Function at 0x4c5400
Capabilities:
Resolve function by parsing pe exports
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x430
mov eax, dword [0x603024]
xor eax, ebp
mov dword [esp + 0x428], eax
mov dword [esp + 0x14], ecx
mov eax, dword [ecx]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x70]
mov dword [eax], 0xffffffff
mov esi, 0x4000
mov ebx, 0x14
push 0x4000
call fcn.005039d3
add esp, 4
lea ecx, [esp + 0x70]
push ecx
push esi
mov dword [esp + 0x20], eax
push eax
push 5
call fcn.0058aaa0
add esp, 0x10
mov edi, eax
cmp eax, 0xc0000023
je 0x4c546e
cmp edi, 0xc0000004
jne 0x4c54d5
mov esi, dword [esp + 0x70]
mov eax, 0x1000
add esi, eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4c548a
push eax
call fcn.005039dc
add esp, 4
push esi
call fcn.005039d3
add esp, 4
dec ebx
jne 0x4c5448
mov dword [esp + 0x18], eax
push 2
call fcn.004e0f90
add esp, 4
test al, al
jne 0x4c5c24
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4c54bd
push ecx
call fcn.005039dc
add esp, 4
mov ecx, dword [esp + 0x428]
xor ecx, ebp
call fcn.00504b53
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
test edi, edi
js 0x4c556e
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov edi, eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], ecx
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x44], edi
je 0x4c5577
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x4c550e
add dword [esp + 0xc], eax
jne 0x4c54f5
push 2
call fcn.004e0f90
add esp, 4
test al, al
je 0x4c54ac
lea ebx, [esp + 0x120]
mov ecx, ebx
push 2
push 0x6b
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.0045d3f0
lea eax, [esp + 0x128]
push 8
push str.process
push eax
call fcn.005364d0
add esp, 0xc
mov ecx, eax
push edi
call fcn.0042abb0
push 0xa
push str._not_found
push eax
call fcn.005364d0
add esp, 0xc
mov ecx, ebx
call fcn.0045d7d0
jmp 0x4c54ac
mov eax, dword [esp + 0x18]
jmp 0x4c5496
cmp dword [esp + 0xc], 0
je 0x4c54b0
mov eax, dword [esp + 0xc]
cmp dword [eax + 4], 0
je 0x4c54b0
lea eax, [edx + 0x58]
mov dword [esp + 0x28], eax
lea eax, [edx + 0xb8]
mov dword [esp + 0x24], eax
pcmpeqd xmm0, xmm0
xor eax, eax
xor ebx, ebx
lea edi, [esp + 0x3e8]
movdqu xmmword [edi + 0x30], xmm0
movdqu xmmword [edi + 0x20], xmm0
movdqu xmmword [edi + 0x10], xmm0
movdqu xmmword [edi], xmm0
push 0x2cc
push eax
lea eax, [esp + 0x128]
push eax
call fcn.005072d0
add esp, 0xc
mov dword [esp + 0x2c], ebx
mov ecx, dword [esp + 0xc]
shl ebx, 6
lea eax, [ecx + ebx]
add eax, 0xd8
pxor xmm0, xmm0
movdqu xmmword [edi + 0x10], xmm0
movdqu xmmword [edi + 0x20], xmm0
movdqu xmmword [edi + 0x2c], xmm0
mov ecx, dword [eax + 4]
mov dword [esp + 0x3f0], ecx
xor edx, edx
mov dword [esp + 0x3f4], edx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x50], 0x18
lea ecx, [esp + 0x54]
mov dword [ecx + 0x10], edx
movdqu xmmword [ecx], xmm0
push eax
lea eax, [esp + 0x54]
push eax
push 0x4a
lea eax, [esp + 0x3c]
push eax
call fcn.0058aa10
add esp, 0x10
test eax, eax
js 0x4c57ab
mov edi, dword [esp + 0x30]
test edi, edi
je 0x4c5c04
mov eax, dword [esp + 0x14]
mov dl, byte [eax + 0xd0]
mov eax, dword [esp + 0x3f0]
mov ecx, dword fs:[0x18]
xor eax, dword [ecx + 0x24]
or eax, dword [esp + 0x3f4]
mov dword [esp + 0x10], edi
jne 0x4c57f7
mov dword [esp + 0x418], 0
lea eax, [esp + 0x120]
push eax
call fcn.00503ed0
add esp, 4
mov dword [esp + 0x41c], 0x20
mov eax, dword [esp + 0xc]
mov eax, dword [eax + ebx + 0xe0]
mov dword [esp + 0x420], eax
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 0x5c], xmm0
movdqa xmmword [esp + 0x50], xmm0
xor esi, esi
push esi
push 0x1c
lea eax, [esp + 0x58]
push eax
push esi
push edi
call fcn.0058ab30
add esp, 0x14
test eax, eax
js 0x4c58a1
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 0x3c], xmm0
movdqa xmmword [esp + 0x30], xmm0
mov eax, dword [esp + 0x54]
mov dword [esp + 0x3fc], esi
mov dword [esp + 0x3f8], eax
mov dword [esp + 0x404], esi
mov dword [esp + 0x400], 0xf98
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x30]
push edx
push esi
push 0x1c
push esi
push eax
call fcn.0059bb30
test al, al
mov esi, dword [esp + 0x14]
je 0x4c5aca
cmp byte [ebp + 8], 0
je 0x4c5a0e
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 0x7c], xmm0
movdqa xmmword [esp + 0x70], xmm0
mov eax, dword [esp + 0x30]
xor edi, edi
mov dword [esp + 0x3fc], edi
mov dword [esp + 0x3f8], eax
mov dword [esp + 0x404], edi
mov dword [esp + 0x400], 0xf98
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x70]
push edx
push edi
push 0x1c
push edi
push eax
call fcn.0059bb30
mov esi, 0
mov ecx, 0
test al, al
je 0x4c5a18
mov esi, dword [esp + 0x74]
mov ecx, dword [esp + 0x78]
jmp 0x4c5a18
mov edi, eax
push 2
call fcn.004e0f90
add esp, 4
test al, al
je 0x4c5c04
lea esi, [esp + 0x70]
mov ecx, esi
push edi
push 2
push 0x7a
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.0058add0
push 0xc
push str.NtOpenThread
lea eax, [esp + 0x80]
push eax
call fcn.005364d0
add esp, 0xc
mov ecx, esi
call fcn.0058ae00
jmp 0x4c5c04
mov byte [esp + 0x20], dl
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x4c58f0
mov edi, eax
mov al, byte [esp + 0x20]
test al, al
mov dword [esp + 0x1c], ebx
je 0x4c592f
test edi, edi
jne 0x4c592f
xor edi, edi
push 1
call fcn.004e0f90
add esp, 4
test al, al
je 0x4c5934
lea esi, [esp + 0x70]
mov ecx, esi
push 1
push 0x9b
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.0045d3f0
push 7
push str.Thread
lea eax, [esp + 0x80]
push eax
call fcn.005364d0
add esp, 0xc
mov ecx, eax
push dword [esp + 0x3f4]
push dword [esp + 0x3f4]
call fcn.0042b010
push 0x34
push str._should_be_suspended__but_previous_suspend_count_is
push eax
call fcn.005364d0
add esp, 0xc
mov ecx, eax
push 0
call fcn.0042abb0
mov ecx, esi
call fcn.0045d7d0
jmp 0x4c5934
mov edi, eax
push 2
call fcn.004e0f90
add esp, 4
test al, al
je 0x4c5bf7
lea esi, [esp + 0x70]
mov ecx, esi
push edi
push 2
push 0x15a
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.0058add0
push 0x18
push str.NtQueryInformationThread
lea eax, [esp + 0x80]
push eax
call fcn.005364d0
add esp, 0xc
mov ecx, esi
call fcn.0058ae00
jmp 0x4c5bf7
push 2
call fcn.004e0f90
add esp, 4
test al, al
mov edi, dword [esp + 0x10]
je 0x4c5bfb
call fcn.0055df20
lea edi, [esp + 0x70]
mov ecx, edi
push eax
push 2
push 0x96
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.0055e050
push 0xd
push 0x5f9c35
jmp 0x4c59ee
movzx eax, al
sub edi, eax
mov dword [esp + 0x418], edi
push 0x2cc
push 0
lea esi, [esp + 0x128]
push esi
call fcn.005072d0
add esp, 0xc
mov dword [esp + 0x120], 0x1003f
push esi
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x4c59b8
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
mov ebx, dword [esp + 0x1c]
jne 0x4c569d
push 2
call fcn.004e0f90
add esp, 4
test al, al
je 0x4c5bfb
call fcn.0055df20
lea edi, [esp + 0x70]
mov ecx, edi
push eax
push 2
push 0xbb
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.0055e050
push 0xc
push 0x5f9c91
jmp 0x4c59ee
push 2
call fcn.004e0f90
add esp, 4
test al, al
je 0x4c5bfb
call fcn.0055df20
lea edi, [esp + 0x70]
mov ecx, edi
push eax
push 2
push 0xb5
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.0055e050
push 0x10
push 0x5f9c80
lea eax, [esp + 0x80]
push eax
call fcn.005364d0
add esp, 0xc
mov ecx, edi
mov edi, dword [esp + 0x10]
call fcn.0055e0b0
jmp 0x4c5bfb
xor edi, edi
mov esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x408], ecx
mov dword [esp + 0x40c], edi
cmp esi, ecx
mov eax, edi
sbb eax, edi
jae 0x4c5ab2
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ecx
xor esi, esi
push 2
call fcn.004e0f90
add esp, 4
mov ecx, 0
test al, al
je 0x4c5ab8
lea esi, [esp + 0x70]
mov ecx, esi
push 2
push 0x17a
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.0045d3f0
push 0x15
push str.invalid_stack_range:
lea eax, [esp + 0x80]
push eax
call fcn.005364d0
add esp, 0xc
mov ecx, eax
push edi
push dword [esp + 0x20]
call fcn.0042b010
push 3
push 0x5f2d2e
push eax
call fcn.005364d0
add esp, 0xc
mov ecx, eax
push edi
push dword [esp + 0x24]
call fcn.0042b010
mov ecx, esi
call fcn.0045d7d0
xor esi, esi
xor ecx, ecx
jmp 0x4c5ab8
sub esi, ecx
sbb edi, edi
mov ecx, edi
mov dword [esp + 0x410], esi
mov dword [esp + 0x414], ecx
mov esi, dword [esp + 0x14]
mov edi, dword [esi + 0xbc]
cmp edi, dword [esi + 0xc0]
je 0x4c5afc
mov ebx, 0x308
push ebx
lea eax, [esp + 0x124]
push eax
push edi
call fcn.00506d50
add esp, 0xc
add edi, ebx
mov dword [esi + 0xbc], edi
jmp 0x4c5bf7
mov eax, dword [esp + 0x24]
sub edi, dword [eax]
mov eax, edi
mov ecx, 0x151d07eb
imul ecx
mov edi, edx
mov eax, edx
shr eax, 0x1f
sar edi, 6
lea ecx, [edi + eax]
inc ecx
cmp ecx, 0x547420
jae 0x4c5c5f
add edi, eax
lea eax, [edi + edi]
cmp eax, ecx
cmova ecx, eax
cmp edi, 0x2a3a0f
mov eax, 0x54741f
cmovae ecx, eax
test ecx, ecx
je 0x4c5b62
cmp ecx, 0x547420
jae 0x4c5c68
imul eax, ecx, 0x308
push eax
mov esi, ecx
call fcn.0050397a
mov ecx, esi
add esp, 4
jmp 0x4c5b64
xor eax, eax
imul esi, edi, 0x308
add esi, eax
imul ecx, ecx, 0x308
add ecx, eax
mov dword [esp + 0x20], ecx
mov edi, 0x308
push edi
lea eax, [esp + 0x124]
push eax
push esi
call fcn.00506d50
add esp, 0xc
lea ecx, [esi + edi]
mov eax, dword [esp + 0x14]
mov ebx, dword [eax + 0xb8]
mov edi, dword [eax + 0xbc]
cmp edi, ebx
je 0x4c5bd0
mov dword [esp + 0x1c], ecx
mov eax, 0xfffffcf8
add edi, eax
add esi, eax
push 0x308
push edi
push esi
call fcn.00506d50
add esp, 0xc
cmp edi, ebx
jne 0x4c5baa
mov eax, dword [esp + 0x24]
mov edi, dword [eax]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [eax + 0xb8], esi
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0x20]
mov dword [eax + 0xc0], ecx
test edi, edi
je 0x4c5bf7
push edi
call fcn.005039aa
add esp, 4
mov edi, dword [esp + 0x10]
push edi
call fcn.00494650
add esp, 4
mov ebx, dword [esp + 0x2c]
inc ebx
mov eax, dword [esp + 0xc]
cmp ebx, dword [eax + 4]
pcmpeqd xmm0, xmm0
mov eax, 0
jb 0x4c55a9
jmp 0x4c54ac
lea ebx, [esp + 0x120]
mov ecx, ebx
push edi
push 2
push 0x59
push str..._.._third_party_crashpad_crashpad_snapshot_win_process_reader_win.cc
call fcn.0058add0
lea eax, [esp + 0x128]
push 0x18
push str.NtQuerySystemInformation
push eax
call fcn.005364d0
add esp, 0xc
mov ecx, ebx
call fcn.0058ae00
jmp 0x4c54ac
mov ecx, dword [esp + 0x24]
call fcn.00536260
call fcn.00518ff0
int3