Function at 0x140049510
Capabilities:
Create process memory minidump
Enumerate threads
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
movaps xmmword [rsp + 0x240], xmm7
movaps xmmword [rsp + 0x230], xmm6
mov qword [rsp + 0x38], rcx
mov rax, qword [0x14019c018]
xor rax, rsp
mov qword [rsp + 0x228], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
mov ecx, 4
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
test rax, rax
je 0x14004960c
mov rdi, rax
xorps xmm0, xmm0
lea rdx, [rsp + 0x40]
movups xmmword [rdx + 4], xmm0
mov qword [rdx + 0x14], 0
mov dword [rdx], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x140049603
lea rbx, [rsp + 0x40]
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r12, qword [sym.imp.KERNEL32.dll_OpenThread]
mov r13, qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x40], 0x10
jb 0x1400495ec
cmp dword [rsp + 0x48], esi
je 0x1400495ec
mov ebp, dword [rsp + 0x4c]
call r15
cmp ebp, eax
jne 0x1400495ec
mov r8d, dword [rsp + 0x48]
mov ecx, 2
xor edx, edx
call r12
test rax, rax
je 0x1400495ec
mov rbp, rax
mov rcx, rax
call r13
mov rcx, rbp
call r14
mov dword [rsp + 0x40], 0x1c
mov rcx, rdi
mov rdx, rbx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1400495b1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x1401aa464], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r13d, eax
movabs rbp, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x210]
mov qword [rsi + 0x10], rbp
movaps xmm6, xmmword [0x140173f60]
movaps xmmword [rsi], xmm6
mov rcx, rsi
call fcn.140050320
mov ecx, 0x2711
mov rdx, rsi
call fcn.140053990
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x140049672
mov rax, qword [rsp + 0x218]
test rax, rax
je 0x140049986
lea rax, str.handler
lea r8, [rsp + 0x200]
mov qword [r8], rax
mov qword [r8 + 8], 7
lea rsi, [rsp + 0x210]
lea rbx, [rsp + 0x40]
mov rcx, rsi
mov rdx, rbx
call fcn.1400523c0
mov rcx, rsi
mov rdx, rbx
call fcn.1400504f0
mov rcx, rbx
call fcn.140050480
mov rcx, rsi
call fcn.140074170
test al, al
jne 0x1400496e1
lea rcx, [rsp + 0x210]
call fcn.140075310
test al, al
je 0x140049986
lea rsi, [rsp + 0x1e0]
mov qword [rsi + 0x10], rbp
movaps xmmword [rsi], xmm6
lea rdx, [0x14017b8e5]
lea r12, [rsp + 0x1b8]
mov rcx, r12
mov r8d, edi
call fcn.140075320
lea r8, str.mmcrashpad_handler_
xor ebp, ebp
mov rcx, r12
xor edx, edx
call fcn.14004422c
movups xmm0, xmmword [rax]
lea rcx, [rsp + 0x180]
movaps xmmword [rcx], xmm0
mov rdx, qword [rax + 0x10]
mov qword [rcx + 0x10], rdx
mov qword [rax + 0x10], rbp
xorps xmm7, xmm7
movups xmmword [rax], xmm7
lea rdx, str..dmp
call fcn.140044650
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x50], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
movups xmmword [rax], xmm7
mov qword [rax + 0x10], rbp
movzx eax, byte [rsp + 0x57]
test al, al
cmovs rbx, qword [rsp + 0x40]
lea r8, [rsp + 0x1d0]
mov qword [r8], rbx
cmovs rax, qword [rsp + 0x48]
mov qword [r8 + 8], rax
lea rcx, [rsp + 0x210]
mov rdx, rsi
call fcn.1400523c0
cmp byte [rsp + 0x57], 0
jns 0x1400497a4
mov rcx, qword [rsp + 0x40]
call fcn.1401349d4
cmp byte [rsp + 0x197], 0
jns 0x1400497bb
mov rcx, qword [rsp + 0x180]
call fcn.1401349d4
cmp byte [rsp + 0x1cf], 0
jns 0x1400497d2
mov rcx, qword [rsp + 0x1b8]
call fcn.1401349d4
lea rsi, [rsp + 0x180]
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
lea rdx, [rsp + 0x1e0]
mov rcx, rsi
mov r8d, 0x68
call fcn.140075ce0
mov rcx, rsi
call fcn.140075f30
test al, al
je 0x1400498ad
mov dword [rsp + 0x1b8], r13d
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x1bc], rax
mov dword [rsp + 0x1c4], 0
lea rcx, [rsp + 0x180]
call fcn.140075f40
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r12
mov rcx, r15
mov edx, edi
mov r8, rax
xor r9d, r9d
call sub.dbghelp.dll_MiniDumpWriteDump
test eax, eax
je 0x140049909
xor ecx, ecx
call fcn.14006c840
test al, al
je 0x14004995f
lea rdx, str..._.._third_party_crashpad_crashpad_handler_handler_main.cc
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r8d, 0x1dc
xor r9d, r9d
call fcn.14006c8f0
lea rcx, [rsp + 0x50]
lea rdx, str.Dump_file_created_successfully.
mov r8d, 0x1f
call fcn.14001df3c
mov rcx, rsi
call fcn.14006cd80
jmp 0x14004995f
mov ecx, 2
call fcn.14006c840
test al, al
je 0x14004996c
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_handler_handler_main.cc
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r8d, 0x1c3
mov r9d, 2
call fcn.14006d900
lea rcx, [rsp + 0x50]
lea rdx, str.Failed_to_create_dump_file.
mov r8d, 0x1b
call fcn.14001df3c
mov rcx, rsi
call fcn.14006d9f0
jmp 0x14004996c
mov ecx, 2
call fcn.14006c840
test al, al
je 0x14004995f
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_handler_handler_main.cc
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r8d, 0x1d7
mov r9d, 2
call fcn.14006d900
lea rcx, [rsp + 0x50]
lea rdx, str.Failed_to_write_dump_file.
mov r8d, 0x1a
call fcn.14001df3c
mov rcx, rsi
call fcn.14006d9f0
lea rcx, [rsp + 0x180]
call fcn.140075f80
lea rcx, [rsp + 0x180]
call fcn.140075e90
lea rcx, [rsp + 0x1e0]
call fcn.140050480
lea rcx, [rsp + 0x210]
call fcn.140050480
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.140135280
xor eax, eax
movaps xmm6, xmmword [rsp + 0x230]
movaps xmm7, xmmword [rsp + 0x240]
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret