Function at 0x41ca0f
Capabilities:
Create process memory minidump

Disassembly:
push 0x460
push 0x4b2778
call fcn.0044de15
mov eax, dword [ebp + 8]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x440], eax
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x434], edi
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x444], eax
xor ecx, ecx
mov dword [ebp - 0x430], ecx
cmp dword [0x4bf974], ecx
je 0x41ccbd
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x41ca76
test edi, edi
je 0x41ccbd
test eax, eax
je 0x41ccbd
push 0x410
push ecx
lea eax, [ebp - 0x42c]
push eax
call fcn.0044f154
add esp, 0xc
mov bx, word [0x4c0110]
test bx, bx
je 0x41cb0d
mov edx, 0x47ecf4
mov eax, 0x4c0110
mov ecx, eax
mov di, word [ecx]
cmp di, word [edx]
jne 0x41cacb
test di, di
je 0x41cac5
mov di, word [ecx + 2]
cmp di, word [edx + 2]
jne 0x41cacb
add ecx, 4
add edx, 4
test di, di
jne 0x41caa3
xor edi, edi
mov ecx, edi
jmp 0x41cad2
sbb ecx, ecx
or ecx, 1
xor edi, edi
test ecx, ecx
jne 0x41cae1
xor ebx, ebx
inc ebx
mov edi, dword [ebp - 0x434]
jmp 0x41cb13
movzx ecx, bx
lea edx, [ebp - 0x42c]
mov dword [edx], eax
test cx, cx
je 0x41caf9
add eax, 2
cmp word [eax], di
jne 0x41caf1
add edx, 4
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x41caea
mov edi, dword [ebp - 0x434]
mov ebx, dword [ebp - 0x430]
test esi, esi
je 0x41cb2b
push 0x104
push 0x4c98a2
push str.unknown
call fcn.00406256
call fcn.0041b9a3
test eax, eax
je 0x41ccbd
push 0
push 0x40000000
push dword [ebp + 0xc]
push dword [ebp - 0x43c]
push dword [ebp - 0x440]
push 0x4bca58
lea eax, [ebp - 0x430]
push eax
call fcn.0041cd51
test eax, eax
je 0x41ccbd
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x470], eax
mov dword [ebp - 0x46c], edi
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x464], ebx
mov dword [ebp - 0x45c], 0x4c93cc
mov eax, dword [0x4bf978]
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x460], esi
mov edx, dword [0x4bf980]
test edx, edx
je 0x41cbc6
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x450], edx
mov dword [ebp - 0x44c], 1
mov dword [ebp - 0x438], 0x41f3bd
lea eax, [ebp - 0x470]
mov dword [ebp - 0x434], eax
cmp dword [0x4c93cc], 0
je 0x41cbf7
mov ecx, dword [0x4c93d0]
test esi, esi
je 0x41cc00
or ecx, 0x400
jmp 0x41cbfc
mov ecx, 0x121
test esi, esi
jne 0x41cc06
or ecx, 0x200
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x438]
push eax
push ebx
lea eax, [ebp - 0x454]
xor edi, edi
test edx, edx
cmove eax, edi
push eax
push ecx
push dword [ebp - 0x430]
push dword [0x4bf974]
push dword [0x4bf994]
call sub.dbghelp.dll_MiniDumpWriteDump
test eax, eax
jne 0x41cc45
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41ccb6
mov dword [ebp - 4], 0xfffffffe
push dword [ebp - 0x430]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x41cc6d
push 0x41
push 0x4c9860
push 0x4c98a2
call fcn.0041fe76
mov edi, dword [ebp - 0x448]
push edi
push dword [ebp - 0x43c]
call fcn.0041d913
test eax, eax
je 0x41ccbd
cmp dword [edi + 0xc], ebx
je 0x41ccbd
test esi, esi
je 0x41cca1
mov ecx, dword [0x4c9abc]
test ecx, ecx
cmove ecx, dword [0x4bf97c]
mov dword [0x4c9abc], ecx
xor eax, eax
inc eax
jmp 0x41ccbf
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.0044de5e
ret 0x1c