Function at 0x14018bb0a
Capabilities:
Resume thread
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x7b8
movaps xmmword [rsp + 0x7a0], xmm6
mov r15d, edx
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x798], rax
mov qword [rsp + 0x48], rcx
mov r14, qword [rcx]
mov ecx, 0x4000
call fcn.1401c9fac
mov r12, rax
mov ebx, 0x4000
mov esi, 0x14
lea r13, [rsp + 0xf0]
mov ebp, 0x1000
mov ecx, 5
mov rdx, r12
mov r8d, ebx
mov r9, r13
call fcn.1400e96e4
mov edi, eax
cmp eax, 0xc0000023
je 0x14018bb8a
cmp edi, 0xc0000004
jne 0x14018bbaf
mov ebx, dword [rsp + 0xf0]
add ebx, ebp
mov rcx, r12
call fcn.1401c9fb4
mov rcx, rbx
call fcn.1401c9fac
mov r12, rax
dec esi
jne 0x14018bb66
jmp 0x14018bc57
test edi, edi
js 0x14018bc57
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov ebp, eax
mov rsi, r12
cmp dword [rsi + 0x50], ebp
je 0x14018bce2
mov eax, dword [rsi]
add rsi, rax
test rax, rax
cmove rsi, rax
test rsi, rsi
jne 0x14018bbc5
mov ecx, 2
call fcn.140060b40
test al, al
je 0x14018bcae
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
lea rdi, [rsp + 0x250]
mov rcx, rdi
mov r8d, 0x6f
mov r9d, 2
call fcn.140060c10
lea rcx, [rsp + 0x258]
lea rdx, str.process
mov r8d, 8
call fcn.140007184
mov rcx, rax
mov edx, ebp
call fcn.1400224f6
lea rdx, str._not_found
mov r8d, 0xa
mov rcx, rax
call fcn.140007184
mov rcx, rdi
call fcn.140061070
jmp 0x14018bcae
mov ecx, 2
call fcn.140060b40
test al, al
je 0x14018bcae
mov dword [rsp + 0x20], edi
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
lea rdi, [rsp + 0x250]
mov rcx, rdi
mov r8d, 0x5d
mov r9d, 2
call fcn.1400e9aa8
lea rcx, [rsp + 0x258]
lea rdx, [0x14020bc78]
mov r8d, 0x18
call fcn.140007184
mov rcx, rdi
call fcn.1400e9aca
mov rcx, r12
call fcn.1401c9fb4
mov rcx, qword [rsp + 0x798]
xor rcx, rsp
call fcn.1401ca2e0
movaps xmm6, xmmword [rsp + 0x7a0]
add rsp, 0x7b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test rsi, rsi
je 0x14018bcae
cmp dword [rsi + 4], 0
je 0x14018bcae
mov eax, 8
lea rcx, [rsp + 0x70]
add rcx, rax
mov qword [rsp + 0x68], rcx
add rax, r13
mov qword [rsp + 0x40], rax
mov eax, 0x10
add rax, r13
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x48]
lea rcx, [rax + 0x90]
mov qword [rsp + 0x50], rcx
lea rdi, [rax + 0x130]
add rax, 0x148
mov qword [rsp + 0x58], rax
xorps xmm6, xmm6
xor ebx, ebx
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x37], r15b
mov r8d, 0x504
lea rcx, [rsp + 0x250]
xor edx, edx
call fcn.1401cd0e0
lea rax, [rsp + 0x758]
movups xmmword [rax], xmm6
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax + 0x20], xmm6
mov qword [rax + 0x30], 0
lea rbp, [rbx + rbx*4]
shl rbp, 4
lea r9, [rsi + rbp]
add r9, 0x128
mov rax, qword [r9 + 8]
mov qword [rsp + 0x720], rax
mov dword [rsp + 0x70], 0x30
mov rax, qword [rsp + 0x68]
movups xmmword [rax], xmm6
mov dword [rax + 0x10], 0
lea r8, [rsp + 0x70]
movups xmmword [r8 + 0x20], xmm6
lea rcx, [rsp + 0xa8]
mov edx, 0x4a
call fcn.1400e9a12
test eax, eax
js 0x14018bef6
mov r14, qword [rsp + 0xa8]
test r14, r14
je 0x14018c56a
mov rax, qword [rsp + 0x48]
movzx edi, byte [rax + 0x160]
mov rax, qword [rsp + 0x720]
mov rcx, qword gs:[0x30]
cmp rax, qword [rcx + 0x48]
jne 0x14018bf4d
mov dword [rsp + 0x748], 0
lea rcx, [rsp + 0x250]
call fcn.1401ca6d0
mov dword [rsp + 0x74c], 0x20
mov eax, dword [rsi + rbp + 0x138]
mov dword [rsp + 0x750], eax
mov qword [rsp + 0x20], 0
mov rcx, r14
xor edx, edx
lea r8, [rsp + 0xa8]
mov r9d, 0x30
call fcn.1400e9775
test eax, eax
js 0x14018bff5
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x728], rdx
mov qword [rsp + 0x730], 0x1788
mov r8d, 0x38
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x70]
call fcn.140177af4
test al, al
je 0x14018c1b3
mov ebp, r15d
test r15b, r15b
je 0x14018c116
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x728], rdx
mov qword [rsp + 0x730], 0x1788
mov r8d, 0x1c
mov rcx, qword [rsp + 0x50]
mov r9, r13
call fcn.140177af4
mov edi, dword [rsp + 0xf4]
mov r15d, dword [rsp + 0xf8]
test al, al
mov eax, 0
cmove rdi, rax
cmove r15, rax
jmp 0x14018c123
mov edi, eax
mov ecx, 2
call fcn.140060b40
test al, al
je 0x14018c56a
mov dword [rsp + 0x20], edi
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0x7e
mov r9d, 2
call fcn.1400e9aa8
mov r8d, 0xc
mov rcx, qword [rsp + 0x40]
lea rdx, str.NtOpenThread
call fcn.140007184
mov rcx, r13
call fcn.1400e9aca
jmp 0x14018c56a
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x14018c04c
sub eax, edi
mov dword [rsp + 0x748], eax
mov r8d, 0x4d0
lea rdi, [rsp + 0x250]
mov rcx, rdi
xor edx, edx
call fcn.1401cd0e0
test r15b, r15b
je 0x14018c099
mov dword [rsp + 0x250], 0x10001f
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
jne 0x14018c0b8
mov ecx, 2
call fcn.140060b40
test al, al
je 0x14018c562
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0xab
mov r9d, 2
call fcn.1400618b0
mov r8d, 0x15
mov rcx, qword [rsp + 0x38]
lea rdx, [0x140232699]
jmp 0x14018c3d5
mov edi, eax
mov ecx, 2
call fcn.140060b40
test al, al
je 0x14018c562
mov dword [rsp + 0x20], edi
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0x187
mov r9d, 2
call fcn.1400e9aa8
mov r8d, 0x18
mov rcx, qword [rsp + 0x40]
lea rdx, str.NtQueryInformationThread
call fcn.140007184
mov rcx, r13
call fcn.1400e9aca
jmp 0x14018c562
mov ecx, 2
call fcn.140060b40
test al, al
je 0x14018c562
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0x9a
mov r9d, 2
call fcn.1400618b0
mov r8d, 0xd
mov rcx, qword [rsp + 0x38]
lea rdx, [0x14023268b]
jmp 0x14018c3d5
mov dword [rsp + 0x280], 0x10001f
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14018c38d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x14018be20
mov ecx, 2
call fcn.140060b40
test al, al
je 0x14018c562
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0xb9
mov r9d, 2
call fcn.1400618b0
mov r8d, 0xc
mov rcx, qword [rsp + 0x38]
lea rdx, [0x1402326c0]
jmp 0x14018c3d5
mov rdi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x80]
mov qword [rsp + 0x738], r15
mov rax, rdi
sub rax, r15
jae 0x14018c1a8
mov ecx, 2
call fcn.140060b40
test al, al
je 0x14018c1a6
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0x1a7
mov r9d, 2
call fcn.140060c10
mov r8d, 0x15
mov rcx, qword [rsp + 0x40]
lea rdx, str.invalid_stack_range:
call fcn.140007184
mov rcx, rax
mov rdx, rdi
call fcn.140022936
mov r8d, 3
mov rcx, rax
lea rdx, [0x140232666]
call fcn.140007184
mov rcx, rax
mov rdx, r15
call fcn.140022936
mov rcx, r13
call fcn.140061070
xor eax, eax
mov qword [rsp + 0x740], rax
mov r15d, ebp
lea rax, [rsp + 0x230]
mov qword [rsp + 0x20], rax
mov rcx, r14
lea rdx, [rsp + 0x248]
lea r8, [rsp + 0x240]
lea r9, [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
test eax, eax
je 0x14018c22c
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0x758], rax
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x760], rax
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x768], rax
mov rax, qword [rsp + 0x230]
mov qword [rsp + 0x770], rax
mov rbp, qword [rsp + 0x48]
jmp 0x14018c282
mov ecx, 2
call fcn.140060b40
test al, al
mov rbp, qword [rsp + 0x48]
je 0x14018c282
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0xce
mov r9d, 2
call fcn.1400618b0
mov r8d, 0xe
mov rcx, qword [rsp + 0x38]
lea rdx, [0x1402326cd]
call fcn.140007184
mov rcx, r13
call fcn.140061980
mov eax, dword [0x140271920]
mov ecx, dword [0x14026d938]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14018c595
mov rax, qword [0x140271918]
test rax, rax
je 0x14018c44e
mov rcx, r14
lea rdx, [rsp + 0xe8]
call rax
test eax, eax
js 0x14018c330
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xd8], rax
test rax, rax
je 0x14018c2f3
cmp word [rax], 0
je 0x14018c2f3
xor ecx, ecx
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14018c2e5
jmp 0x14018c2f5
xor ecx, ecx
mov qword [rsp + 0xe0], rcx
mov rcx, r13
lea rdx, [rsp + 0xd8]
call fcn.14006f5f0
cmp byte [rsp + 0x78f], 0
js 0x14018c3e7
xor eax, eax
mov byte [rsp + 0x778], al
mov byte [rsp + 0x78f], al
jmp 0x14018c421
mov edi, eax
mov ecx, 2
call fcn.140060b40
test al, al
je 0x14018c44e
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0xdb
mov r9d, 2
call fcn.140060c10
mov r8d, 0x16
mov rcx, qword [rsp + 0x40]
lea rdx, str.GetThreadDescription:
call fcn.140007184
mov rcx, rax
mov edx, edi
call fcn.1400222d6
mov rcx, r13
call fcn.140061070
jmp 0x14018c44e
mov ecx, 2
call fcn.140060b40
test al, al
je 0x14018c562
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0xb3
mov r9d, 2
call fcn.1400618b0
mov r8d, 0x10
mov rcx, qword [rsp + 0x38]
lea rdx, [0x1402326af]
call fcn.140007184
mov rcx, r13
call fcn.140061980
jmp 0x14018c562
mov rax, qword [rsp + 0x778]
xor ecx, ecx
mov byte [rax], cl
mov qword [rsp + 0x780], 0
cmp byte [rsp + 0x78f], cl
jns 0x14018c421
mov rcx, qword [rsp + 0x778]
call fcn.1401c9f6c
mov qword [rsp + 0x788], 0
mov rax, qword [rsp + 0x100]
lea rcx, [rsp + 0x778]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rcx], xmm0
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rbp + 0x138]
mov rax, qword [rbp + 0x140]
cmp rdi, rax
je 0x14018c49e
mov r8d, 0x528
mov rcx, rdi
lea rdx, [rsp + 0x250]
call fcn.1401cccd0
lea rcx, [rdi + 0x528]
lea rdx, [rsp + 0x778]
call fcn.14003a9a6
add rdi, 0x540
mov qword [rbp + 0x138], rdi
jmp 0x14018c562
mov r15, qword [rsp + 0x60]
mov rdx, qword [r15]
sub rdi, rdx
sar rdi, 6
movabs r8, 0xcf3cf3cf3cf3cf3d
imul rdi, r8
lea rcx, [rdi + 1]
movabs rbp, 0x30c30c30c30c30
cmp rcx, rbp
ja 0x14018c5dc
sub rax, rdx
sar rax, 6
imul rax, r8
lea rdx, [rax + rax]
cmp rdx, rcx
cmovb rdx, rcx
movabs rcx, 0x18618618618618
cmp rax, rcx
cmovae rdx, rbp
mov rcx, r13
mov r8, rdi
mov r9, qword [rsp + 0x58]
call fcn.14018c76c
mov rdi, qword [rsp + 0x100]
mov r8d, 0x528
mov rcx, rdi
lea rdx, [rsp + 0x250]
call fcn.1401cccd0
add rdi, 0x528
mov rcx, rdi
lea rdx, [rsp + 0x778]
call fcn.14003a9a6
add qword [rsp + 0x100], 0x540
mov rcx, r15
mov rdx, r13
call fcn.14018c7da
mov rcx, r13
call fcn.14018c890
mov r15b, byte [rsp + 0x37]
mov rcx, r14
call fcn.1400a8b7e
cmp byte [rsp + 0x78f], 0
jns 0x14018c581
mov rcx, qword [rsp + 0x778]
call fcn.1401c9f6c
inc rbx
mov eax, dword [rsi + 4]
cmp rbx, rax
jb 0x14018bd46
jmp 0x14018bcae
lea rcx, [0x140271920]
call fcn.1401ca090
cmp dword [0x140271920], 0xffffffff
jne 0x14018c2a7
lea rcx, [0x1402003d6]
lea rdx, str.::GetThreadDescription
xor r8d, r8d
call fcn.1400e6604
mov qword [0x140271918], rax
lea rcx, [0x140271920]
call fcn.1401ca128
jmp 0x14018c2a7
mov rcx, r15
call fcn.14003d05c
int3