Function at 0x4c56c0
Capabilities:
Resolve function by parsing pe exports
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x430
mov eax, dword [0x5ff014]
xor eax, ebp
mov dword [esp + 0x428], eax
mov dword [esp + 0x18], ecx
mov eax, dword [ecx]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x70]
mov dword [eax], 0xffffffff
mov esi, 0x4000
mov ebx, 0x14
push 0x4000
call fcn.00503dd3
add esp, 4
lea ecx, [esp + 0x70]
push ecx
push esi
mov dword [esp + 0x18], eax
push eax
push 5
call fcn.0057b540
add esp, 0x10
mov edi, eax
cmp eax, 0xc0000023
je 0x4c5732
cmp edi, 0xc0000004
jne 0x4c57cb
mov esi, dword [esp + 0x70]
mov eax, 0x1000
add esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4c574e
push eax
call fcn.00503ddc
add esp, 4
push esi
call fcn.00503dd3
add esp, 4
dec ebx
jne 0x4c5708
mov dword [esp + 0x10], eax
push 2
call fcn.004deac0
add esp, 4
test al, al
je 0x4c57a2
lea ebx, [esp + 0x120]
mov ecx, ebx
push edi
push 2
push 0x59
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.0057b870
lea eax, [esp + 0x128]
push 0x18
push str.NtQuerySystemInformation
push eax
call fcn.004d4870
add esp, 0xc
mov ecx, ebx
call fcn.004952e0
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4c57b3
push ecx
call fcn.00503ddc
add esp, 4
mov ecx, dword [esp + 0x428]
xor ecx, ebp
call fcn.00504596
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
test edi, edi
js 0x4c5857
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov edi, eax
mov ecx, dword [esp + 0x10]
mov ebx, ecx
cmp dword [ebx + 0x44], edi
je 0x4c5860
mov eax, dword [ebx]
add ebx, eax
test eax, eax
cmove ebx, eax
test ebx, ebx
jne 0x4c57e5
push 2
call fcn.004deac0
add esp, 4
test al, al
je 0x4c57a2
lea ebx, [esp + 0x120]
mov ecx, ebx
push 2
push 0x6b
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.00454e90
lea eax, [esp + 0x128]
push 8
push str.process
push eax
call fcn.004d4870
add esp, 0xc
mov ecx, eax
push edi
call fcn.0042ad40
push 0xa
push str._not_found
push eax
call fcn.004d4870
add esp, 0xc
mov ecx, ebx
call fcn.00455270
jmp 0x4c57a2
mov eax, dword [esp + 0x10]
jmp 0x4c575a
test ebx, ebx
je 0x4c57a6
cmp dword [ebx + 4], 0
je 0x4c57a6
mov ecx, dword [esp + 0x18]
lea eax, [ecx + 0x58]
mov dword [esp + 0x28], eax
lea eax, [ecx + 0xb8]
mov dword [esp + 0x20], eax
pcmpeqd xmm0, xmm0
xor esi, esi
mov dword [esp + 0x2c], ebx
xor ecx, ecx
lea edi, [esp + 0x3f0]
movdqu xmmword [edi + 0x28], xmm0
movdqu xmmword [edi + 0x18], xmm0
movdqu xmmword [edi + 8], xmm0
movdqu xmmword [edi - 8], xmm0
push 0x2cc
push ecx
lea eax, [esp + 0x128]
push eax
call fcn.00508060
add esp, 0xc
mov dword [esp + 0x24], esi
shl esi, 6
lea eax, [ebx + esi]
add eax, 0xd8
pxor xmm0, xmm0
movdqu xmmword [edi], xmm0
movdqu xmmword [edi + 0x10], xmm0
movdqu xmmword [edi + 0x20], xmm0
xor edx, edx
mov dword [edi + 0x30], edx
mov ecx, dword [eax + 4]
mov dword [esp + 0x3f0], ecx
mov dword [esp + 0x3f4], edx
xor edx, edx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x50], 0x18
lea ecx, [esp + 0x54]
mov dword [ecx + 0x10], edx
movdqu xmmword [ecx], xmm0
push eax
lea eax, [esp + 0x54]
push eax
push 0x4a
lea eax, [esp + 0x3c]
push eax
call fcn.0057b4b0
add esp, 0x10
test eax, eax
js 0x4c5a9b
mov dword [esp + 0xc], esi
mov esi, dword [esp + 0x30]
test esi, esi
mov edi, 0
je 0x4c5ef8
mov eax, dword [esp + 0x18]
mov dl, byte [eax + 0xd0]
mov eax, dword [esp + 0x3f0]
mov ecx, dword fs:[0x18]
xor eax, dword [ecx + 0x24]
or eax, dword [esp + 0x3f4]
jne 0x4c5ae7
mov dword [esp + 0x418], 0
lea eax, [esp + 0x120]
push eax
call fcn.00504420
add esp, 4
mov dword [esp + 0x41c], 0x20
mov eax, dword [esp + 0xc]
mov eax, dword [ebx + eax + 0xe0]
mov dword [esp + 0x420], eax
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 0x5c], xmm0
movdqa xmmword [esp + 0x50], xmm0
push edi
push 0x1c
lea eax, [esp + 0x58]
push eax
push edi
push esi
call fcn.0057b5d0
add esp, 0x14
xor edx, edx
test eax, eax
js 0x4c5b8d
mov dword [esp + 0xc], esi
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 0x3c], xmm0
movdqa xmmword [esp + 0x30], xmm0
mov eax, dword [esp + 0x54]
mov dword [esp + 0x3fc], edx
mov dword [esp + 0x3f8], eax
mov dword [esp + 0x404], edx
mov dword [esp + 0x400], 0xf98
mov ecx, dword [esp + 0x28]
lea esi, [esp + 0x30]
push esi
push edx
push 0x1c
push edx
push eax
call fcn.00590c80
test al, al
je 0x4c5dbf
cmp byte [ebp + 8], 0
je 0x4c5d07
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 0x7c], xmm0
movdqa xmmword [esp + 0x70], xmm0
mov eax, dword [esp + 0x30]
xor edi, edi
mov dword [esp + 0x3fc], edi
mov dword [esp + 0x3f8], eax
mov dword [esp + 0x404], edi
mov dword [esp + 0x400], 0xf98
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x70]
push edx
push edi
push 0x1c
push edi
push eax
call fcn.00590c80
mov esi, 0
mov ecx, 0
test al, al
je 0x4c5d11
mov esi, dword [esp + 0x74]
mov ecx, dword [esp + 0x78]
jmp 0x4c5d11
mov edi, eax
push 2
call fcn.004deac0
add esp, 4
test al, al
je 0x4c5ef8
lea esi, [esp + 0x70]
mov ecx, esi
push edi
push 2
push 0x7a
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.0057b870
push 0xc
push str.NtOpenThread
lea eax, [esp + 0x80]
push eax
call fcn.004d4870
add esp, 0xc
mov ecx, esi
call fcn.004952e0
jmp 0x4c5ef8
mov byte [esp + 0x14], dl
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x4c5be4
mov edi, eax
test eax, eax
mov al, byte [esp + 0x14]
jne 0x4c5c23
test al, al
je 0x4c5c23
xor edi, edi
push 1
call fcn.004deac0
add esp, 4
test al, al
je 0x4c5c28
lea ecx, [esp + 0x70]
push 1
push 0x9b
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.00454e90
push 7
push str.Thread
lea eax, [esp + 0x80]
push eax
call fcn.004d4870
add esp, 0xc
mov ecx, eax
push dword [esp + 0x3f4]
push dword [esp + 0x3f4]
call fcn.0042b1a0
push 0x34
push str._should_be_suspended__but_previous_suspend_count_is
push eax
call fcn.004d4870
add esp, 0xc
mov ecx, eax
push 0
call fcn.0042ad40
lea ecx, [esp + 0x70]
call fcn.00455270
jmp 0x4c5c28
mov edi, eax
push 2
call fcn.004deac0
add esp, 4
test al, al
je 0x4c5eef
mov dword [esp + 0xc], esi
lea esi, [esp + 0x70]
mov ecx, esi
push edi
push 2
push 0x15a
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.0057b870
push 0x18
push str.NtQueryInformationThread
lea eax, [esp + 0x80]
push eax
call fcn.004d4870
add esp, 0xc
mov ecx, esi
mov esi, dword [esp + 0xc]
call fcn.004952e0
jmp 0x4c5eef
push 2
call fcn.004deac0
add esp, 4
test al, al
je 0x4c5eef
call fcn.00551fb0
mov dword [esp + 0xc], esi
lea esi, [esp + 0x70]
mov ecx, esi
push eax
push 2
push 0x96
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.005520e0
push 0xd
push 0x5f5fb4
jmp 0x4c5ce7
movzx eax, al
sub edi, eax
mov dword [esp + 0x418], edi
push 0x2cc
push 0
lea edi, [esp + 0x128]
push edi
call fcn.00508060
add esp, 0xc
mov dword [esp + 0x120], 0x1003f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x4c5cad
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
mov edi, 0
jne 0x4c598d
push 2
call fcn.004deac0
add esp, 4
test al, al
je 0x4c5eef
call fcn.00551fb0
mov dword [esp + 0xc], esi
lea esi, [esp + 0x70]
mov ecx, esi
push eax
push 2
push 0xbb
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.005520e0
push 0xc
push 0x5f6010
jmp 0x4c5ce7
push 2
call fcn.004deac0
add esp, 4
test al, al
je 0x4c5eef
call fcn.00551fb0
mov dword [esp + 0xc], esi
lea esi, [esp + 0x70]
mov ecx, esi
push eax
push 2
push 0xb5
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.005520e0
push 0x10
push 0x5f5fff
lea eax, [esp + 0x80]
push eax
call fcn.004d4870
add esp, 0xc
mov ecx, esi
mov esi, dword [esp + 0xc]
call fcn.00552140
jmp 0x4c5eef
xor edi, edi
mov esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x408], ecx
mov dword [esp + 0x40c], edi
cmp esi, ecx
mov eax, edi
sbb eax, edi
jae 0x4c5dab
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], ecx
xor esi, esi
push 2
call fcn.004deac0
add esp, 4
mov ecx, 0
test al, al
je 0x4c5db1
lea esi, [esp + 0x70]
mov ecx, esi
push 2
push 0x17a
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.00454e90
push 0x15
push str.invalid_stack_range:
lea eax, [esp + 0x80]
push eax
call fcn.004d4870
add esp, 0xc
mov ecx, eax
push edi
push dword [esp + 0x20]
call fcn.0042b1a0
push 3
push 0x5eefce
push eax
call fcn.004d4870
add esp, 0xc
mov ecx, eax
push edi
push dword [esp + 0x18]
call fcn.0042b1a0
mov ecx, esi
call fcn.00455270
xor esi, esi
xor ecx, ecx
jmp 0x4c5db1
sub esi, ecx
sbb edi, edi
mov ecx, edi
mov dword [esp + 0x410], esi
mov dword [esp + 0x414], ecx
mov edi, dword [esp + 0x18]
mov esi, dword [edi + 0xbc]
cmp esi, dword [edi + 0xc0]
je 0x4c5dfa
mov eax, 0x308
push eax
lea eax, [esp + 0x124]
push eax
push esi
call fcn.00507560
add esp, 0xc
mov eax, 0x308
add esi, eax
mov dword [edi + 0xbc], esi
jmp 0x4c5eeb
mov eax, dword [esp + 0x20]
sub esi, dword [eax]
sar esi, 3
imul esi, esi, 0x5f02a3a1
lea eax, [esi + 1]
cmp eax, 0x547420
jae 0x4c5f0f
lea edi, [esi + esi]
cmp edi, eax
cmovb edi, eax
cmp esi, 0x2a3a0f
mov eax, 0x54741f
cmovae edi, eax
test edi, edi
je 0x4c5e4e
cmp edi, 0x547420
jae 0x4c5f18
imul eax, edi, 0x308
push eax
call fcn.00503d75
add esp, 4
jmp 0x4c5e50
xor eax, eax
imul esi, esi, 0x308
add esi, eax
imul ecx, edi, 0x308
add ecx, eax
mov dword [esp + 0x14], ecx
mov edi, 0x308
push edi
lea eax, [esp + 0x124]
push eax
push esi
call fcn.00507560
add esp, 0xc
lea ecx, [esi + edi]
mov eax, dword [esp + 0x18]
mov edx, dword [eax + 0xb8]
mov edi, dword [eax + 0xbc]
cmp edi, edx
je 0x4c5ec4
mov dword [esp + 0x1c], ecx
mov eax, 0xfffffcf8
add edi, eax
add esi, eax
push 0x308
push edi
push esi
mov ebx, edx
call fcn.00507560
mov edx, ebx
add esp, 0xc
cmp edi, ebx
jne 0x4c5e96
mov eax, dword [esp + 0x20]
mov edi, dword [eax]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
mov dword [eax + 0xb8], esi
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 0xc0], ecx
test edi, edi
je 0x4c5eeb
push edi
call fcn.00503da5
add esp, 4
mov esi, dword [esp + 0xc]
push esi
call fcn.004956c0
add esp, 4
mov esi, dword [esp + 0x24]
inc esi
cmp esi, dword [ebx + 4]
pcmpeqd xmm0, xmm0
jb 0x4c5891
jmp 0x4c57a2
mov ecx, dword [esp + 0x20]
call fcn.00534620
call fcn.00517b60
int3