Function at 0x1004066f0
Capabilities:
Check mutex on windows
Create process memory minidump
Query or enumerate registry value
Resume thread
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x8e0
mov rax, qword [0x100422010]
xor rax, rsp
mov qword [rsp + 0x8d0], rax
xor eax, eax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], eax
mov dword [0x1004276d0], 4
lea edx, [rax + 1]
lea rcx, [0x100401a20]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rax, [0x1004073e0]
mov qword [rsp + 0x88], rax
lea r14, [0x1004276d0]
mov qword [rsp + 0x90], r14
mov rcx, qword [0x100427d60]
test rcx, rcx
je 0x1004067a8
mov rax, qword [0x100427d68]
test rax, rax
je 0x1004067a8
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x78], rax
lea r15, [rsp + 0x68]
mov eax, dword [0x100427ddc]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x6c], rax
xor ebx, ebx
mov dword [rsp + 0x74], ebx
jmp 0x1004067ad
xor ebx, ebx
mov r15d, ebx
mov dword [rsp + 0x98], ntohs
mov rax, qword [0x100427d88]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], ntohs
mov rax, qword [0x100427d80]
mov qword [rsp + 0xb0], rax
mov dword [rsp + ntohs8], 0xb
mov rax, qword [0x1004290b0]
mov qword [rsp + 0xc0], rax
mov r9d, ebx
lea rdx, [rsp + 0xac]
mov rax, qword [rdx - 0xc]
test rax, rax
je 0x10040684a
mov ecx, 0x1000
cmp word [rax], 0
je 0x100406824
add rax, 2
sub rcx, 1
jne 0x100406814
mov r8d, 0x80070057
test rcx, rcx
cmovne r8d, ebx
je 0x10040683d
mov eax, 0x1000
sub rax, rcx
jmp 0x100406840
mov rax, rbx
test rcx, rcx
je 0x100406850
add rax, rax
jmp 0x100406853
mov r8d, 0x80070057
mov rax, rbx
test r8d, r8d
js 0x100406865
test rax, rax
je 0x100406865
add eax, 2
mov dword [rdx - 0x10], eax
jmp 0x100406868
mov dword [rdx - 0x10], ebx
mov rax, qword [rdx + 4]
test rax, rax
je 0x1004068ac
mov ecx, 0x1000
cmp word [rax], 0
je 0x100406886
add rax, 2
sub rcx, 1
jne 0x100406876
mov r8d, 0x80070057
test rcx, rcx
cmovne r8d, ebx
je 0x10040689f
mov eax, 0x1000
sub rax, rcx
jmp 0x1004068a2
mov rax, rbx
test rcx, rcx
je 0x1004068b2
add rax, rax
jmp 0x1004068b5
mov r8d, 0x80070057
mov rax, rbx
test r8d, r8d
js 0x1004068c6
test rax, rax
je 0x1004068c6
add eax, 2
mov dword [rdx], eax
jmp 0x1004068c8
mov dword [rdx], ebx
mov rax, qword [rdx + 0x14]
test rax, rax
je 0x10040690c
mov ecx, 0x1000
cmp word [rax], 0
je 0x1004068e6
add rax, 2
sub rcx, 1
jne 0x1004068d6
mov r8d, 0x80070057
test rcx, rcx
cmovne r8d, ebx
je 0x1004068ff
mov eax, 0x1000
sub rax, rcx
jmp 0x100406902
mov rax, rbx
test rcx, rcx
je 0x100406912
add rax, rax
jmp 0x100406915
mov r8d, 0x80070057
mov rax, rbx
test r8d, r8d
js 0x100406927
test rax, rax
je 0x100406927
add eax, 2
mov dword [rdx + 0x10], eax
jmp 0x10040692a
mov dword [rdx + 0x10], ebx
add r9d, 3
add rdx, 0x30
cmp r9d, 3
jb 0x100406806
mov dword [rsp + 0x50], 3
lea rax, [rsp + 0x98]
mov qword [rsp + 0x54], rax
mov esi, dword [0x100427d44]
mov dword [rsp + 0x48], ebx
cmp dword [0x100427d48], 0
jne 0x1004069fb
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftMicrosoft_SQL_Server150
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004069fb
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.DumpOverrideFlags
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1004069f0
cmp dword [rsp + 0x40], 4
jne 0x1004069f0
cmp dword [rsp + 0x44], 4
jne 0x1004069f0
mov ecx, dword [0x100427d48]
mov eax, dword [rsp + 0x48]
test eax, eax
cmovne ecx, eax
mov dword [0x100427d48], ecx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [0x100427d48]
test edi, edi
cmove edi, esi
xor edx, edx
mov r8d, 0x440
lea rcx, [rsp + 0xd0]
call sub.VCRUNTIME140.dll_memset
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x100406ac3
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x100406ac3
xor r9d, r9d
mov r8d, 0x440
lea rdx, [rsp + 0xd0]
mov ecx, 0x1388
call rax
test eax, eax
jne 0x100406ac3
mov byte [0x100427718], 1
lea r8, str.Running_on_sqlpal
lea edx, [rax + 2]
lea rcx, [0x100422050]
call fcn.100401b20
lea r8, str.SQLDumperSerializer
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x100427710], rax
test rax, rax
jne 0x100406ab5
lea rdx, str.Unable_to_create_or_open_serialization_mutex.
call fcn.10040a220
mov qword [0x100427710], 0xffffffffffffffff
jmp 0x100406ac3
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x1004290e0]
test eax, 0x9000
jne 0x100406afc
cmp dword [0x100427dac], 0
je 0x100406add
test al, 0x20
je 0x100406afc
xor edx, edx
call fcn.10040b6c0
lea r8, str.Target_suspended
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
mov r9d, edi
lea r8, str.MINIDUMP_TYPE:_0x_X
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
cmp qword [0x100426468], 0
je 0x100406ba7
mov rcx, qword [0x100422460]
test rcx, rcx
jne 0x100406b48
lea rcx, [0x100422050]
call fcn.1004020b0
test eax, eax
je 0x100406ba7
mov rcx, qword [0x100422460]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x40], ebx
mov r8d, dword [0x100426468]
add r8d, r8d
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
lea rdx, [0x100422468]
mov rcx, qword [0x100422460]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x100422460]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor edx, edx
mov r8d, 0x4008
lea rcx, [0x100422468]
call sub.VCRUNTIME140.dll_memset
nop
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9d, edi
mov r8, qword [0x100427d38]
mov edx, dword [0x100427db0]
mov rcx, qword [0x1004276d8]
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
test eax, eax
je 0x100406dd7
mov dword [0x1004276d0], 5
lea r9, [0x100427924]
lea r8, str.MiniDump_completed:__ls
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
mov r9d, dword [0x1004312e8]
imul r9, qword [0x1004312a0]
shr r9, 0xb
lea r8, str.Total_Buffer_pool_data_pages_filtered_out:__llu_KB
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
mov r9d, dword [0x100431308]
imul r9, qword [0x1004312a8]
shr r9, 0xb
lea r8, str.Total_Hekaton_data_pages_filtered_out:__llu_KB
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
mov r9, qword [0x1004312b8]
shr r9, 0xb
lea r8, str.Total_Free_memory__from_non_top_level_allocators__filtered_out:__llu_KB
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
mov r9, qword [0x100431270]
imul r9, qword [0x1004312b0]
shr r9, 0xb
lea r8, str.Total_top_level_free_memory_filtered_out:__llu_KB
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
mov r9, qword [0x1004312c0]
shr r9, 0xb
lea r8, str.Total_Log_pool_memory_filtered_out:__llu_KB
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
mov r9d, dword [0x100427d40]
shr r9d, 0x1c
and r9d, 1
lea r8, str.Should_columnstore_object_pool_be_included_in_filtered_dump__d
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
mov r9d, dword [0x100427d40]
shr r9d, 0x1d
and r9d, 1
lea r8, str.Should_columnstore_blob_cache_be_included_in_filtered_dump__d
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
mov r9, qword [0x1004312c8]
shr r9, 0xb
lea r8, str.Total_columnstore_object_pool_memory_filtered_out:__llu_KB
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
mov r9, qword [0x1004312d0]
shr r9, 0xb
lea r8, str.Total_columnstore_blob_cache_filtered_out:__llu_KB
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
mov r9d, dword [0x1004312e8]
imul r9, qword [0x1004312d8]
shr r9, 0xb
lea r8, str.Total_pages_filtered_out_by_bitmap:__llu_KB
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
mov r9, qword [0x1004312e0]
shr r9, 0xb
lea r8, str.Total_file_mapped_memory_filtered_out:__llu_KB
mov edx, 2
lea rcx, [0x100422050]
call fcn.100401b20
lea rdx, [0x1004182a0]
call fcn.10040db20
lea rdx, str.sqldumper.exe
call fcn.10040db20
jmp 0x100406e5b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x400
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
mov r8d, edi
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r9d, edi
mov edx, 1
lea rcx, [0x100422050]
test eax, eax
je 0x100406e3d
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
lea r8, str.MiniDumpWriteDump____Failed_0x_x____ls
call fcn.100401b20
jmp 0x100406e49
lea r8, str.MiniDumpWriteDump____Failed_Error_Code_0x_x
call fcn.100401b20
mov rcx, r14
call fcn.10040b590
or dword [0x100422040], 0x20000010
jmp 0x100406e7e
cmp qword [0x100426468], 0
je 0x100406f0d
mov rcx, qword [0x100422460]
test rcx, rcx
jne 0x100406eaf
lea rcx, [0x100422050]
call fcn.1004020b0
test eax, eax
je 0x100406f0d
mov rcx, qword [0x100422460]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x40], ebx
mov r8d, dword [0x100426468]
add r8d, r8d
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
lea rdx, [0x100422468]
mov rcx, qword [0x100422460]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x100422460]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor edx, edx
mov r8d, 0x4008
lea rcx, [0x100422468]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x100443d90]
test eax, eax
je 0x100406f72
nop word [rax + rax]
dec eax
mov dword [0x100443d90], eax
mov rbx, qword [r14 + rax*8 + 0x1c6c8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x100406f5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.Unable_to_resume_suspended_thread____d
mov edx, 1
lea rcx, [0x100422050]
call fcn.100401b20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x100443d90]
test eax, eax
jne 0x100406f20
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov rcx, qword [rsp + 0x8d0]
xor rcx, rsp
call fcn.1004119e0
lea r11, [rsp + 0x8e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret