Function at 0x140001c1c
Capabilities:
Get common file path
Query environment variable
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x820
mov rax, qword [0x14000b0c8]
xor rax, rsp
mov qword [rsp + 0x810], rax
mov rdi, rdx
mov r15d, ecx
xor ebx, ebx
lea rcx, [r11 - 0x5f8]
lea rdx, str.TracePDB_creates_TMF_files_from_the_specified_PDB_file._If_you_specify_an_image_nfile__TracePDB_finds_the_PDB_file_for_the_image_and_then_creates_a_TMF_file._n_nUsage:_n_nTracePDB.exe___f__PDBFiles_____s____p__TMFDirectory_____v____c__nTracePDB.exe__i__ImageFiles____r__SymbolPaths_____p__TMFDirectory_____v____c__n_nParameters:_n_n_f__PDBFiles________Source_of_trace_formatting_instructions.__n____________________Default_LocalDirectory_.pdb._n____________________Valid_wildcards_are___and_._n_n_s__________________Recursive._Creates_TMF_files_for_all_PDB_files_n____________________that_match__f_in_all_subdirectories_of_the__f_path._n_n_p__TMFDirectory____Output_file_location__directory_only_._n____________________DefaultLocal_directory._n____________________Do_not_specify_a_file_name__the_file_name_is_generated_n____________________automatically_based_on_the_message_GUID._n_n_i_ImageFiles_______Image_Files_for_which_to_find_PDBs_and_creates_TMFs._n____________________Valid_wildcards_are___and_._n_n_r__SymbolPaths_____Path_to_private_PDB_symbol_files._Default__n____________________is___NT_SYMBOL_PATH__or_srv_symbols_symbols._n_n_o__TmfFile_________Name_of_single_tmf_file_output._n____________________Will_generate_a_single_TMF_file_n_n_c__________________Generate_TMC_files._n_n_v__________________Verbose._n_nDefault_values:_n_n_________PDBFiles_______LocalDirectory_.pdb._n_________TMFDirectory__Local_directory._n_________SymbolPath______NT_SYMBOL_PATH__or_srv_symbols_symbols_n
mov r8d, 0x5bc
mov r12b, bl
call sub.msvcrt.dll_memcpy
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop dword [rax + rax]
lea r13d, [rbx + 1]
test rax, rax
je 0x140001cb9
lea rdx, str.HeapSetInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x140001cb9
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
xor ecx, ecx
call qword [0x140007468]
call fcn.1400012a4
mov ebp, 0x104
lea rdx, [0x14000cce0]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
nop dword [rax + rax]
test eax, eax
jne 0x140001d15
mov ecx, r13d
call fcn.140006478
mov rdx, rax
lea rcx, str.TracePDB:_no_current_directory_n
call qword [sym.imp.msvcrt.dll_fputs]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
mov r8, rbp
lea rcx, [rsp + 0x30]
xor edx, edx
call sub.msvcrt.dll_memset
mov r8, rbp
lea rcx, [0x14000ce00]
xor edx, edx
call sub.msvcrt.dll_memset
lea r14, [0x14000b7c0]
mov esi, r13d
cmp r15d, r13d
jle 0x14000211b
add rdi, 8
mov rcx, qword [rdi]
or rdx, 0xffffffffffffffff
mov r8b, 0xdf
mov al, byte [rcx]
sub al, 0x2d
test al, 0xfd
jne 0x14000210b
mov cl, byte [rcx + 1]
lea eax, [rcx - 0x3f]
cmp al, 0x29
ja 0x140001d84
movabs rdx, 0x20000000201
bt rdx, rax
jb 0x1400021a9
or rdx, 0xffffffffffffffff
lea eax, [rcx - 0x46]
test r8b, al
je 0x140002079
lea eax, [rcx - 0x50]
test r8b, al
je 0x140002016
lea eax, [rcx - 0x4f]
test r8b, al
je 0x140001f3d
lea eax, [rcx - 0x53]
test r8b, al
je 0x140001f31
lea eax, [rcx - 0x43]
test r8b, al
je 0x140001ee3
lea eax, [rcx - 0x56]
test r8b, al
je 0x140001ed7
lea eax, [rcx - 0x49]
test r8b, al
je 0x140001e48
sub cl, 0x52
test r8b, cl
jne 0x1400021a4
add esi, r13d
add rdi, 8
cmp esi, r15d
jge 0x14000210b
mov rcx, qword [rdi]
mov rax, rdx
inc rax
cmp byte [rcx + rax], bl
jne 0x140001df6
add rax, r13
cmp rax, rbp
ja 0x140002174
lfence
mov r8, qword [rdi]
mov rdx, rbp
mov rcx, r14
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140001e36
mov al, byte [r8]
test al, al
je 0x140001e36
mov byte [rcx], al
add r8, r13
add rcx, r13
sub rdx, r13
jne 0x140001e16
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], bl
jmp 0x14000210b
add esi, r13d
add rdi, 8
cmp esi, r15d
jge 0x140001ecf
mov rcx, qword [rdi]
mov rax, rdx
inc rax
cmp byte [rcx + rax], bl
jne 0x140001e5a
add rax, r13
cmp rax, rbp
ja 0x1400021cf
lfence
mov r9, qword [rdi]
lea rax, [rsp + 0x30]
sub r9, rax
lea rcx, [rsp + 0x30]
mov rdx, rbp
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140001ea2
mov al, byte [r9 + rcx]
test al, al
je 0x140001ea2
mov byte [rcx], al
add rcx, r13
sub rdx, r13
jne 0x140001e84
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
cmp dword [0x14000b7b0], ebx
mov byte [rax], bl
je 0x140001ecf
mov r8, qword [rdi]
lea rcx, str.argv__d___s_n
mov edx, esi
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
mov r12b, r13b
jmp 0x14000210b
mov dword [0x14000b7b0], r13d
jmp 0x14000210b
cmp byte [0x14000b7b5], bl
jne 0x1400021ff
lea r9, [0x14000ce00]
mov rdx, rbp
lea r8, [0x140007fd0]
mov rcx, r9
sub r8, r9
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140001e36
mov al, byte [r8 + rcx]
test al, al
je 0x140001e36
mov byte [rcx], al
add rcx, r13
sub rdx, r13
jne 0x140001f06
jmp 0x140001e36
mov dword [0x14000b8c4], r13d
jmp 0x14000210b
add esi, r13d
add rdi, 8
cmp esi, r15d
jge 0x14000210b
mov rcx, qword [rdi]
mov rax, rdx
inc rax
cmp byte [rcx + rax], bl
jne 0x140001f53
add rax, r13
cmp rax, rbp
ja 0x14000222f
lea rax, [0x14000ce00]
mov rdx, rbp
lea r8, [0x140007f90]
mov rcx, rax
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140001f9c
mov al, byte [r8 + rcx]
test al, al
je 0x140001f9c
mov byte [rcx], al
add rcx, r13
sub rdx, r13
jne 0x140001f7e
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], bl
lfence
mov r8, qword [rdi]
lea rcx, [0x14000ce05]
mov rdx, rbp
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140001fd9
mov al, byte [r8]
test al, al
je 0x140001fd9
mov byte [rcx], al
add r8, r13
add rcx, r13
sub rdx, r13
jne 0x140001fb9
mov byte [0x14000b7b5], r13b
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
cmp dword [0x14000b7b0], ebx
mov byte [rax], bl
je 0x14000210b
mov r8, qword [rdi]
lea rcx, str.argv__d___s_n
mov edx, esi
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
jmp 0x14000210b
add esi, r13d
add rdi, 8
cmp esi, r15d
jge 0x14000210b
mov rcx, qword [rdi]
mov rax, rdx
inc rax
cmp byte [rcx + rax], bl
jne 0x14000202c
add rax, r13
cmp rax, rbp
ja 0x14000225f
lfence
mov r8, qword [rdi]
lea rcx, [0x14000cce0]
mov rdx, rbp
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140001fe0
mov al, byte [r8]
test al, al
je 0x140001fe0
mov byte [rcx], al
add r8, r13
add rcx, r13
sub rdx, r13
jne 0x140002050
jmp 0x140001fe0
add esi, r13d
add rdi, 8
cmp esi, r15d
jge 0x14000210b
mov rcx, qword [rdi]
mov rax, rdx
inc rax
cmp byte [rcx + rax], bl
jne 0x14000208f
add rax, r13
cmp rax, rbp
ja 0x14000228f
lfence
mov r9, qword [rdi]
lea rax, [rsp + 0x30]
sub r9, rax
lea rcx, [rsp + 0x30]
mov rdx, rbp
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400020d7
mov al, byte [r9 + rcx]
test al, al
je 0x1400020d7
mov byte [rcx], al
add rcx, r13
sub rdx, r13
jne 0x1400020b9
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
cmp dword [0x14000b7b0], ebx
mov byte [rax], bl
je 0x140002104
mov r8, qword [rdi]
lea rcx, str.argv__d___s_n
mov edx, esi
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
mov byte [0x14000b7b4], r13b
add esi, r13d
add rdi, 8
cmp esi, r15d
jl 0x140001d4c
cmp byte [0x14000b7b4], bl
je 0x1400022bf
test r12b, r12b
je 0x1400022d3
lea rcx, str._nTracePDB:_Choose_either__f_file.pdb_or__i_image_file_to_extract_TMF_files_n_n_n
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
mov ecx, r13d
call fcn.140006478
mov rdx, rax
lea rcx, [rsp + 0x250]
call qword [sym.imp.msvcrt.dll_fputs]
nop dword [rax + rax]
mov ecx, 0x57
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
mov ecx, r13d
call fcn.140006478
mov rdx, rax
lea rcx, str.TracePDB:_SymPath_Path_larger_than_MAX_PATH_n
call qword [sym.imp.msvcrt.dll_fputs]
nop dword [rax + rax]
mov ecx, 0x7a
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
mov ebx, 0x57
mov ecx, r13d
call fcn.140006478
mov rdx, rax
lea rcx, [rsp + 0x250]
call qword [sym.imp.msvcrt.dll_fputs]
nop dword [rax + rax]
mov eax, ebx
jmp 0x1400023b2
mov ecx, r13d
call fcn.140006478
mov rdx, rax
lea rcx, str.TracePDB:_PDBname_toolarge_n
call qword [sym.imp.msvcrt.dll_fputs]
nop dword [rax + rax]
mov ecx, 0x7a
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
mov ecx, r13d
call fcn.140006478
mov rdx, rax
lea rcx, str.TracePDB:_select_either__o_or__c__both_are_not_allowed_n
call qword [sym.imp.msvcrt.dll_fputs]
nop dword [rax + rax]
mov ecx, 0x57
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
mov ecx, r13d
call fcn.140006478
mov rdx, rax
lea rcx, str.TracePDB:_Out_file_name_and_path_larger_than_MAX_PATH_n
call qword [sym.imp.msvcrt.dll_fputs]
nop dword [rax + rax]
mov ecx, 0x7a
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
mov ecx, r13d
call fcn.140006478
mov rdx, rax
lea rcx, str.TracePDB:_Path_larger_than_MAX_PATH_n
call qword [sym.imp.msvcrt.dll_fputs]
nop dword [rax + rax]
mov ecx, 0x7a
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
mov ecx, r13d
call fcn.140006478
mov rdx, rax
lea rcx, str.TracePDB:_PDBname_toolarge_n
call qword [sym.imp.msvcrt.dll_fputs]
nop dword [rax + rax]
mov ecx, 0x7a
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
movzx eax, byte [0x14000b7b4]
test r12b, r12b
cmove eax, r13d
mov byte [0x14000b7b4], al
lea r9, [0x14000cce0]
mov rdx, rbp
lea r8, [0x140008060]
lea rcx, [rsp + 0x140]
call fcn.14000115c
lea rcx, [rsp + 0x140]
call qword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
nop dword [rax + rax]
test eax, eax
jne 0x14000232d
lea rdx, [0x14000cce0]
lea rcx, str.TracePDB:_Invalid_Target_Path_Name__s_n
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
mov eax, 0x57
jmp 0x1400023b2
cmp byte [0x14000b7b4], bl
jne 0x1400023a8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop dword [rax + rax]
cmp byte [0x14000b7c0], bl
mov qword [0x14000b7b8], rax
jne 0x1400023a8
mov r8d, ebp
lea rcx, str._NT_SYMBOL_PATH
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop dword [rax + rax]
dec eax
cmp eax, 0x102
jbe 0x1400023a8
lea rcx, str.srv_symbols_symbols
sub rcx, r14
lea rax, [rbp + 0x7ffffefa]
test rax, rax
je 0x14000239b
mov al, byte [rcx + r14]
test al, al
je 0x14000239b
mov byte [r14], al
add r14, r13
sub rbp, r13
jne 0x14000237c
test rbp, rbp
lea rax, [r14 - 1]
cmovne rax, r14
mov byte [rax], bl
lea rcx, [rsp + 0x30]
call fcn.140001520
mov rcx, qword [rsp + 0x810]
xor rcx, rsp
call fcn.140005e90
lea r11, [rsp + 0x820]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret