Function at 0x140049730
Capabilities:
Create process memory minidump
Enumerate threads
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
movaps xmmword [rsp + 0x240], xmm7
movaps xmmword [rsp + 0x230], xmm6
mov qword [rsp + 0x38], rcx
mov rax, qword [0x14019e018]
xor rax, rsp
mov qword [rsp + 0x228], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
mov ecx, 4
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
test rax, rax
je 0x14004982c
mov rdi, rax
xorps xmm0, xmm0
lea rdx, [rsp + 0x40]
movups xmmword [rdx + 4], xmm0
mov qword [rdx + 0x14], 0
mov dword [rdx], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x140049823
lea rbx, [rsp + 0x40]
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r12, qword [sym.imp.KERNEL32.dll_OpenThread]
mov r13, qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x40], 0x10
jb 0x14004980c
cmp dword [rsp + 0x48], esi
je 0x14004980c
mov ebp, dword [rsp + 0x4c]
call r15
cmp ebp, eax
jne 0x14004980c
mov r8d, dword [rsp + 0x48]
mov ecx, 2
xor edx, edx
call r12
test rax, rax
je 0x14004980c
mov rbp, rax
mov rcx, rax
call r13
mov rcx, rbp
call r14
mov dword [rsp + 0x40], 0x1c
mov rcx, rdi
mov rdx, rbx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1400497d1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x1401ac464], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r13d, eax
movabs rbp, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x210]
mov qword [rsi + 0x10], rbp
movaps xmm6, xmmword [0x140175f60]
movaps xmmword [rsi], xmm6
mov rcx, rsi
call fcn.140050540
mov ecx, 0x2711
mov rdx, rsi
call fcn.140053bb0
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x140049892
mov rax, qword [rsp + 0x218]
test rax, rax
je 0x140049ba6
lea rax, str.handler
lea r8, [rsp + 0x200]
mov qword [r8], rax
mov qword [r8 + 8], 7
lea rsi, [rsp + 0x210]
lea rbx, [rsp + 0x40]
mov rcx, rsi
mov rdx, rbx
call fcn.1400525e0
mov rcx, rsi
mov rdx, rbx
call fcn.140050710
mov rcx, rbx
call fcn.1400506a0
mov rcx, rsi
call fcn.140075390
test al, al
jne 0x140049901
lea rcx, [rsp + 0x210]
call fcn.140076530
test al, al
je 0x140049ba6
lea rsi, [rsp + 0x1e0]
mov qword [rsi + 0x10], rbp
movaps xmmword [rsi], xmm6
lea rdx, [0x14017d8e5]
lea r12, [rsp + 0x1b8]
mov rcx, r12
mov r8d, edi
call fcn.140076540
lea r8, str.mmcrashpad_handler_
xor ebp, ebp
mov rcx, r12
xor edx, edx
call fcn.14004435c
movups xmm0, xmmword [rax]
lea rcx, [rsp + 0x180]
movaps xmmword [rcx], xmm0
mov rdx, qword [rax + 0x10]
mov qword [rcx + 0x10], rdx
mov qword [rax + 0x10], rbp
xorps xmm7, xmm7
movups xmmword [rax], xmm7
lea rdx, str..dmp
call fcn.140044780
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x50], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
movups xmmword [rax], xmm7
mov qword [rax + 0x10], rbp
movzx eax, byte [rsp + 0x57]
test al, al
cmovs rbx, qword [rsp + 0x40]
lea r8, [rsp + 0x1d0]
mov qword [r8], rbx
cmovs rax, qword [rsp + 0x48]
mov qword [r8 + 8], rax
lea rcx, [rsp + 0x210]
mov rdx, rsi
call fcn.1400525e0
cmp byte [rsp + 0x57], 0
jns 0x1400499c4
mov rcx, qword [rsp + 0x40]
call fcn.140136864
cmp byte [rsp + 0x197], 0
jns 0x1400499db
mov rcx, qword [rsp + 0x180]
call fcn.140136864
cmp byte [rsp + 0x1cf], 0
jns 0x1400499f2
mov rcx, qword [rsp + 0x1b8]
call fcn.140136864
lea rsi, [rsp + 0x180]
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
lea rdx, [rsp + 0x1e0]
mov rcx, rsi
mov r8d, 0x68
call fcn.140076f00
mov rcx, rsi
call fcn.140077150
test al, al
je 0x140049acd
mov dword [rsp + 0x1b8], r13d
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x1bc], rax
mov dword [rsp + 0x1c4], 0
lea rcx, [rsp + 0x180]
call fcn.140077160
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r12
mov rcx, r15
mov edx, edi
mov r8, rax
xor r9d, r9d
call sub.dbghelp.dll_MiniDumpWriteDump
test eax, eax
je 0x140049b29
xor ecx, ecx
call fcn.14006d9d0
test al, al
je 0x140049b7f
lea rdx, str..._.._third_party_crashpad_crashpad_handler_handler_main.cc
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r8d, 0x1dc
xor r9d, r9d
call fcn.14006da80
lea rcx, [rsp + 0x50]
lea rdx, str.Dump_file_created_successfully.
mov r8d, 0x1f
call fcn.14001df3c
mov rcx, rsi
call fcn.14006df10
jmp 0x140049b7f
mov ecx, 2
call fcn.14006d9d0
test al, al
je 0x140049b8c
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_handler_handler_main.cc
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r8d, 0x1c3
mov r9d, 2
call fcn.14006ea90
lea rcx, [rsp + 0x50]
lea rdx, str.Failed_to_create_dump_file.
mov r8d, 0x1b
call fcn.14001df3c
mov rcx, rsi
call fcn.14006eb80
jmp 0x140049b8c
mov ecx, 2
call fcn.14006d9d0
test al, al
je 0x140049b7f
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_handler_handler_main.cc
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r8d, 0x1d7
mov r9d, 2
call fcn.14006ea90
lea rcx, [rsp + 0x50]
lea rdx, str.Failed_to_write_dump_file.
mov r8d, 0x1a
call fcn.14001df3c
mov rcx, rsi
call fcn.14006eb80
lea rcx, [rsp + 0x180]
call fcn.1400771a0
lea rcx, [rsp + 0x180]
call fcn.1400770b0
lea rcx, [rsp + 0x1e0]
call fcn.1400506a0
lea rcx, [rsp + 0x210]
call fcn.1400506a0
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.140137110
xor eax, eax
movaps xmm6, xmmword [rsp + 0x230]
movaps xmm7, xmmword [rsp + 0x240]
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret