Function at 0x1402890fe
Capabilities:
Resume thread
Suspend thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm7
movaps xmmword [rsp + 0x2c0], xmm6
mov byte [rsp + 0x2f], dl
mov rdi, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
mov r14, qword [rcx]
lea r15, [rsp + 0xd8]
mov dword [r15], 0xaaaaaaaa
mov ecx, 0x4000
call fcn.14013a834
mov rsi, rax
mov r12d, 0x4000
mov r13d, 0x14
mov ebx, 0x1000
mov ecx, 5
mov rdx, rsi
mov r8d, r12d
mov r9, r15
call fcn.14022369c
mov ebp, eax
cmp eax, 0xc0000023
je 0x140289192
cmp ebp, 0xc0000004
jne 0x140289259
mov r12d, dword [rsp + 0xd8]
add r12d, ebx
test rsi, rsi
je 0x1402891aa
mov rcx, rsi
call fcn.14013b350
mov ecx, r12d
call fcn.14013a834
mov rsi, rax
dec r13d
jne 0x14028916a
cmp dword [0x14033b1a8], 2
jg 0x140289218
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
lea rdi, [rsp + 0x170]
mov rcx, rdi
mov r8d, 0x66
mov r9d, 2
call fcn.14012fd40
lea rax, [0x1402e3588]
mov qword [rdi], rax
mov dword [rdi + 0x138], ebp
lea rcx, [rsp + 0x180]
lea rdx, str.NtQuerySystemInformation
mov r8d, 0x18
call fcn.1401970a4
mov rcx, rdi
call fcn.140246530
test rsi, rsi
je 0x140289225
mov rcx, rsi
call fcn.14013b350
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
call fcn.14013d520
movaps xmm6, xmmword [rsp + 0x2c0]
movaps xmm7, xmmword [rsp + 0x2d0]
add rsp, 0x2e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test ebp, ebp
js 0x1402891ba
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov ebp, eax
mov r13, rsi
cmp dword [r13 + 0x50], ebp
je 0x1402892f9
mov eax, dword [r13]
test rax, rax
je 0x140289287
add r13, rax
jne 0x14028926f
cmp dword [0x14033b1a8], 2
jg 0x140289218
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
lea rdi, [rsp + 0x170]
mov rcx, rdi
mov r8d, pe_nt_image_headers64
mov r9d, 2
call fcn.14012fd40
lea rcx, [rsp + 0x180]
lea rdx, str.process
mov r8d, 8
call fcn.1401970a4
mov rcx, rax
mov edx, ebp
call fcn.140134a42
lea rdx, str._not_found
mov r8d, 0xa
mov rcx, rax
call fcn.1401970a4
mov rcx, rdi
call fcn.1400a0470
jmp 0x140289218
test r13, r13
je 0x140289218
cmp dword [r13 + 4], 0
je 0x140289218
movabs rbx, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0xe0]
lea r15, [r13 + 0x128]
movaps xmm6, xmmword [0x1402e6d80]
xorps xmm7, xmm7
xor r14d, r14d
jmp 0x140289416
mov qword [rsp + 0x30], r15
mov r15, r14
mov r14, r12
mov r12, rbx
cmp dword [0x14033b1a8], 2
jg 0x1402893ac
mov ebp, eax
lea rbx, [rsp + 0x170]
mov rcx, rbx
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
mov r8d, 0x87
mov r9d, 2
call fcn.14012fd40
lea rax, [0x1402e3588]
mov qword [rsp + 0x170], rax
mov dword [rsp + 0x2a8], ebp
mov r8d, 0xc
lea rcx, [rsp + 0x180]
lea rdx, str.NtOpenThread
call fcn.1401970a4
mov rcx, rbx
call fcn.140246530
mov rbx, r12
mov r12, r14
mov r14, r15
mov r15, qword [rsp + 0x30]
lea rcx, str.Microsoft.ProcessSnapshotInitMilestone
mov edx, 0xc
mov r8d, 0xf
call fcn.140090bd0
cmp byte [rsp + 0x16f], 0
jns 0x1402893e8
mov rcx, qword [rsp + 0x158]
call fcn.14013a6ac
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x140289402
mov qword [rsp + 0xf0], rcx
call fcn.14013a6ac
inc r14
mov eax, dword [r13 + 4]
add r15, 0x50
cmp r14, rax
jae 0x140289218
mov qword [r12 + 0x50], rbx
movups xmmword [r12 + 0x40], xmm6
movups xmmword [r12 + 0x30], xmm6
movups xmmword [r12 + 0x20], xmm6
movups xmmword [r12 + 0x10], xmm6
movups xmmword [r12], xmm6
xor eax, eax
mov qword [rsp + 0xd8], rax
mov byte [rsp + 0xe0], 0
movups xmmword [r12 + 0x44], xmm7
movups xmmword [r12 + 0x38], xmm7
movups xmmword [r12 + 0x28], xmm7
movups xmmword [r12 + 0x18], xmm7
movups xmmword [r12 + 8], xmm7
mov qword [r12 + 0x88], rax
movups xmmword [r12 + 0x78], xmm7
movups xmmword [r12 + 0x68], xmm7
movups xmmword [r12 + 0x58], xmm7
mov rax, qword [r15 + 8]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0xa0], rbx
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x70], xmm6
mov dword [rsp + 0x60], 0x30
lea rax, [rsp + 0x68]
movups xmmword [rax], xmm7
mov dword [rax + 0x10], 0
movups xmmword [rax + 0x18], xmm7
lea rcx, [rsp + 0xa0]
mov edx, 0x4a
lea r8, [rsp + 0x60]
mov r9, r15
call fcn.140223602
test eax, eax
js 0x140289338
mov rbp, qword [rsp + 0xa0]
test rbp, rbp
je 0x1402893ba
mov bl, byte [rdi + 0x160]
mov rax, qword [rsp + 0x100]
mov rcx, qword gs:[0x30]
cmp rax, qword [rcx + 0x48]
je 0x1402895c3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1402896ce
cmp dword [0x14033b1a8], 2
movabs rbx, 0xaaaaaaaaaaaaaaaa
jg 0x14028959f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x30], r15
mov r15, r14
mov r14, r12
mov r12, rbx
lea rbx, [rsp + 0x170]
mov rcx, rbx
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
mov r8d, 0xa3
mov r9d, 2
call fcn.1401fea80
mov r8d, 0xd
lea rcx, [rsp + 0x180]
lea rdx, [0x14030e38e]
call fcn.1401970a4
mov rcx, rbx
mov rbx, r12
mov r12, r14
mov r14, r15
mov r15, qword [rsp + 0x30]
call fcn.1401feb00
lea rcx, str.Microsoft.ProcessSnapshotInitMilestone
mov edx, 0xd
mov r8d, 0xf
call fcn.140090bd0
mov rcx, rbp
call fcn.14005b54e
jmp 0x1402893d1
mov dword [rsp + 0x128], 0
lea rcx, [rsp + 0xd8]
call fcn.1402888c6
movabs rbx, 0xaaaaaaaaaaaaaaaa
mov dword [rsp + 0x12c], 0x20
mov eax, dword [r15 + 0x10]
mov dword [rsp + 0x130], eax
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
mov qword [rsp + 0x20], 0
mov rcx, rbp
xor edx, edx
lea r8, [rsp + 0xa0]
mov r9d, 0x30
call fcn.140223734
test eax, eax
jns 0x140289839
mov dword [rsp + 0x30], eax
cmp dword [0x14033b1a8], 2
jg 0x1402896a8
lea rbx, [rsp + 0x170]
mov rcx, rbx
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
mov r8d, 0x1c9
mov r9d, 2
call fcn.14012fd40
lea rax, [0x1402e3588]
mov qword [rsp + 0x170], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x2a8], eax
mov r8d, 0x18
lea rcx, [rsp + 0x180]
lea rdx, str.NtQueryInformationThread
call fcn.1401970a4
mov rcx, rbx
call fcn.140246530
lea rcx, str.Microsoft.ProcessSnapshotInitMilestone
mov edx, 0xe
mov r8d, 0xf
call fcn.140090bd0
movabs rbx, 0xaaaaaaaaaaaaaaaa
jmp 0x1402895b6
test bl, bl
je 0x14028976e
test eax, eax
jne 0x14028976e
xor eax, eax
cmp dword [0x14033b1a8], 1
jg 0x140289773
cmp dword [0x14032a9b8], 0
je 0x140289773
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
lea rbx, [rsp + 0x170]
mov rcx, rbx
mov r8d, 0xa8
mov r9d, 1
call fcn.14012fd40
lea rdx, str.Thread
mov r8d, 7
lea rcx, [rsp + 0x180]
call fcn.1401970a4
mov rdx, qword [rsp + 0x100]
mov rcx, rax
call fcn.140106ab2
lea rdx, str._should_be_suspended__but_previous_suspend_count_is
mov r8d, 0x34
mov rcx, rax
call fcn.1401970a4
mov rcx, rax
xor edx, edx
call fcn.140134a42
mov rcx, rbx
call fcn.1400a0470
xor eax, eax
jmp 0x140289773
movzx ecx, bl
sub eax, ecx
mov dword [rsp + 0x128], eax
cmp byte [rsp + 0x2f], 0
jne 0x1402897a8
mov ecx, 0x800
call fcn.1402a1ec3
lea rcx, [rsp + 0xd8]
mov rdx, rbp
test al, al
jne 0x1402897a1
call fcn.140288920
jmp 0x1402897b8
call fcn.140288b18
jmp 0x1402897b8
lea rcx, [rsp + 0xd8]
mov rdx, rbp
call fcn.140288a1c
test al, al
movabs rbx, 0xaaaaaaaaaaaaaaaa
je 0x14028959f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x1402895e5
cmp dword [0x14033b1a8], 2
jg 0x14028959f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
lea rcx, [rsp + 0x170]
mov r8d, 0xc7
mov r9d, 2
call fcn.1401fea80
lea rdx, [0x14030e3d9]
mov r8d, 0xc
lea rcx, [rsp + 0x180]
call fcn.1401970a4
lea rcx, [rsp + 0x170]
jmp 0x14028959a
lea rcx, [rdi + 0x90]
mov qword [rsp + 0x90], rbx
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
mov rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x108], rdx
mov qword [rsp + 0x110], 0x1788
mov r8d, 0x38
mov qword [rsp + 0x38], rcx
lea r9, [rsp + 0x60]
call fcn.140279b2e
test al, al
je 0x1402899a3
mov qword [rsp + 0x30], r15
cmp byte [rsp + 0x2f], 0
je 0x1402898ee
lea rbx, [rsp + 0x170]
movups xmmword [rbx + 0xc], xmm6
movaps xmmword [rbx], xmm6
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x108], rdx
mov qword [rsp + 0x110], 0x1788
mov r8d, 0x1c
mov rcx, qword [rsp + 0x38]
mov r9, rbx
call fcn.140279b2e
mov edx, dword [rbx + 4]
mov ebx, dword [rbx + 8]
xor ecx, ecx
test al, al
cmove rdx, rcx
cmove rbx, rcx
jmp 0x1402898f8
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x118], rbx
mov rax, rdx
sub rax, rbx
jae 0x14028998c
cmp dword [0x14033b1a8], 2
jg 0x14028998a
mov r15, rdx
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
lea rcx, [rsp + 0x170]
mov r8d, 0x1ec
mov r9d, 2
call fcn.14012fd40
lea rdx, str.invalid_stack_range:
mov r8d, 0x15
lea rcx, [rsp + 0x180]
call fcn.1401970a4
mov rcx, rax
mov rdx, r15
call fcn.140106ab2
lea rdx, [0x1402ec5bb]
mov r8d, 3
mov rcx, rax
call fcn.1401970a4
mov rcx, rax
mov rdx, rbx
call fcn.140106ab2
lea rcx, [rsp + 0x170]
call fcn.1400a0470
xor eax, eax
mov qword [rsp + 0x120], rax
movabs rbx, 0xaaaaaaaaaaaaaaaa
mov r15, qword [rsp + 0x30]
mov eax, dword [0x1403452d0]
mov ecx, dword [0x140337e40]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140289b72
mov rax, qword [0x1403452c8]
test rax, rax
je 0x140289a7f
mov qword [rsp + 0x58], rbx
mov rcx, rbp
lea rdx, [rsp + 0x58]
call qword [case.0x14017aab5.0]
test eax, eax
js 0x140289aba
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x140289a0f
mov rcx, rbx
call fcn.14013ad74
test rax, rax
jns 0x140289a11
jmp 0x140289bb9
xor eax, eax
xorps xmm0, xmm0
lea r8, [rsp + 0x170]
movaps xmmword [r8], xmm0
mov qword [r8 + 0x10], 0
mov rcx, rbx
mov rdx, rax
call fcn.140111960
cmp byte [rsp + 0x16f], 0
jns 0x140289a4a
mov rcx, qword [rsp + 0x158]
call fcn.14013a6ac
mov rax, qword [rsp + 0x180]
mov qword [r12 + 0x88], rax
movaps xmm0, xmmword [rsp + 0x170]
movups xmmword [r12 + 0x78], xmm0
test rbx, rbx
je 0x140289a75
mov rcx, rbx
call fcn.140287906
movabs rbx, 0xaaaaaaaaaaaaaaaa
lea rcx, [rdi + 0x130]
mov rax, qword [rdi + 0x138]
cmp rax, qword [rdi + 0x140]
jne 0x140289aa8
lea rdx, [rsp + 0xd8]
call fcn.140289dea
jmp 0x1402895b6
lea rdx, [rsp + 0xd8]
call fcn.140289d90
jmp 0x1402895b6
cmp dword [0x14033b1a8], 1
jg 0x140289a75
cmp dword [0x14032a9b8], 0
je 0x140289a75
mov ebx, eax
lea r12, [rsp + 0x180]
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinprocess_reader_win.cc
lea rcx, [rsp + 0x170]
mov r8d, 0x1fd
mov r9d, 1
call fcn.14012fd40
lea rdx, str.GetThreadDescription:
mov r8d, 0x16
mov rcx, r12
call fcn.1401970a4
mov qword [rsp + 0x30], rax
lea r12, [rsp + 0x40]
mov rcx, r12
mov edx, ebx
call fcn.1401fe920
movzx r8d, byte [r12 + 0x17]
test r8b, r8b
js 0x140289b33
mov rdx, r12
and r8d, 0x7f
jmp 0x140289b3d
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call fcn.1401970a4
cmp byte [rsp + 0x57], 0
jns 0x140289b58
mov rcx, qword [rsp + 0x40]
call fcn.14013a6ac
lea rcx, [rsp + 0x170]
call fcn.1400a0470
lea r12, [rsp + 0xe0]
jmp 0x140289a75
lea rcx, [0x1403452d0]
call fcn.14013b388
cmp dword [0x1403452d0], 0xffffffff
jne 0x1402899c8
lea rcx, [0x1402e7370]
lea rdx, str.::GetThreadDescription
xor r8d, r8d
call fcn.1400723d4
mov qword [0x1403452c8], rax
lea rcx, [0x1403452d0]
call fcn.14013a7d4
jmp 0x1402899c8
int3