dmp
call fcn.1400446b0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x50], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
movups xmmword [rax], xmm7
mov qword [rax + 0x10], rbp
movzx eax, byte [rsp + 0x57]
test al, al
cmovs rbx, qword [rsp + 0x40]
lea r8, [rsp + 0x1d0]
mov qword [r8], rbx
cmovs rax, qword [rsp + 0x48]
mov qword [r8 + 8], rax
lea rcx, [rsp + 0x210]
mov rdx, rsi
call fcn.140052510
cmp byte [rsp + 0x57], 0
jns 0x1400498f4
mov rcx, qword [rsp + 0x40]
call fcn.140136524
cmp byte [rsp + 0x197], 0
jns 0x14004990b
mov rcx, qword [rsp + 0x180]
call fcn.140136524
cmp byte [rsp + 0x1cf], 0
jns 0x140049922
mov rcx, qword [rsp + 0x1b8]
call fcn.140136524
lea rsi, [rsp + 0x180]
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
lea rdx, [rsp + 0x1e0]
mov rcx, rsi
mov r8d, 0x68
call fcn.140076bc0
mov rcx, rsi
call fcn.140076e10
test al, al
je 0x1400499fd
mov dword [rsp + 0x1b8], r13d
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x1bc], rax
mov dword [rsp + 0x1c4], 0
lea rcx, [rsp + 0x180]
call fcn.140076e20
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r12
mov rcx, r15
mov edx, edi
mov r8, rax
xor r9d, r9d
call sub.dbghelp.dll_MiniDumpWriteDump
test eax, eax
je 0x140049a59
xor ecx, ecx
call fcn.14006d690
test al, al
je 0x140049aaf
lea rdx, str..._.._third_party_crashpad_crashpad_handler_handler_main.cc
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r8d, 0x1dc
xor r9d, r9d
call fcn.14006d740
lea rcx, [rsp + 0x50]
lea rdx, str.Dump_file_created_successfully.
mov r8d, 0x1f
call fcn.14001df3c
mov rcx, rsi
call fcn.14006dbd0
jmp 0x140049aaf
mov ecx, 2
call fcn.14006d690
test al, al
je 0x140049abc
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_handler_handler_main.cc
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r8d, 0x1c3
mov r9d, 2
call fcn.14006e750
lea rcx, [rsp + 0x50]
lea rdx, str.Failed_to_create_dump_file.
mov r8d, 0x1b
call fcn.14001df3c
mov rcx, rsi
call fcn.14006e840
jmp 0x140049abc
mov ecx, 2
call fcn.14006d690
test al, al
je 0x140049aaf
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_handler_handler_main.cc
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r8d, 0x1d7
mov r9d, 2
call fcn.14006e750
lea rcx, [rsp + 0x50]
lea rdx, str.Failed_to_write_dump_file.
mov r8d, 0x1a
call fcn.14001df3c
mov rcx, rsi
call fcn.14006e840
lea rcx, [rsp + 0x180]
call fcn.140076e60
lea rcx, [rsp + 0x180]
call fcn.140076d70
lea rcx, [rsp + 0x1e0]
call fcn.1400505d0
lea rcx, [rsp + 0x210]
call fcn.1400505d0
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.140136dd0
xor eax, eax
movaps xmm6, xmmword [rsp + 0x230]
movaps xmm7, xmmword [rsp + 0x240]
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret