Function at 0x140034c70
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1400e0038]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rax, qword gs:[0x30]
mov rsi, rcx
xor r13d, r13d
movzx r15d, r8b
movzx r12d, r9b
mov rdi, rdx
mov rcx, qword [rax + 0x48]
cmp qword [rdx + 0x48], rcx
jne 0x140034d09
mov dword [rdx + 0x70], r13d
lea rcx, [rdi + 0x10]
mov edx, 0x4d0
call fcn.1400339c0
mov rcx, qword [rdi + 0x10]
add rcx, qword [rdi]
mov byte [rdi + 8], 1
call fcn.1400b0bc0
mov al, 1
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400809d0
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140034def
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x28]
mov ebx, eax
call fcn.140006da0
lea r14, str..._.._snapshot_win_process_reader_win.cc
mov qword [rbp + 0x18], r13
lea rcx, [rsp + 0x28]
mov qword [rbp + 0x10], r14
mov dword [rbp + 0x20], reloc.SHELL32.dll_ILFree
mov dword [rbp + 0x24], 2
call fcn.140013280
lea rdx, [0x1400c8800]
mov dword [rbp + 0x28], ebx
lea rcx, [rsp + 0x28]
call fcn.140006680
lea rdx, [0x1400c2070]
lea rcx, [rsp + 0x28]
call fcn.140006680
mov edx, dword [rbp + 0x28]
lea rcx, [rbp + 0x30]
mov rbx, rax
call fcn.140012e60
cmp qword [rax + 0x18], 0x10
mov r8, qword [rax + 0x10]
jb 0x140034d98
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140009230
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140034dde
mov rcx, qword [rbp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034dd9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035119
call fcn.1400809f0
lea rcx, [rsp + 0x28]
call fcn.140012fd0
xor al, al
jmp 0x140034ce2
lea r14, str..._.._snapshot_win_process_reader_win.cc
test ebx, ebx
jne 0x140034e6f
cmp r15b, 1
jne 0x140034e6f
lea rcx, [rsp + 0x28]
call fcn.140006da0
lea rcx, [rsp + 0x28]
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], r13
mov dword [rbp + 0x20], 0xa0
mov dword [rbp + 0x24], 1
call fcn.140013280
lea rdx, str.Thread
lea rcx, [rsp + 0x28]
call fcn.140006680
mov rdx, qword [rdi + 0x48]
mov rcx, rax
call fcn.14000a190
mov rcx, rax
lea rdx, str._should_be_suspended__but_previous_suspend_count_is
call fcn.140006680
mov edx, ebx
mov rcx, rax
call fcn.1400138d0
lea rcx, [rsp + 0x28]
call fcn.140012fd0
mov ebx, r13d
jmp 0x140034e72
sub ebx, r15d
mov dword [rdi + 0x70], ebx
test r12b, r12b
je 0x140034f78
mov edx, 0x2cc
lea rcx, [rdi + 0x10]
call fcn.1400339c0
mov rcx, qword [rdi]
mov rax, qword [rdi + 0x10]
mov byte [rdi + 8], 1
mov dword [rcx + rax], 0x10001f
mov rcx, rsi
mov rdx, qword [rdi]
add rdx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
jne 0x140034f94
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x28]
mov ebx, eax
call fcn.140006da0
lea rcx, [rsp + 0x28]
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], r13
mov dword [rbp + 0x20], 0xe3
mov dword [rbp + 0x24], 2
call fcn.140013280
lea rdx, [0x1400c8680]
mov dword [rbp + 0x28], ebx
lea rcx, [rsp + 0x28]
call fcn.140006680
lea rdx, [0x1400c2070]
lea rcx, [rsp + 0x28]
call fcn.140006680
mov edx, dword [rbp + 0x28]
lea rcx, [rbp + 0x30]
mov rbx, rax
call fcn.140012e60
cmp qword [rax + 0x18], 0x10
mov r8, qword [rax + 0x10]
jb 0x140034f2a
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140009230
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x1400350eb
mov rcx, qword [rbp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400350e6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035113
jmp 0x1400350e6
call fcn.140038580
test al, al
je 0x140034ffc
mov rdx, rsi
mov rcx, rdi
call fcn.1400333f0
test al, al
je 0x140035106
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x140034ce0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x28]
mov ebx, eax
call fcn.140006da0
lea rcx, [rsp + 0x28]
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], r13
mov dword [rbp + 0x20], 0xbf
mov dword [rbp + 0x24], 2
call fcn.140013280
lea rdx, [0x1400c8810]
mov dword [rbp + 0x28], ebx
lea rcx, [rsp + 0x28]
call fcn.140006680
lea rcx, [rsp + 0x28]
call fcn.140013810
xor al, al
jmp 0x140034ce2
mov edx, 0x4d0
lea rcx, [rdi + 0x10]
call fcn.1400339c0
mov rcx, qword [rdi + 0x10]
mov rax, qword [rdi]
mov byte [rdi + 8], 1
mov dword [rcx + rax + 0x30], 0x10001f
mov rcx, rsi
mov rdx, qword [rdi + 0x10]
add rdx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x140034f94
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x28]
mov ebx, eax
call fcn.140006da0
lea rcx, [rsp + 0x28]
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], r13
mov dword [rbp + 0x20], 0xd7
mov dword [rbp + 0x24], 2
call fcn.140013280
lea rdx, [0x1400c8638]
mov dword [rbp + 0x28], ebx
lea rcx, [rsp + 0x28]
call fcn.140006680
lea rdx, [0x1400c2070]
lea rcx, [rsp + 0x28]
call fcn.140006680
mov edx, dword [rbp + 0x28]
lea rcx, [rbp + 0x30]
mov rbx, rax
call fcn.140012e60
cmp qword [rax + 0x18], 0x10
mov r8, qword [rax + 0x10]
jb 0x1400350a9
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140009230
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x1400350eb
mov rcx, qword [rbp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400350e6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003510d
call fcn.1400809f0
movdqa xmm0, xmmword [0x1400cd310]
lea rcx, [rsp + 0x28]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], r13b
call fcn.140012fd0
xor al, al
jmp 0x140034ce2
call fcn.140087b78
int3
call fcn.140087b78
int3
call fcn.140087b78
int3