Function at 0x1800012c0
Capabilities:
Accept command line arguments
Create process memory minidump
Delete file

Disassembly:
push rbx
push rdi
sub rsp, 0x4a8
mov rax, qword [0x18001d008]
xor rax, rsp
mov qword [rsp + 0x490], rax
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call fcn.180002ed0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edi, edi
lea rdx, [rsp + 0x60]
mov rcx, rax
mov dword [rsp + 0x60], edi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
test rax, rax
je 0x18000136b
cmp dword [rsp + 0x60], 4
jl 0x18000136b
mov rcx, qword [rax + 8]
lea r8d, [rdi + 0xa]
xor edx, edx
call fcn.180005e7c
cmp dword [rsp + 0x60], 4
mov rcx, qword [rbx + 0x10]
mov dword [0x18001ec30], eax
mov rax, qword [rbx + 0x18]
mov qword [0x18001ec28], rax
mov qword [0x18001ec40], rcx
jle 0x18000136b
mov rcx, qword [rbx + 0x20]
lea rdx, [0x18001a9ec]
call fcn.180005638
test eax, eax
jne 0x180001400
mov dword [0x18001ec48], 1
cmp dword [0x18001ec34], edi
je 0x1800013a7
lea rcx, str.DEBUG_mode_enabled_n
call fcn.180001760
cmp dword [0x18001ec34], edi
je 0x1800013a7
mov r9, qword [0x18001ec28]
lea rcx, str.PID_d__File_ws__GUID_ws_n
mov r8, qword [0x18001ec40]
mov edx, dword [0x18001ec30]
call fcn.180001760
mov r9, qword [0x18001ec28]
lea r8, str.Global_ws_DLL_LOADED
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.180001070
xor edx, edx
lea r8, [rsp + 0x70]
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
test rax, rax
je 0x180001431
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x1800013f5
lea rcx, [0x18001a548]
call fcn.180001940
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000143d
mov rcx, qword [rbx + 0x20]
lea rdx, [0x18001a9f4]
call fcn.180005638
test eax, eax
jne 0x18000136b
mov dword [0x18001ec48], 1
mov dword [0x18001ec34], 1
jmp 0x180001373
lea rcx, str.OpenEvent
call fcn.180001940
cmp dword [0x18001ec48], edi
je 0x180001451
lea rcx, str.___DLL_loaded._n
call fcn.180001760
mov rcx, qword [0x18001ec50]
lea rdx, [rsp + 0x280]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x180001746
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x4c8], rsi
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edx, 0x80
mov rbx, rax
lea ecx, [rdx - 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x18000173e
mov qword [rsp + 0x4d8], r14
lea r8, [0x18001a770]
mov r9, rbx
mov qword [rsp + 0x4a0], r15
mov edx, 0x40
mov rcx, rax
call fcn.180001070
mov rcx, rsi
call fcn.1800019e0
test eax, eax
jne 0x1800014e9
lea rcx, str.____Failed_to_delete_KnownDll_entry__ws_n
jmp 0x1800014f8
cmp dword [0x18001ec48], edi
je 0x180001500
lea rcx, str.___KnownDll_entry__ws_removed._n
mov rdx, rsi
call fcn.180001760
mov r15, qword [0x18001ec40]
xor r9d, r9d
mov ebx, dword [0x18001ec30]
mov edx, 0x40000000
mov qword [rsp + 0x30], rdi
mov rcx, r15
mov dword [rsp + 0x28], 0x80
lea r8d, [r9 + 7]
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x180001551
lea rcx, str.CreateFile
call fcn.180001940
jmp 0x180001681
cmp dword [0x18001ec34], edi
mov qword [rsp + 0x4c0], rbp
je 0x180001570
mov rdx, r15
lea rcx, str.CreateFile__ws__OK_n
call fcn.180001760
mov r8d, ebx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
jne 0x180001599
lea rcx, [0x18001aa48]
call fcn.180001940
jmp 0x180001650
cmp dword [0x18001ec34], edi
je 0x1800015af
mov edx, ebx
lea rcx, str.OpenProcess__d__OK_n
call fcn.180001760
mov qword [rsp + 0x30], rdi
mov r9d, 2
mov qword [rsp + 0x28], rdi
mov r8, r14
mov edx, ebx
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
mov edi, eax
test eax, eax
jne 0x18000164b
mov qword [rsp + 0x4d0], r12
call qword [sym.imp.KERNEL32.dll_GetLastError]
xorps xmm0, xmm0
lea r12, vtable._com_error.0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x48], eax
movdqu xmmword [rsp + 0x50], xmm0
mov ebx, eax
mov qword [rsp + 0x40], r12
call fcn.180001190
mov r8, rax
lea rcx, str.____MiniDumpWriteDump_failed_with_error_code_0x_08x___ws__n
mov edx, ebx
call fcn.180001760
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x40], r12
mov r12, qword [rsp + 0x4d0]
test rcx, rcx
je 0x180001639
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180001650
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180001650
mov edi, 1
test r14, r14
je 0x18000165e
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x18000166c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x4c0]
test edi, edi
jne 0x180001681
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [0x18001ec48], 0
mov r15, qword [rsp + 0x4a0]
mov r14, qword [rsp + 0x4d8]
je 0x1800016cc
test edi, edi
lea rax, str.SUCCESS
lea r8, str.FAILURE
cmovne r8, rax
lea rdx, [0x18001a670]
lea rax, [0x18001a668]
cmovne rdx, rax
lea rcx, str._ws_DumpProcessMemory:__ws_n
call fcn.180001760
test edi, edi
je 0x180001735
mov r9, qword [0x18001ec28]
lea r8, str.Global_ws_DUMP_SUCCESS
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.180001070
xor edx, edx
lea r8, [rsp + 0x70]
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
test rax, rax
je 0x180001729
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x18000171e
lea rcx, [0x18001a548]
call fcn.180001940
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180001735
lea rcx, str.OpenEvent
call fcn.180001940
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x4c8]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.180001d70
add rsp, 0x4a8
pop rdi
pop rbx
ret