Function at 0x41c560
Capabilities:
Create process memory minidump
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51fe9e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x10dc
call fcn.004e3340
xor eax, eax
mov word [ebp - 0x814], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x812]
push ecx
call fcn.004df590
add esp, 0xc
xor edx, edx
mov word [ebp - 0x1014], dx
push 0x7fe
push 0
lea eax, [ebp - 0x1012]
push eax
call fcn.004df590
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x1030], cx
xor edx, edx
mov dword [ebp - 0x102e], edx
mov dword [ebp - 0x102a], edx
mov dword [ebp - 0x1026], edx
mov word [ebp - 0x1022], dx
lea eax, [ebp - 0x1030]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0x1a
lea ecx, [ebp - 0x1014]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.004358c0
mov dword [ebp - 0x10], eax
push str.make_minidump:
mov ecx, dword [ebp - 0x10]
call fcn.004389a0
movzx edx, word [ebp - 0x1024]
push edx
movzx eax, word [ebp - 0x1026]
push eax
movzx ecx, word [ebp - 0x1028]
push ecx
movzx edx, word [ebp - 0x102a]
push edx
movzx eax, word [ebp - 0x102e]
push eax
movzx ecx, word [ebp - 0x1030]
push ecx
push str.CrashDump
lea edx, [ebp - 0x1014]
push edx
push str._s_s___4d_02d_02d__02d_02d_02d.dmp
push 0x400
lea eax, [ebp - 0x814]
push eax
call fcn.00421880
add esp, 0x2c
lea ecx, [ebp - 0x814]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041baf0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00459cf0
push eax
lea ecx, [ebp - 0x10d8]
call fcn.0041f550
mov dword [ebp - 0x10dc], eax
mov edx, dword [ebp - 0x10dc]
mov dword [ebp - 0x10e0], edx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10e0]
call fcn.00459cf0
push eax
lea ecx, [ebp - 0x1054]
call fcn.004025c0
mov dword [ebp - 0x10e4], eax
mov eax, dword [ebp - 0x10e4]
mov dword [ebp - 0x10e8], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10e8]
call fcn.00419640
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004389a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1054]
call fcn.00401ef0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10d8]
call fcn.0041f590
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x814]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1034], eax
cmp dword [ebp - 0x1034], 0xffffffff
jne 0x41c74c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401640
jmp 0x41c7ca
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x1020], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0x101c], edx
mov dword [ebp - 0x1018], 0
push 0
push 0
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
lea ecx, [ebp - 0x1020]
and eax, ecx
push eax
push 0x52
mov edx, dword [ebp - 0x1034]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.dbghelp.dll_MiniDumpWriteDump
cmp dword [ebp - 0x1034], 0
je 0x41c7bb
mov eax, dword [ebp - 0x1034]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1034], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401640
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret