Function at 0x41014c
Capabilities:
Create process memory minidump
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x44d8c0
push 0x445509
mov eax, dword fs:[0]
push eax
push ecx
push ecx
mov eax, 0x1658
call fcn.00446050
mov eax, dword [section..data]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1644], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x163c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
push dword [ebp - 0x163c]
lea ecx, [ebp - 0x1638]
call fcn.00422eee
pop ecx
mov dword [ebp - 0x1648], eax
xor eax, eax
mov word [ebp - 0x228], ax
xor edi, edi
mov dword [ebp - 0x1640], edi
lea eax, [ebp - 0x228]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x410245
push ebx
push dword [ebp + 8]
push 0x44aedc
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov dword [ebp - 0x1640], eax
cmp eax, edi
je 0x410245
push esi
lea ecx, [ebp - 0x228]
lea eax, [ebp - 0x638]
call fcn.00440c1b
mov dword [esp], str..dmp
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
cmp dword [ebp - 0x1640], edi
je 0x4103a6
push edi
push edi
push 2
push edi
push 3
push 0xc0000000
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1640], eax
cmp eax, 0xffffffff
je 0x4102d6
mov dword [ebp - 4], edi
mov dword [ebp - 0x1654], ebx
mov ecx, dword [ebp - 0x1644]
mov dword [ebp - 0x1650], ecx
xor ecx, ecx
inc ecx
mov dword [ebp - 0x164c], ecx
push edi
push edi
lea edx, [ebp - 0x1654]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebp - 0x163c]
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
mov dword [ebp - 4], 0xfffffffe
jmp 0x4102ca
push dword [ebp - 0x1640]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.comLazy.dll
xor ecx, ecx
lea esi, [ebp - 0x430]
call fcn.00442350
pop ecx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x4103a6
push 1
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x41039f
lea ecx, [ebp - 0x163c]
push ecx
push 0x449a40
push 0x449a40
call eax
test eax, eax
js 0x41039f
mov eax, dword [ebp - 0x1644]
mov dword [ebp - 0x166c], eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x1668], eax
mov eax, dword [ebp - 0x1648]
mov dword [ebp - 0x1664], eax
lea eax, [ebp - 0x1638]
mov dword [ebp - 0x1660], eax
lea eax, [ebp - 0x1238]
mov dword [ebp - 0x165c], eax
mov eax, 0x4000
mov word [ebp - 0x1658], ax
lea eax, [ebp - 0x166c]
mov dword [ebp - 0x1650], eax
mov eax, dword [ebp - 0x163c]
mov ecx, dword [eax]
push edi
push edi
push edi
lea edx, [ebp - 0x1658]
push edx
push 0x6000001e
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x163c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0044552e
leave
ret