Function at 0x44cd40
Capabilities:
Create process memory minidump

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7035a6
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x7c0ab4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, edx
mov dword [ebp - 0xd8], ebx
mov edx, ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xf0], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xfc], edx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xf8], ecx
test edx, edx
je 0x44db35
cmp word [edx], 0
je 0x44db35
mov dword [ebp - 0xf4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0x128], 0
mov byte [ebp - 4], 3
test ebx, ebx
jne 0x44ce0c
test eax, eax
je 0x44db55
mov ecx, eax
call fcn.0044e370
mov ebx, eax
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xdc], ebx
test ebx, ebx
je 0x44db75
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0xfc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x100], edi
mov dword [ebp - 0x128], edi
test edi, edi
je 0x44ce3e
cmp edi, 0xffffffff
jne 0x44ce5b
push 0
push 0x191
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_appskldumperkldumpgen.cpp
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
call fcn.00465440
add esp, 0x10
mov dword [ebp - 0xec], 0
push ebx
push 0
push 0x80000c50
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x104], esi
mov dword [ebp - 0xe4], esi
test esi, esi
je 0x44ce8e
cmp esi, 0xffffffff
jne 0x44ceab
push 0
push 0x19c
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_appskldumperkldumpgen.cpp
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
call fcn.00465440
add esp, 0x10
mov dword [ebp - 4], 4
jmp 0x44d076
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 3
call fcn.00448f20
mov ecx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xe0]
push ecx
push eax
push ebx
mov dword [ebp - 0x170], ecx
lea ecx, [ebp - 0x208]
push esi
mov dword [ebp - 0x16c], 1
mov dword [ebp - 0x174], eax
call fcn.0044ae70
xor eax, eax
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 7
mov word [ebp - 0xd4], ax
mov esi, dword [ebp - 0xe0]
push ebx
push esi
push dword [ebp - 0xf0]
push ecx
call fcn.0045a300
mov dword [ebp - 0x168], 0x44ae40
mov dword [ebp - 0x164], 0
mov dword [ebp - 0xe0], 0
mov byte [ebp - 4], 0xd
call fcn.00465ea0
cmp dword [0x7cc634], 6
sbb eax, eax
and eax, 0xfff9f800
add eax, 0x60800
cmp dword [ebp - 0xf0], 0
je 0x44d136
test esi, esi
je 0x44d136
lea ecx, [ebp - 0x174]
jmp 0x44d138
xor ecx, ecx
mov esi, dword [ebp - 0xe4]
lea edx, [ebp - 0x168]
push edx
push 0
push ecx
or eax, 6
push eax
push edi
push ebx
push esi
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
test eax, eax
jne 0x44d19a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0
push edi
mov dword [ebp - 0x104], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [ebp - 0x104]
test eax, eax
je 0x44d19a
push 0
push 0x1d3
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_appskldumperkldumpgen.cpp
push ecx
mov edx, eax
call fcn.00465440
add esp, 0x10
test esi, esi
je 0x44d329
mov eax, dword [ebp - 0xf8]
test eax, eax
je 0x44d329
mov dword [ebp - 0xe8], 0
push dword [ebp - 0xfc]
mov byte [ebp - 4], 0xf
push dword [ebp - 0x1d4]
mov eax, dword [eax]
push dword [ebp - 0x1dc]
push ebx
mov edi, dword [eax]
mov ecx, edi
push esi
call dword [0x70d440]
mov ecx, dword [ebp - 0xf8]
call edi
mov ebx, dword [ebp - 0xd8]
lea ecx, [ebp - 0xe8]
call fcn.00448f20
mov dword [ebp - 4], 0xc
jmp 0x44d3ab
mov ebx, dword [ebp - 0xd8]
mov dword [ebp - 4], 0xc
jmp 0x44d3ab
mov edi, dword [ebp - 0xe0]
test edi, edi
jne 0x44db92
jmp 0x44d435
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 0xb
call fcn.00448f20
xorps xmm0, xmm0
mov dword [ebp - 0x110], 0
push ecx
mov edx, ebx
movq qword [ebp - 0x118], xmm0
lea ecx, [ebp - 0xbc]
call fcn.00455390
add esp, 4
mov ebx, eax
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
mov edx, str.Dump__1_has_been_written_for_the_process__2__
lea ecx, [ebp - 0x2c]
call fcn.00468e70
mov dword [ebp - 0x10c], eax
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x1a
call fcn.0044a820
mov edi, eax
push ebx
mov eax, dword [edi + 4]
cmp dword [edi + 8], eax
je 0x44d4ca
mov ecx, eax
call fcn.00449040
add dword [edi + 4], 0x18
jmp 0x44d4d2
push eax
mov ecx, edi
call fcn.004565d0
mov edx, dword [ebp - 0x10c]
lea ecx, [ebp - 0x44]
push edi
call fcn.004874d0
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x44d4ec
mov eax, dword [eax]
push 1
push 0x1df
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_appskldumperkldumpgen.cpp
push 0x78c2b4
or edx, 0xffffffff
mov ecx, eax
call fcn.004863e0
mov edx, dword [ebp - 0x30]
add esp, 0x10
cmp edx, 8
jb 0x44d544
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44d53a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44dbfc
push edx
push ecx
call fcn.006d0b31
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
cmp edx, 8
jb 0x44d596
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44d58c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44dc01
push edx
push ecx
call fcn.006d0b31
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.00454a90
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0xa8]
cmp edx, 8
jb 0x44d5f9
mov ecx, dword [ebp - 0xbc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44d5ef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44dc06
push edx
push ecx
call fcn.006d0b31
add esp, 8
lea eax, [ebp - 0x1c4]
mov byte [ebp - 4], 0x1b
push eax
push 1
push str.KLDUMPER::AutoSuspendProcess::AutoSuspendProcess
mov ecx, 0x78c2b4
mov dword [ebp - method.KLDBG::CDbgTimeMeasurer3_char_.virtual_0], vtable.KLDBG::CDbgTimeMeasurer3_char_.0
mov dword [ebp - 0x1a4], 0x78c2b4
mov dword [ebp - 0x1a0], str.KLDUMPER::AutoSuspendProcess::AutoSuspendProcess
mov dword [ebp - 0x19c], 1
mov byte [ebp - 0x198], 0
mov dword [ebp - 0x1c4], 3
call fcn.00484650
add esp, 0xc
lea ecx, [ebp - 0x208]
mov bl, al
mov byte [ebp - 0x198], bl
call fcn.0044c120
mov dword [ebp - method.KLDBG::CDbgTimeMeasurer3_char_.virtual_0], vtable.KLDBG::CDbgTimeMeasurer3_char_.0
test bl, bl
je 0x44d696
push ecx
mov ecx, dword [ebp - 0x1a4]
lea eax, [ebp - 0x1c4]
push eax
push dword [ebp - 0x19c]
xor edx, edx
push dword [ebp - 0x1a0]
call fcn.004848c0
add esp, 0x10
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - method.KLSTD::CPointer_struct__EXCEPTION_RECORD_.virtual_0], vtable.KLSTD::CPointer_struct__EXCEPTION_RECORD_.0
test eax, eax
je 0x44d6bf
push 0x50
push eax
call fcn.006d0b31
add esp, 8
mov dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - method.KLSTD::CPointer_struct__CONTEXT_.virtual_0], vtable.KLSTD::CPointer_struct__CONTEXT_.0
test eax, eax
je 0x44d6eb
push 0x2cc
push eax
call fcn.006d0b31
add esp, 8
mov dword [ebp - 0x1dc], 0
lea ecx, [ebp - 0x1ec]
call fcn.00454910
mov eax, dword [ebp - 0x100]
test eax, eax
je 0x44d711
cmp eax, 0xffffffff
je 0x44d711
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x44d711
int3
test esi, esi
je 0x44d726
cmp esi, 0xffffffff
je 0x44d726
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x44d726
int3
mov ebx, dword [ebp - 0xd8]
jmp 0x44d78e
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0xf4]
test esi, esi
je 0x44db0e
push str.KLDUMPER::WriteDump
push 0x1e2
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_appskldumperkldumpgen.cpp
push 0x780fa8
mov edx, esi
mov ecx, 5
call fcn.00477010
push str.KLDUMPER::WriteDump
push 0x1e3
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_appskldumperkldumpgen.cpp
push 0x780fa8
mov edx, esi
mov ecx, 4
call fcn.00477010
add esp, 0x18
mov dword [ebp - 0x11c], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x2a0]
movq qword [ebp - 0x124], xmm0
call fcn.00457260
mov byte [ebp - 4], 0x20
mov eax, dword [esi]
mov dword [ebp - 0x138], esi
mov edi, dword [eax]
mov ecx, edi
call dword [0x70d440]
mov ecx, esi
call edi
mov byte [ebp - 0x134], 0
lea edx, [ebp - 0x138]
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x2a0]
call fcn.004850c0
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x20
call fcn.00448f20
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x29c]
call fcn.00458f40
lea ecx, [ebp - 0x2a0]
call fcn.00456da0
push ecx
mov edx, ebx
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x5c]
call fcn.00455390
add esp, 4
mov ebx, eax
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
mov edx, str.Writing_dump_to_the_file__1_for_process__2_failed____3
lea ecx, [ebp - 0x74]
call fcn.00468e70
mov dword [ebp - 0x108], eax
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 0x25
call fcn.0044a820
mov edi, eax
push ebx
mov eax, dword [edi + 4]
cmp dword [edi + 8], eax
je 0x44d95e
mov ecx, eax
call fcn.00449040
add dword [edi + 4], 0x18
jmp 0x44d966
push eax
mov ecx, edi
call fcn.004565d0
mov eax, dword [edi + 4]
lea ecx, [ebp - 0xa4]
push ecx
cmp dword [edi + 8], eax
je 0x44d982
mov ecx, eax
call fcn.00449040
add dword [edi + 4], 0x18
jmp 0x44d98a
push eax
mov ecx, edi
call fcn.004565d0
mov edx, dword [ebp - 0x108]
lea ecx, [ebp - 0x8c]
push edi
call fcn.004874d0
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x44d9a7
mov eax, dword [eax]
push 3
push 0x1e4
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_appskldumperkldumpgen.cpp
push 0x78c2b4
or edx, 0xffffffff
mov ecx, eax
call fcn.004863e0
mov edx, dword [ebp - 0x78]
add esp, 0x10
cmp edx, 8
jb 0x44da02
mov ecx, dword [ebp - 0x8c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44d9f8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44dc0b
push edx
push ecx
call fcn.006d0b31
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x24
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 7
mov word [ebp - 0x8c], ax
cmp edx, 8
jb 0x44da57
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44da4d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44dc10
push edx
push ecx
call fcn.006d0b31
add esp, 8
xor eax, eax
mov dword [ebp - 0x64], 0
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
call fcn.00454a90
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x44dab4
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44daaa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44dc15
push edx
push ecx
call fcn.006d0b31
add esp, 8
xor eax, eax
mov dword [ebp - 0x4c], 0
mov byte [ebp - 4], al
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
cmp edx, 8
jb 0x44dc29
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44dc1f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x44dc1f
jmp 0x44dc1a
lea ecx, [ebp - 0xf4]
call fcn.00448f20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006d0856
mov esp, ebp
pop ebp
ret
push str.szwDumpFileName
push 0
push 0x17a
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_appskldumperkldumpgen.cpp
push 0x4a3
push 0x7824b0
call fcn.00477ab0
push str.nThreadId
push 0
push 0x17f
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_appskldumperkldumpgen.cpp
push 0x4a3
push 0x7824b0
call fcn.00477ab0
push 0
push 0
push 0x186
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_appskldumperkldumpgen.cpp
push 0x4a2
push 0x7822c0
call fcn.00477ab0
push str.KLDUMPER::WriteDump
push 0x1da
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_appskldumperkldumpgen.cpp
push 0x780fa8
mov edx, edi
mov ecx, 5
call fcn.00477010
push str.KLDUMPER::WriteDump
push 0x1db
push str.c:_a_b_a_6cb29bb7_scsadminkitdevelopment2_appskldumperkldumpgen.cpp
push 0x780fa8
mov edx, edi
mov ecx, 1
call fcn.00477010
mov eax, dword [edi]
add esp, 0x20
mov esi, dword [eax]
mov ecx, esi
call dword [0x70d440]
mov ecx, edi
call esi
push 0x7bae10
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], edi
push eax
call fcn.006d4ced
call fcn.006d79b8
call fcn.006d79b8
call fcn.006d79b8
call fcn.006d79b8
call fcn.006d79b8
call fcn.006d79b8
call fcn.006d79b8
push edx
push ecx
call fcn.006d0b31
add esp, 8
mov eax, dword [esi]
mov edi, dword [eax]
mov ecx, edi
call dword [0x70d440]
mov ecx, esi
call edi
push 0x7bae10
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x13c], esi
push eax
call fcn.006d4ced
int3