Function at 0x14038cc00
Capabilities:
Resume thread
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2d8
movaps xmmword [rsp + 0x2c0], xmm7
movaps xmmword [rsp + 0x2b0], xmm6
mov byte [rsp + 0x2f], dl
mov rdi, rcx
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin], rax
mov r14, qword [rcx]
lea r15, [rsp + 0xf8]
mov dword [r15], 0xaaaaaaaa
mov ecx, 0x4000
call fcn.1402776fc
mov rsi, rax
mov r12d, 0x4000
mov r13d, reloc.WS2_32.dll_sendto
mov ebx, 0x1000
jmp 0x14038cc96
mov r12d, dword [rsp + 0xf8]
add r12d, ebx
test rsi, rsi
je 0x14038cc86
mov rcx, rsi
call fcn.140277704
mov ecx, r12d
call fcn.1402776fc
mov rsi, rax
dec r13d
je 0x14038ccf6
mov ecx, 5
mov rdx, rsi
mov r8d, r12d
mov r9, r15
call fcn.14032bb50
mov ebp, eax
cmp eax, 0xc0000023
je 0x14038cc6e
cmp ebp, 0xc0000004
je 0x14038cc6e
test ebp, ebp
js 0x14038ccf6
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov ebp, eax
mov r15, rsi
cmp dword [r15 + 0x50], ebp
je 0x14038cd98
mov eax, dword [r15]
test rax, rax
je 0x14038cce3
add r15, rax
jne 0x14038cccc
mov ecx, 2
call fcn.14021c050
test al, al
je 0x14038cd4d
jmp 0x14038cde7
mov ecx, 2
call fcn.14021c050
test al, al
je 0x14038cd4d
mov dword [rsp + 0x20], ebp
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
lea rdi, [rsp + 0x170]
mov rcx, rdi
mov r8d, 0x5f
mov r9d, 2
call fcn.14032bef0
lea rcx, [rsp + 0x180]
lea rdx, str.NtQuerySystemInformation
mov r8d, Ordinal_27
call fcn.1401f8290
mov rcx, rdi
call fcn.14032bf20
test rsi, rsi
je 0x14038cd5a
mov rcx, rsi
call fcn.140277704
mov rcx, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x14038cd74
call fcn.140278ca0
int3
movaps xmm6, xmmword [rsp + 0x2b0]
movaps xmm7, xmmword [rsp + 0x2c0]
add rsp, 0x2d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test r15, r15
je 0x14038cd4d
cmp dword [r15 + 4], 0
je 0x14038cd4d
movabs rbx, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0x108]
lea rax, [rdi + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rdi + 0x130]
mov qword [rsp + 0x48], rax
lea r13, [r15 + 0x128]
movaps xmm6, xmmword [0x1403d4b30]
xorps xmm7, xmm7
xor r14d, r14d
jmp 0x14038d19c
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
lea rdi, [rsp + 0x170]
mov rcx, rdi
mov r8d, WSACleanup
mov r9d, 2
call fcn.14010dcd0
lea rcx, [rsp + 0x180]
lea rdx, str.process
mov r8d, 8
call fcn.1401f8290
mov rcx, rax
mov edx, ebp
call fcn.1400c2fb0
lea rdx, str._not_found
mov r8d, 0xa
mov rcx, rax
call fcn.1401f8290
mov rcx, rdi
call fcn.14010e2d0
jmp 0x14038cd4d
mov qword [rsp + 0xb0], rbx
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
mov rdx, qword [rsp + 0xc8]
mov qword [rsp + 0x140], rdx
mov qword [rsp + 0x148], 0x1788
mov r8d, gethostname
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x80]
call fcn.140355d40
test al, al
je 0x14038cfcb
cmp byte [rsp + 0x2f], 0
jne 0x14038cec5
mov rcx, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x90]
jmp 0x14038cf26
movups xmmword [rsp + 0x17c], xmm6
movaps xmmword [rsp + 0x170], xmm6
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x140], rdx
mov qword [rsp + 0x148], 0xf98
mov r8d, 0x1c
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x170]
call fcn.140355d40
mov ecx, dword [rsp + 0x174]
mov ebp, dword [rsp + 0x178]
test al, al
mov eax, 0
cmove rcx, rax
cmove rbp, rax
mov qword [rsp + 0x150], rbp
mov rax, rcx
sub rax, rbp
jae 0x14038cfc3
mov qword [rsp + 0x38], rcx
mov ecx, 2
call fcn.14021c050
test al, al
je 0x14038cfc1
lea rcx, [rsp + 0x170]
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
mov r8d, 0x1cb
mov r9d, 2
call fcn.14010dcd0
mov r8d, reloc.WS2_32.dll_setsockopt
lea rcx, [rsp + 0x180]
lea rdx, str.invalid_stack_range:
call fcn.1401f8290
mov rcx, rax
mov rdx, qword [rsp + 0x38]
call fcn.1400c3200
mov r8d, 3
mov rcx, rax
lea rdx, [0x1403e0939]
call fcn.1401f8290
mov rcx, rax
mov rdx, rbp
call fcn.1400c3200
lea rcx, [rsp + 0x170]
call fcn.14010e2d0
xor eax, eax
mov qword [rsp + 0x158], rax
mov eax, dword [0x14044c9d0]
mov ecx, dword [0x14043f8b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14038d5e2
mov rax, qword [0x14044c9c8]
test rax, rax
je 0x14038d12c
mov qword [rsp + 0x78], rbx
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x78]
call qword [str._a_]
test eax, eax
jns 0x14038d0c0
mov ebp, eax
mov ecx, 1
call fcn.14021c050
test al, al
je 0x14038d12c
lea rcx, [rsp + 0x170]
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
mov r8d, 0x1dc
mov r9d, 1
call fcn.14010dcd0
mov r8d, Ordinal_27
lea rcx, [rsp + 0x180]
lea rdx, str.GetThreadDescription:
call fcn.1401f8290
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x50]
mov edx, ebp
call fcn.1402f6100
movsx r8, byte [rsp + 0x67]
lea rdx, [rsp + 0x50]
test r8, r8
jns 0x14038d096
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call fcn.1401f8290
cmp byte [rsp + 0x67], 0
jns 0x14038d0b1
mov rcx, qword [rsp + 0x50]
call fcn.1402776c8
lea rcx, [rsp + 0x170]
call fcn.14010e2d0
jmp 0x14038d12c
mov rbp, qword [rsp + 0x78]
mov qword [rsp + 0x68], rbp
test rbp, rbp
je 0x14038d5e0
mov rcx, rbp
call fcn.14029c474
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x170]
lea rdx, [rsp + 0x68]
call fcn.1402120b0
cmp byte [rsp + 0x137], 0
jns 0x14038d109
mov rcx, qword [rsp + 0x120]
call fcn.1402776c8
mov rax, qword [rsp + 0x180]
mov qword [r12 + 0x28], rax
movups xmm0, xmmword [rsp + 0x170]
movups xmmword [r12 + 0x18], xmm0
mov rcx, rbp
call fcn.14016fa90
mov rbp, qword [rdi + 0x138]
cmp rbp, qword [rdi + 0x140]
jb 0x14038d153
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0xf8]
call fcn.14038d7f0
mov rbp, rax
jmp 0x14038d167
mov rcx, rbp
lea rdx, [rsp + 0xf8]
call fcn.14038d950
add rbp, 0x78
mov qword [rdi + 0x138], rbp
mov rbp, qword [rsp + 0x30]
mov rcx, rbp
call fcn.14014a3a0
lea rcx, [rsp + 0xf8]
call fcn.14038d7a0
inc r14
mov eax, dword [r15 + 4]
add r13, 0x50
cmp r14, rax
jae 0x14038cd4d
movups xmmword [r12 + 0x58], xmm6
movups xmmword [r12 + 0x48], xmm6
movups xmmword [r12 + 0x38], xmm6
movups xmmword [r12 + 0x28], xmm6
movups xmmword [r12 + 0x18], xmm6
movups xmmword [r12 + 8], xmm6
movups xmmword [r12 - 8], xmm6
mov qword [rsp + 0xf8], 0
mov byte [rsp + 0x100], 0
xor ecx, ecx
mov dword [r12 + 0x60], ecx
movups xmmword [r12 + 0x50], xmm7
movups xmmword [r12 + 0x40], xmm7
movups xmmword [r12 + 0x30], xmm7
movups xmmword [r12 + 0x20], xmm7
movups xmmword [r12 + 0x10], xmm7
movups xmmword [r12], xmm7
mov rax, qword [r13 + 8]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0xc0], rbx
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x90], xmm6
mov dword [rsp + 0x80], gethostname
lea rax, [rsp + 0x88]
mov dword [rax + 0x10], ecx
movups xmmword [rax], xmm7
movups xmmword [rax + 0x18], xmm7
lea rcx, [rsp + 0xc0]
mov edx, 0x4a
lea r8, [rsp + 0x80]
mov r9, r13
call fcn.14032bab0
test eax, eax
jns 0x14038d2c8
mov ebp, eax
mov ecx, 2
call fcn.14021c050
test al, al
je 0x14038d17b
mov dword [rsp + 0x20], ebp
lea rbp, [rsp + 0x170]
mov rcx, rbp
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
mov r8d, Ordinal_133
mov r9d, 2
call fcn.14032bef0
mov r8d, recv
lea rcx, [rsp + 0x180]
lea rdx, str.NtOpenThread
call fcn.1401f8290
mov rcx, rbp
call fcn.14032bf20
jmp 0x14038d17b
mov rbp, qword [rsp + 0xc0]
test rbp, rbp
je 0x14038d17b
mov bl, byte [rdi + 0x160]
mov rax, qword [rsp + 0x138]
mov rcx, qword gs:[0x30]
cmp rax, qword [rcx + 0x48]
mov qword [rsp + 0x30], rbp
je 0x14038d38a
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x14038d465
mov ecx, 2
call fcn.14021c050
test al, al
movabs rbx, 0xaaaaaaaaaaaaaaaa
mov rbp, qword [rsp + 0x30]
je 0x14038d173
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rbp, [rsp + 0x170]
mov rcx, rbp
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
mov r8d, 0x9c
mov r9d, 2
call fcn.1402f6330
mov r8d, reloc.WS2_32.dll_listen
lea rcx, [rsp + 0x180]
lea rdx, [0x140419d74]
call fcn.1401f8290
mov rcx, rbp
mov rbp, qword [rsp + 0x30]
call fcn.1402f63a0
jmp 0x14038d173
mov dword [rsp + 0x160], 0
lea rcx, [rsp + 0xf8]
call fcn.14038c2c0
movabs rbx, 0xaaaaaaaaaaaaaaaa
mov dword [rsp + 0x164], Ordinal_41
mov eax, dword [r13 + 0x10]
mov dword [rsp + 0x168], eax
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0x20], 0
mov rcx, rbp
xor edx, edx
lea r8, [rsp + 0xc0]
mov r9d, 0x30
call fcn.14032bbf0
test eax, eax
jns 0x14038ce50
mov ebp, eax
mov ecx, 2
call fcn.14021c050
test al, al
je 0x14038d16e
mov dword [rsp + 0x20], ebp
lea rbp, [rsp + 0x170]
mov rcx, rbp
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
mov r8d, 0x1ab
mov r9d, 2
call fcn.14032bef0
mov r8d, Ordinal_27
lea rcx, [rsp + 0x180]
lea rdx, str.NtQueryInformationThread
call fcn.1401f8290
mov rcx, rbp
call fcn.14032bf20
jmp 0x14038d16e
mov ebp, eax
mov eax, ebx
xor al, 1
test ebp, ebp
setne cl
or cl, al
jne 0x14038d500
mov ecx, 1
call fcn.14021c050
xor ebp, ebp
test al, al
je 0x14038d505
lea rbx, [rsp + 0x170]
mov rcx, rbx
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
mov r8d, 0xa1
mov r9d, 1
call fcn.14010dcd0
mov r8d, 7
lea rcx, [rsp + 0x180]
lea rdx, str.Thread
call fcn.1401f8290
mov rdx, qword [rsp + 0x138]
mov rcx, rax
call fcn.1400c3200
mov r8d, gethostname
mov rcx, rax
lea rdx, str._should_be_suspended__but_previous_suspend_count_is
call fcn.1401f8290
xor ebp, ebp
mov rcx, rax
xor edx, edx
call fcn.1400c2fb0
mov rcx, rbx
call fcn.14010e2d0
jmp 0x14038d505
movzx eax, bl
sub ebp, eax
mov dword [rsp + 0x160], ebp
cmp byte [rsp + 0x2f], 0
movabs rbx, 0xaaaaaaaaaaaaaaaa
jne 0x14038d55a
mov ecx, 0x800
call fcn.1403a32c0
test al, al
mov rbp, qword [rsp + 0x30]
jne 0x14038d542
lea rcx, [rsp + 0xf8]
mov rdx, rbp
call fcn.14038c330
jmp 0x14038d56f
mov r8d, 0x800
lea rcx, [rsp + 0xf8]
mov rdx, rbp
call fcn.14038c590
jmp 0x14038d56f
lea rcx, [rsp + 0xf8]
mov rbp, qword [rsp + 0x30]
mov rdx, rbp
call fcn.14038c460
test al, al
je 0x14038d173
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x14038d3ac
mov ecx, 2
call fcn.14021c050
test al, al
je 0x14038d173
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rbp, [rsp + 0x170]
mov rcx, rbp
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
mov r8d, 0xc0
mov r9d, 2
call fcn.1402f6330
mov r8d, recv
lea rcx, [rsp + 0x180]
lea rdx, [0x140419dbf]
jmp 0x14038d373
ud2
lea rcx, [0x14044c9d0]
call fcn.14027770c
cmp dword [0x14044c9d0], 0xffffffff
jne 0x14038cff0
lea rcx, [0x1403e1038]
lea rdx, str.::GetThreadDescription
xor r8d, r8d
call fcn.14014ae50
mov qword [0x14044c9c8], rax
lea rcx, [0x14044c9d0]
call fcn.1402777c0
jmp 0x14038cff0