Function at 0x140065530
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2d8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x240], xmm6
mov qword [rbp + 0x238], 0xfffffffffffffffe
mov byte [rbp + 0x237], dl
mov qword [rbp + 0x218], rcx
mov rsi, qword [rcx]
mov qword [rbp + 0x228], 0
mov ecx, 0x4000
call fcn.14008ded8
mov r13, rax
mov r14d, 0x4000
xor r15d, r15d
lea rdi, [rbp + 0x178]
mov r12d, 0x1000
nop dword [rax + rax]
mov qword [rbp + 0x228], r13
mov ecx, 5
mov rdx, r13
mov r8d, r14d
mov r9, rdi
call fcn.140056ec0
mov ebx, eax
cmp eax, 0xc0000023
je 0x1400655cf
cmp ebx, 0xc0000004
jne 0x14006567d
mov r14d, dword [rbp + 0x178]
add r14d, r12d
mov rcx, r13
call fcn.14008dee0
mov qword [rbp + 0x228], 0
mov rcx, r14
call fcn.14008ded8
mov r13, rax
inc r15d
cmp r15d, 0x14
jne 0x1400655a0
mov qword [rbp + 0x228], r13
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
lea rdx, str.process_types::SYSTEM_PROCESS_INFORMATION_Traits____cdecl_crashpad::_anonymous_namespace_::GetProcessInformation_HANDLE__std::unique_ptr_uint8_t_______Traits__crashpad::process_types::internal::Traits64_
lea r8, str.third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
lea rcx, [rbp - 0x48]
mov r9d, 0x5f
call fcn.140005e40
mov qword [rbp + 0x220], r13
lea rdx, str.NtQuerySystemInformation
lea rcx, [rbp - 0x48]
mov r8d, 0x18
call fcn.140003fb0
lea rcx, [rbp - 0x48]
call fcn.140057490
mov rcx, qword [rbp + 0x220]
call fcn.14008dee0
movaps xmm6, xmmword [rbp + 0x240]
add rsp, 0x2d8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
test ebx, ebx
js 0x140065600
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov esi, eax
mov qword [rbp + 0x220], r13
mov rcx, qword [rbp + 0x218]
nop
cmp dword [r13 + 0x50], esi
je 0x14006572c
mov eax, dword [r13]
add r13, rax
test rax, rax
jne 0x1400656a0
mov rax, qword [rbp + 0x220]
mov qword [rbp + 0x228], rax
mov dword [rsp + 0x20], 2
lea rdx, str.process_types::SYSTEM_PROCESS_INFORMATION_Traits____cdecl_crashpad::_anonymous_namespace_::GetProcessInformation_HANDLE__std::unique_ptr_uint8_t_______Traits__crashpad::process_types::internal::Traits64_
lea r8, str.third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
lea rcx, [rbp - 0x48]
mov r9d, 0x71
call fcn.140005340
lea rdx, str.process
lea rcx, [rbp - 0x48]
mov r8d, 8
call fcn.140003fb0
mov rcx, rax
mov edx, esi
call fcn.14001d9a0
lea rdx, str._not_found
mov r8d, 0xa
mov rcx, rax
call fcn.140003fb0
lea rcx, [rbp - 0x48]
call fcn.140005c30
jmp 0x140065656
lea rsi, [rbp + 0x188]
lea rax, [rcx + 0x90]
mov qword [rbp + 0x1f0], rax
lea rax, [rcx + 0x130]
mov qword [rbp + 0x168], rax
lea rax, [rcx + 0x148]
mov qword [rbp + 0x170], rax
xorps xmm6, xmm6
lea r15, [rbp - 0x48]
xor r14d, r14d
jmp 0x140065773
inc r14d
cmp r14d, dword [r13 + 4]
jae 0x140065656
mov eax, r14d
lea rbx, [rax + rax*4]
shl rbx, 4
mov qword [rbp + 0x178], 0
mov byte [rbp + 0x180], 0
movups xmmword [rsi + 0x50], xmm6
movups xmmword [rsi + 0x40], xmm6
movups xmmword [rsi + 0x30], xmm6
movups xmmword [rsi + 0x20], xmm6
movups xmmword [rsi + 0x10], xmm6
movups xmmword [rsi], xmm6
mov dword [rsi + 0x60], 0
lea r9, [r13 + rbx + 0x128]
mov rax, qword [r13 + rbx + 0x130]
mov qword [rbp + 0x1b8], rax
mov dword [rbp + 0x110], 0x30
lea rax, [rbp + 0x118]
movups xmmword [rax], xmm6
mov dword [rax + 0x10], 0
movups xmmword [rax + 0x18], xmm6
lea rcx, [rbp + 0xe0]
mov edx, 0x4a
lea r8, [rbp + 0x110]
call fcn.1400573b0
test eax, eax
js 0x1400658a0
mov rdi, qword [rbp + 0xe0]
mov qword [rbp + 0x158], rdi
test rdi, rdi
je 0x140065e4b
mov r12, r15
mov rax, qword [rbp + 0x218]
movzx r15d, byte [rax + 0x160]
mov rax, qword [rbp + 0x1b8]
mov rcx, qword gs:[0x30]
cmp rax, qword [rcx + 0x48]
jne 0x1400658ea
mov dword [rbp + 0x1e0], 0
mov rcx, qword [rbp + 0x188]
mov rax, qword [rbp + 0x190]
sub rax, rcx
cmp rax, 0x4cf
ja 0x140065986
mov edx, 0x4d0
sub rdx, rax
mov rcx, rsi
call fcn.14005fb40
mov rcx, qword [rbp + 0x188]
jmp 0x14006599c
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov rcx, r15
lea rdx, str.HANDLE___cdecl_crashpad::_anonymous_namespace_::OpenThread_const_process_types::SYSTEM_THREAD_INFORMATION_Traits_____Traits__crashpad::process_types::internal::Traits64_
lea r8, str.third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0x80
call fcn.140005e40
mov r8d, 0xc
mov rcx, r15
lea rdx, str.NtOpenThread
call fcn.140003fb0
mov rcx, r15
call fcn.140057490
jmp 0x140065e4b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x140065ac8
test r15b, r15b
je 0x140065b12
test eax, eax
jne 0x140065b12
mov dword [rsp + 0x20], 1
mov rcx, r12
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::FillThreadContextAndSuspendCount_HANDLE__ProcessReaderWin::Thread___ProcessSuspensionState__bool___Traits__crashpad::process_types::internal::Traits64_
lea r8, str.third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0xa1
call fcn.140005340
mov r8d, 7
mov r15, r12
mov rcx, r12
lea rdx, str.Thread
call fcn.140003fb0
mov rdx, qword [rbp + 0x1b8]
mov rcx, rax
call fcn.14001df40
mov r8d, 0x34
mov rcx, rax
lea rdx, str._should_be_suspended__but_previous_suspend_count_is
call fcn.140003fb0
mov rcx, rax
xor edx, edx
call fcn.14001d9a0
mov rcx, r15
call fcn.140005c30
xor eax, eax
jmp 0x140065b18
cmp rax, 0x4d0
je 0x14006599c
lea rax, [rcx + 0x4d0]
mov qword [rbp + 0x190], rax
mov byte [rbp + 0x180], 1
add rcx, qword [rbp + 0x178]
call fcn.1400527d0
lea rax, [rbx + r13]
add rax, 0x100
mov dword [rbp + 0x1e4], 0x20
mov eax, dword [rax + 0x38]
mov dword [rbp + 0x1e8], eax
mov qword [rsp + 0x20], 0
mov rcx, rdi
xor edx, edx
lea r8, [rbp + 0xe0]
mov r9d, 0x30
call fcn.140056fa0
test eax, eax
js 0x140065a7b
mov rdx, qword [rbp + 0xe8]
mov qword [rbp + 0x1c0], rdx
mov qword [rbp + 0x1c8], 0x1788
mov r8d, 0x38
mov rcx, qword [rbp + 0x1f0]
lea r9, [rbp + 0x110]
call fcn.14006a6d0
test al, al
je 0x140065c78
cmp byte [rbp + 0x237], 0
je 0x140065b5d
mov rdx, qword [rbp + 0x110]
mov qword [rbp + 0x1c0], rdx
mov qword [rbp + 0x1c8], 0xf98
mov r8d, 0x1c
mov rcx, qword [rbp + 0x1f0]
mov r9, r12
call fcn.14006a6d0
test al, al
jne 0x140065bed
xor ebx, ebx
xor r15d, r15d
jmp 0x140065bf4
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov rcx, r12
lea rdx, str.void___cdecl_crashpad::ProcessReaderWin::ReadThreadData_bool___Traits__crashpad::process_types::internal::Traits64_
lea r8, str.third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0x1ab
call fcn.140005e40
mov r8d, 0x18
mov r15, r12
mov rcx, r12
lea rdx, str.NtQueryInformationThread
call fcn.140003fb0
mov rcx, r15
call fcn.140057490
jmp 0x140065e43
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov rcx, r12
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::FillThreadContextAndSuspendCount_HANDLE__ProcessReaderWin::Thread___ProcessSuspensionState__bool___Traits__crashpad::process_types::internal::Traits64_
lea r8, str.third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0x9c
call fcn.140005e40
mov r8d, 0xd
mov r15, r12
mov rcx, r12
lea rdx, [0x1400c9378]
call fcn.140003fb0
jmp 0x140065be0
movzx ecx, r15b
sub eax, ecx
mov dword [rbp + 0x1e0], eax
cmp byte [rbp + 0x237], 0
je 0x140065b38
lea rcx, [rbp + 0x178]
mov rdx, rdi
call fcn.140064cb0
jmp 0x140065b7f
mov ecx, 0x800
call fcn.14007d190
test al, al
je 0x140065b70
mov r8d, 0x800
lea rcx, [rbp + 0x178]
mov rdx, rdi
call fcn.140064dd0
jmp 0x140065b7f
mov rbx, qword [rbp + 0x118]
mov r15, qword [rbp + 0x120]
jmp 0x140065bf4
lea rcx, [rbp + 0x178]
mov rdx, rdi
call fcn.140064b90
test al, al
mov r15, r12
je 0x140065e43
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x1400659af
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 2
mov rcx, r12
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::FillThreadContextAndSuspendCount_HANDLE__ProcessReaderWin::Thread___ProcessSuspensionState__bool___Traits__crashpad::process_types::internal::Traits64_
lea r8, str.third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0xc0
call fcn.140005e40
mov r8d, 0xc
mov r15, r12
mov rcx, r12
lea rdx, [0x1400c93c3]
call fcn.140003fb0
mov rcx, r15
call fcn.140005e70
jmp 0x140065e43
mov ebx, dword [rbp - 0x44]
mov r15d, dword [rbp - 0x40]
mov qword [rbp + 0x1d0], r15
mov rax, rbx
sub rax, r15
jae 0x140065c71
mov dword [rsp + 0x20], 2
mov rcx, r12
lea rdx, str.void___cdecl_crashpad::ProcessReaderWin::ReadThreadData_bool___Traits__crashpad::process_types::internal::Traits64_
lea r8, str.third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0x1cb
call fcn.140005340
mov r8d, 0x15
mov rcx, r12
lea rdx, str.invalid_stack_range:
call fcn.140003fb0
mov rcx, rax
mov rdx, rbx
call fcn.14001df40
mov r8d, 3
mov rcx, rax
lea rdx, [0x1400c90c9]
call fcn.140003fb0
mov rcx, rax
mov rdx, r15
call fcn.14001df40
mov rcx, r12
call fcn.140005c30
xor eax, eax
mov qword [rbp + 0x1d8], rax
mov eax, dword [0x1401037c0]
mov ecx, dword [0x1401025a8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
mov r15, r12
jg 0x140065e81
mov rax, qword [0x1401037b8]
test rax, rax
je 0x140065dd3
mov rcx, rdi
lea rdx, [rbp + 0x160]
call rax
mov ebx, eax
test eax, eax
js 0x140065cf0
mov rbx, qword [rbp + 0x160]
mov qword [rbp + 0x200], rbx
mov qword [rbp + 0x148], rbx
test rbx, rbx
mov r15, r12
je 0x140065d89
mov rcx, rbx
call fcn.1400a6280
jmp 0x140065d8b
mov dword [rsp + 0x20], 1
mov rcx, r12
lea rdx, str.void___cdecl_crashpad::ProcessReaderWin::ReadThreadData_bool___Traits__crashpad::process_types::internal::Traits64_
lea r8, str.third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
mov r9d, 0x1dc
call fcn.140005340
mov r8d, 0x16
mov rcx, r12
lea rdx, str.GetThreadDescription:
call fcn.140003fb0
mov r15, rax
lea rcx, [rbp + 0x200]
mov edx, ebx
call fcn.140005200
lea rax, [rbp + 0x200]
movzx r8d, byte [rbp + 0x217]
test r8b, r8b
cmovs r8, qword [rbp + 0x208]
mov rdx, qword [rbp + 0x200]
cmovns rdx, rax
mov rcx, r15
call fcn.140003fb0
cmp byte [rbp + 0x217], 0
mov r15, r12
jns 0x140065d7f
mov rcx, qword [rbp + 0x200]
call fcn.14008de68
mov rcx, r15
call fcn.140005c30
jmp 0x140065dd3
xor eax, eax
mov qword [rbp + 0x150], rax
mov rcx, r15
lea rdx, [rbp + 0x148]
call fcn.1400164b0
cmp byte [rbp + 0x1b7], 0
jns 0x140065db6
mov rcx, qword [rbp + 0x1a0]
call fcn.14008de68
mov rax, qword [rbp - 0x38]
mov qword [rsi + 0x28], rax
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rsi + 0x18], xmm0
test rbx, rbx
je 0x140065dd3
mov rcx, rbx
call fcn.140063830
mov rax, qword [rbp + 0x218]
mov rdx, qword [rax + 0x138]
cmp rdx, qword [rax + 0x140]
jae 0x140065e1f
mov rcx, qword [rbp + 0x170]
mov qword [rbp + 0x1f8], rdx
lea r8, [rbp + 0x178]
call fcn.1400667e0
mov rax, qword [rbp + 0x1f8]
add rax, 0x78
mov rcx, qword [rbp + 0x218]
mov qword [rcx + 0x138], rax
jmp 0x140065e3c
mov rcx, qword [rbp + 0x168]
lea rdx, [rbp + 0x178]
call fcn.140066530
mov rcx, qword [rbp + 0x218]
mov r15, r12
mov qword [rcx + 0x138], rax
mov rcx, rdi
call fcn.140045fa0
cmp byte [rbp + 0x1b7], 0
jns 0x140065e60
mov rcx, qword [rbp + 0x1a0]
call fcn.14008de68
mov rcx, qword [rbp + 0x188]
test rcx, rcx
je 0x140065770
mov qword [rbp + 0x190], rcx
call fcn.14008de68
jmp 0x140065770
lea rcx, [0x1401037c0]
call fcn.14008dca0
cmp dword [0x1401037c0], 0xffffffff
jne 0x140065ca0
lea rcx, [0x1400bfcd4]
lea rdx, str.::GetThreadDescription
xor r8d, r8d
call fcn.140051790
mov qword [0x1401037b8], rax
lea rcx, [0x1401037c0]
call fcn.14008dd38
mov r15, r12
jmp 0x140065ca0