Function at 0x14011e09a
Capabilities:
Resume thread
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x7b8
movaps xmmword [rsp + 0x7a0], xmm6
mov r15d, edx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0x798], rax
mov qword [rsp + 0x48], rcx
mov r14, qword [rcx]
mov ecx, 0x4000
call fcn.140163acc
mov r12, rax
mov ebx, 0x4000
mov esi, 0x14
lea r13, [rsp + 0xf0]
mov ebp, 0x1000
mov ecx, 5
mov rdx, r12
mov r8d, ebx
mov r9, r13
call fcn.1401064b8
mov edi, eax
cmp eax, 0xc0000023
je 0x14011e11a
cmp edi, 0xc0000004
jne 0x14011e13f
mov ebx, dword [rsp + 0xf0]
add ebx, ebp
mov rcx, r12
call fcn.140163ad4
mov rcx, rbx
call fcn.140163acc
mov r12, rax
dec esi
jne 0x14011e0f6
jmp 0x14011e1e7
test edi, edi
js 0x14011e1e7
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov ebp, eax
mov rsi, r12
cmp dword [rsi + 0x50], ebp
je 0x14011e272
mov eax, dword [rsi]
add rsi, rax
test rax, rax
cmove rsi, rax
test rsi, rsi
jne 0x14011e155
mov ecx, 2
call fcn.140038810
test al, al
je 0x14011e23e
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
lea rdi, [rsp + 0x250]
mov rcx, rdi
mov r8d, 0x6f
mov r9d, 2
call fcn.1400388b0
lea rcx, [rsp + 0x258]
lea rdx, str.process
mov r8d, 8
call fcn.140001e11
mov rcx, rax
mov edx, ebp
call fcn.1400155fc
lea rdx, str._not_found
mov r8d, 0xa
mov rcx, rax
call fcn.140001e11
mov rcx, rdi
call fcn.140038d10
jmp 0x14011e23e
mov ecx, 2
call fcn.140038810
test al, al
je 0x14011e23e
mov dword [rsp + 0x20], edi
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
lea rdi, [rsp + 0x250]
mov rcx, rdi
mov r8d, 0x5d
mov r9d, 2
call fcn.14010687c
lea rcx, [rsp + 0x258]
lea rdx, str.NtQuerySystemInformation
mov r8d, 0x18
call fcn.140001e11
mov rcx, rdi
call fcn.14010689e
mov rcx, r12
call fcn.140163ad4
mov rcx, qword [rsp + 0x798]
xor rcx, rsp
call fcn.140163e00
movaps xmm6, xmmword [rsp + 0x7a0]
add rsp, 0x7b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test rsi, rsi
je 0x14011e23e
cmp dword [rsi + 4], 0
je 0x14011e23e
mov eax, 8
lea rcx, [rsp + 0x70]
add rcx, rax
mov qword [rsp + 0x68], rcx
add rax, r13
mov qword [rsp + 0x40], rax
mov eax, 0x10
add rax, r13
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x48]
lea rcx, [rax + 0x90]
mov qword [rsp + 0x50], rcx
lea rdi, [rax + 0x130]
add rax, 0x148
mov qword [rsp + 0x58], rax
xorps xmm6, xmm6
xor ebx, ebx
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x37], r15b
mov r8d, 0x504
lea rcx, [rsp + 0x250]
xor edx, edx
call fcn.140166bf0
lea rax, [rsp + 0x758]
movups xmmword [rax], xmm6
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax + 0x20], xmm6
mov qword [rax + 0x30], 0
lea rbp, [rbx + rbx*4]
shl rbp, 4
lea r9, [rsi + rbp]
add r9, 0x128
mov rax, qword [r9 + 8]
mov qword [rsp + 0x720], rax
mov dword [rsp + 0x70], 0x30
mov rax, qword [rsp + 0x68]
movups xmmword [rax], xmm6
mov dword [rax + 0x10], 0
lea r8, [rsp + 0x70]
movups xmmword [r8 + 0x20], xmm6
lea rcx, [rsp + 0xa8]
mov edx, 0x4a
call fcn.1401067e6
test eax, eax
js 0x14011e486
mov r14, qword [rsp + 0xa8]
test r14, r14
je 0x14011eafa
mov rax, qword [rsp + 0x48]
movzx edi, byte [rax + 0x160]
mov rax, qword [rsp + 0x720]
mov rcx, qword gs:[0x30]
cmp rax, qword [rcx + 0x48]
jne 0x14011e4dd
mov dword [rsp + 0x748], 0
lea rcx, [rsp + 0x250]
call fcn.1401654e0
mov dword [rsp + 0x74c], 0x20
mov eax, dword [rsi + rbp + 0x138]
mov dword [rsp + 0x750], eax
mov qword [rsp + 0x20], 0
mov rcx, r14
xor edx, edx
lea r8, [rsp + 0xa8]
mov r9d, 0x30
call fcn.140106549
test eax, eax
js 0x14011e585
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x728], rdx
mov qword [rsp + 0x730], 0x1788
mov r8d, 0x38
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x70]
call fcn.140111364
test al, al
je 0x14011e743
mov ebp, r15d
test r15b, r15b
je 0x14011e6a6
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x728], rdx
mov qword [rsp + 0x730], 0x1788
mov r8d, 0x1c
mov rcx, qword [rsp + 0x50]
mov r9, r13
call fcn.140111364
mov edi, dword [rsp + 0xf4]
mov r15d, dword [rsp + 0xf8]
test al, al
mov eax, 0
cmove rdi, rax
cmove r15, rax
jmp 0x14011e6b3
mov edi, eax
mov ecx, 2
call fcn.140038810
test al, al
je 0x14011eafa
mov dword [rsp + 0x20], edi
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0x7e
mov r9d, 2
call fcn.14010687c
mov r8d, 0xc
mov rcx, qword [rsp + 0x40]
lea rdx, str.NtOpenThread
call fcn.140001e11
mov rcx, r13
call fcn.14010689e
jmp 0x14011eafa
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x14011e5dc
sub eax, edi
mov dword [rsp + 0x748], eax
mov r8d, 0x4d0
lea rdi, [rsp + 0x250]
mov rcx, rdi
xor edx, edx
call fcn.140166bf0
test r15b, r15b
je 0x14011e629
mov dword [rsp + 0x250], 0x10001f
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
jne 0x14011e648
mov ecx, 2
call fcn.140038810
test al, al
je 0x14011eaf2
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0xab
mov r9d, 2
call fcn.140039550
mov r8d, 0x15
mov rcx, qword [rsp + 0x38]
lea rdx, [0x1401b9c3c]
jmp 0x14011e965
mov edi, eax
mov ecx, 2
call fcn.140038810
test al, al
je 0x14011eaf2
mov dword [rsp + 0x20], edi
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0x187
mov r9d, 2
call fcn.14010687c
mov r8d, 0x18
mov rcx, qword [rsp + 0x40]
lea rdx, str.NtQueryInformationThread
call fcn.140001e11
mov rcx, r13
call fcn.14010689e
jmp 0x14011eaf2
mov ecx, 2
call fcn.140038810
test al, al
je 0x14011eaf2
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0x9a
mov r9d, 2
call fcn.140039550
mov r8d, 0xd
mov rcx, qword [rsp + 0x38]
lea rdx, [0x1401b9c2e]
jmp 0x14011e965
mov dword [rsp + 0x280], 0x10001f
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14011e91d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x14011e3b0
mov ecx, 2
call fcn.140038810
test al, al
je 0x14011eaf2
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0xb9
mov r9d, 2
call fcn.140039550
mov r8d, 0xc
mov rcx, qword [rsp + 0x38]
lea rdx, [0x1401b9c63]
jmp 0x14011e965
mov rdi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x80]
mov qword [rsp + 0x738], r15
mov rax, rdi
sub rax, r15
jae 0x14011e738
mov ecx, 2
call fcn.140038810
test al, al
je 0x14011e736
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0x1a7
mov r9d, 2
call fcn.1400388b0
mov r8d, 0x15
mov rcx, qword [rsp + 0x40]
lea rdx, str.invalid_stack_range:
call fcn.140001e11
mov rcx, rax
mov rdx, rdi
call fcn.140015a3c
mov r8d, 3
mov rcx, rax
lea rdx, [0x1401b9c16]
call fcn.140001e11
mov rcx, rax
mov rdx, r15
call fcn.140015a3c
mov rcx, r13
call fcn.140038d10
xor eax, eax
mov qword [rsp + 0x740], rax
mov r15d, ebp
lea rax, [rsp + 0x230]
mov qword [rsp + 0x20], rax
mov rcx, r14
lea rdx, [rsp + 0x248]
lea r8, [rsp + 0x240]
lea r9, [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
test eax, eax
je 0x14011e7bc
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0x758], rax
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x760], rax
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x768], rax
mov rax, qword [rsp + 0x230]
mov qword [rsp + 0x770], rax
mov rbp, qword [rsp + 0x48]
jmp 0x14011e812
mov ecx, 2
call fcn.140038810
test al, al
mov rbp, qword [rsp + 0x48]
je 0x14011e812
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0xce
mov r9d, 2
call fcn.140039550
mov r8d, 0xe
mov rcx, qword [rsp + 0x38]
lea rdx, [0x1401b9c70]
call fcn.140001e11
mov rcx, r13
call fcn.140039620
mov eax, dword [0x1401f7148]
mov ecx, dword [0x1401f3a70]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14011eb25
mov rax, qword [0x1401f7140]
test rax, rax
je 0x14011e9de
mov rcx, r14
lea rdx, [rsp + 0xe8]
call rax
test eax, eax
js 0x14011e8c0
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xd8], rax
test rax, rax
je 0x14011e883
cmp word [rax], 0
je 0x14011e883
xor ecx, ecx
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14011e875
jmp 0x14011e885
xor ecx, ecx
mov qword [rsp + 0xe0], rcx
mov rcx, r13
lea rdx, [rsp + 0xd8]
call fcn.140044ab0
cmp byte [rsp + 0x78f], 0
js 0x14011e977
xor eax, eax
mov byte [rsp + 0x778], al
mov byte [rsp + 0x78f], al
jmp 0x14011e9b1
mov edi, eax
mov ecx, 2
call fcn.140038810
test al, al
je 0x14011e9de
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0xdb
mov r9d, 2
call fcn.1400388b0
mov r8d, 0x16
mov rcx, qword [rsp + 0x40]
lea rdx, str.GetThreadDescription:
call fcn.140001e11
mov rcx, rax
mov edx, edi
call fcn.1400153dc
mov rcx, r13
call fcn.140038d10
jmp 0x14011e9de
mov ecx, 2
call fcn.140038810
test al, al
je 0x14011eaf2
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
mov rcx, r13
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r8d, 0xb3
mov r9d, 2
call fcn.140039550
mov r8d, 0x10
mov rcx, qword [rsp + 0x38]
lea rdx, [0x1401b9c52]
call fcn.140001e11
mov rcx, r13
call fcn.140039620
jmp 0x14011eaf2
mov rax, qword [rsp + 0x778]
xor ecx, ecx
mov byte [rax], cl
mov qword [rsp + 0x780], 0
cmp byte [rsp + 0x78f], cl
jns 0x14011e9b1
mov rcx, qword [rsp + 0x778]
call fcn.140163a8c
mov qword [rsp + 0x788], 0
mov rax, qword [rsp + 0x100]
lea rcx, [rsp + 0x778]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rcx], xmm0
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rbp + 0x138]
mov rax, qword [rbp + 0x140]
cmp rdi, rax
je 0x14011ea2e
mov r8d, 0x528
mov rcx, rdi
lea rdx, [rsp + 0x250]
call fcn.1401667e0
lea rcx, [rdi + 0x528]
lea rdx, [rsp + 0x778]
call fcn.14002d606
add rdi, 0x540
mov qword [rbp + 0x138], rdi
jmp 0x14011eaf2
mov r15, qword [rsp + 0x60]
mov rdx, qword [r15]
sub rdi, rdx
sar rdi, 6
movabs r8, 0xcf3cf3cf3cf3cf3d
imul rdi, r8
lea rcx, [rdi + 1]
movabs rbp, 0x30c30c30c30c30
cmp rcx, rbp
ja 0x14011eb6c
sub rax, rdx
sar rax, 6
imul rax, r8
lea rdx, [rax + rax]
cmp rdx, rcx
cmovb rdx, rcx
movabs rcx, 0x18618618618618
cmp rax, rcx
cmovae rdx, rbp
mov rcx, r13
mov r8, rdi
mov r9, qword [rsp + 0x58]
call fcn.14011ecfc
mov rdi, qword [rsp + 0x100]
mov r8d, 0x528
mov rcx, rdi
lea rdx, [rsp + 0x250]
call fcn.1401667e0
add rdi, 0x528
mov rcx, rdi
lea rdx, [rsp + 0x778]
call fcn.14002d606
add qword [rsp + 0x100], 0x540
mov rcx, r15
mov rdx, r13
call fcn.14011ed6a
mov rcx, r13
call fcn.14011ee20
mov r15b, byte [rsp + 0x37]
mov rcx, r14
call fcn.14005be2e
cmp byte [rsp + 0x78f], 0
jns 0x14011eb11
mov rcx, qword [rsp + 0x778]
call fcn.140163a8c
inc rbx
mov eax, dword [rsi + 4]
cmp rbx, rax
jb 0x14011e2d6
jmp 0x14011e23e
lea rcx, [0x1401f7148]
call fcn.140163bb0
cmp dword [0x1401f7148], 0xffffffff
jne 0x14011e837
lea rcx, [0x14019701a]
lea rdx, str.::GetThreadDescription
xor r8d, r8d
call fcn.140103598
mov qword [0x1401f7140], rax
lea rcx, [0x1401f7148]
call fcn.140163c48
jmp 0x14011e837
mov rcx, r15
call fcn.14002fbb0
int3