Function at 0x140074910
Capabilities:
Create process memory minidump
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x338
movdqa xmmword [rsp + 0x320], xmm7
movdqa xmmword [rsp + 0x310], xmm6
mov r14, r9
mov rbx, r8
mov rdi, rdx
mov r12, rcx
mov rax, qword [0x140191d78]
xor rax, rsp
mov qword [rsp + 0x308], rax
lea rdx, [r12 + 0x20]
lea rbp, [rsp + 0x90]
mov rcx, rbp
call fcn.140087380
mov rcx, qword [rbp]
test rcx, rcx
je 0x140074991
lea rdx, [rsp + 0x88]
mov qword [rdx], 0
mov rax, qword [rcx]
call qword [rax + 0x10]
test eax, eax
je 0x140074998
xor esi, esi
jmp 0x1400751b1
xor esi, esi
jmp 0x1400751c8
mov r15, qword [rsp + 0x3a0]
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x78]
call fcn.14008a110
mov eax, dword [r12 + 0x10]
mov dword [rsp + 0x68], eax
mov rax, qword [r12 + 0x18]
mov qword [rsp + 0x6c], rax
mov dword [rsp + 0x74], 1
lea rax, str.Win64
lea rsi, [rsp + 0x60]
mov qword [rsi], rax
lea rdx, str.prod
lea rbp, [rsp + 0x170]
mov rcx, rbp
mov r8, rdi
call fcn.140075600
lea rcx, [rsp + 0x1b0]
lea rdx, [0x14015c716]
mov r8, rbx
call fcn.140075600
lea rcx, [rsp + 0x1f0]
lea rdx, [0x14015c71a]
mov r8, r14
call fcn.140075600
lea rcx, [rsp + 0x230]
lea rdx, str.plat
mov r8, rsi
call fcn.140075660
lea rcx, [rsp + 0x270]
lea rdx, [0x14015c6c2]
mov r8, r15
call fcn.140075600
lea rdx, [rsp + 0x40]
mov qword [rdx], rbp
lea rax, [rsp + 0x2b0]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x50]
call fcn.1400756e0
lea rdi, [rsp + 0x290]
mov rsi, 0xfffffffffffffec0
mov rcx, rdi
call fcn.140001c80
lea rcx, [rdi - 0x20]
call fcn.140001c80
add rdi, 0xffffffffffffffc0
add rsi, 0x40
jne 0x140074a87
pxor xmm6, xmm6
lea rsi, [rsp + 0x100]
movdqa xmmword [rsi], xmm6
movdqa xmmword [rsi + 0x40], xmm6
movdqa xmmword [rsi + 0x30], xmm6
movdqa xmmword [rsi + 0x20], xmm6
movdqa xmmword [rsi + 0x10], xmm6
mov dword [rsi], 0x50
mov rcx, r12
call fcn.14001f030
mov r8d, 0x50
mov rcx, rax
mov rdx, rsi
call sub.PSAPI.DLL_GetProcessMemoryInfo
test eax, eax
je 0x140074c8d
mov rdx, qword [rsp + 0x148]
shr rdx, 0xc
lea rdi, [rsp + 0x2d0]
mov rcx, rdi
call fcn.140021080
lea rax, str.ProcessPrivateUsage
lea rbp, [rsp + 0x178]
mov qword [rbp - 8], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbp], xmm0
movups xmm0, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x10], xmm0
mov eax, 0xf
movq xmm7, rax
pslldq xmm7, 8
movdqu xmmword [rdi + 0x10], xmm7
xor r13d, r13d
mov byte [rdi], r13b
lea rbx, [rsp + 0x50]
lea r15, [rsp + 0x170]
mov rcx, rbx
mov rdx, r15
call fcn.140075750
mov qword [rsp + 0x20], rax
lea r9, [rax + 0x20]
lea rdx, [rsp + 0x2b0]
xor r8d, r8d
mov rcx, rbx
call fcn.14005c250
mov rcx, rbp
call fcn.140001c80
mov rcx, rdi
call fcn.140001c80
mov rdx, qword [rsp + 0x108]
shr rdx, 0xc
lea rdi, [rsp + 0x2d0]
mov rcx, rdi
call fcn.140021080
lea rax, str.ProcessPeakWorkingSetSize
mov qword [r15], rax
lea rsi, [rsp + 0x178]
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
movdqu xmmword [rdi + 0x10], xmm7
mov byte [rdi], r13b
lea rbp, [rsp + 0x170]
mov rcx, rbx
mov rdx, rbp
call fcn.140075750
mov qword [rsp + 0x20], rax
lea r9, [rax + 0x20]
lea rdx, [rsp + 0x2b0]
xor r8d, r8d
mov rcx, rbx
call fcn.14005c250
mov rcx, rsi
call fcn.140001c80
mov rcx, rdi
call fcn.140001c80
mov rdx, qword [rsp + 0x140]
shr rdx, 0xc
lea rdi, [rsp + 0x2d0]
mov rcx, rdi
call fcn.140021080
lea rax, str.ProcessPeakPagefileUsage
mov qword [rbp], rax
lea rsi, [rsp + 0x178]
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
movdqu xmmword [rdi + 0x10], xmm7
mov byte [rdi], r13b
lea rdx, [rsp + 0x170]
mov rcx, rbx
call fcn.140075750
mov qword [rsp + 0x20], rax
lea r9, [rax + 0x20]
lea rdx, [rsp + 0x2b0]
xor r8d, r8d
mov rcx, rbx
call fcn.14005c250
mov rcx, rsi
call fcn.140001c80
mov rcx, rdi
call fcn.140001c80
lea rcx, [rsp + 0x170]
movdqa xmmword [rcx], xmm6
movdqa xmmword [rcx + 0x50], xmm6
movdqa xmmword [rcx + 0x40], xmm6
movdqa xmmword [rcx + 0x30], xmm6
movdqa xmmword [rcx + 0x20], xmm6
movdqa xmmword [rcx + 0x10], xmm6
mov qword [rcx + 0x60], 0
mov dword [rcx], 0x68
mov edx, 0x68
call sub.PSAPI.DLL_GetPerformanceInfo
test eax, eax
je 0x140074deb
mov edx, dword [rsp + 0x180]
sub edx, dword [rsp + 0x178]
lea rdi, [rsp + 0x2b0]
mov rcx, rdi
call fcn.140020eb0
lea rax, str.SystemCommitRemaining
lea rbp, [rsp + 0x2d8]
mov qword [rbp - 8], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbp], xmm0
movups xmm0, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x10], xmm0
mov eax, 0xf
movq xmm6, rax
pslldq xmm6, 8
movdqu xmmword [rdi + 0x10], xmm6
xor r15d, r15d
mov byte [rdi], r15b
lea rbx, [rsp + 0x50]
lea rsi, [rsp + 0x2d0]
mov rcx, rbx
mov rdx, rsi
call fcn.140075750
mov qword [rsp + 0x20], rax
lea r9, [rax + 0x20]
lea rdx, [rsp + 0x150]
xor r8d, r8d
mov rcx, rbx
call fcn.14005c250
mov rcx, rbp
call fcn.140001c80
mov rcx, rdi
call fcn.140001c80
mov edx, dword [rsp + 0x180]
lea rdi, [rsp + 0x2b0]
mov rcx, rdi
call fcn.140020eb0
lea rax, str.SystemCommitLimit
mov qword [rsi], rax
lea rsi, [rsp + 0x2d8]
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
movdqu xmmword [rdi + 0x10], xmm6
mov byte [rdi], r15b
lea rdx, [rsp + 0x2d0]
mov rcx, rbx
call fcn.140075750
mov qword [rsp + 0x20], rax
lea r9, [rax + 0x20]
lea rdx, [rsp + 0x150]
xor r8d, r8d
mov rcx, rbx
call fcn.14005c250
mov rcx, rsi
call fcn.140001c80
mov rcx, rdi
call fcn.140001c80
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
call qword [rax + 8]
test rax, rax
je 0x140074e0e
lea rdx, [rsp + 0xf0]
mov rcx, rax
call fcn.14008a400
lea rsi, [rsp + 0x150]
mov rcx, rsi
call fcn.140012850
mov rcx, rsi
call fcn.140039ab0
test al, al
je 0x14007500f
lea rsi, [rsp + 0x170]
lea rdx, [rsp + 0x150]
mov r8d, 0x2061
mov rcx, rsi
call fcn.140021860
mov rcx, rsi
call fcn.140021a70
test al, al
je 0x140075168
lea rdx, str.canary
xor r8d, r8d
mov rcx, r14
call fcn.140003460
test rax, rax
je 0x140074e90
lea rdx, [0x14015c72e]
xor r8d, r8d
mov rcx, r14
call fcn.140003460
mov r14d, 0x1920
test rax, rax
jne 0x140074e96
mov r14d, 0x1960
pxor xmm6, xmm6
lea rax, [rsp + 0x2d0]
movdqu xmmword [rax + 0x24], xmm6
mov ecx, 1
mov dword [rax], ecx
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rax + 0x14], xmm0
mov rdx, qword [rsp + 0x88]
movups xmm0, xmmword [rdx + 8]
movups xmmword [rax + 4], xmm0
movabs rdx, 0x3443500001
lea rbp, [rsp + 0xa8]
mov qword [rbp], rdx
mov qword [rbp + 8], rax
lea rdi, [rsp + 0x98]
mov dword [rdi], ecx
mov qword [rdi + 4], rbp
lea rcx, [rsp + 0x170]
call fcn.140022f30
mov rsi, rax
mov rcx, r12
call fcn.14001f050
mov ebx, eax
mov rcx, r12
call fcn.14001f030
mov qword [rsp + 0x28], rdi
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], 0
mov rcx, rax
mov edx, ebx
mov r8, rsi
mov r9d, r14d
call sub.dbghelp.dll_MiniDumpWriteDump
test eax, eax
je 0x140075168
movdqa xmmword [rsp + 0x2c0], xmm6
movdqa xmmword [rsp + 0x2b0], xmm6
lea r8, [rsp + 0x100]
movdqa xmmword [r8 + 0x10], xmm6
movdqa xmmword [r8], xmm6
lea rcx, [rsp + 0x170]
xor edx, edx
mov r9d, 0x20
call fcn.140021bf0
cmp eax, 0x20
jne 0x14007515b
cmp dword [rsp + 0x100], 0x504d444d
jne 0x14007515b
mov edx, dword [rsp + 0x108]
test rdx, rdx
je 0x14007515b
lea rsi, [rsp + 0x2b8]
mov rcx, rsi
mov r8, rsi
call fcn.140075860
mov eax, dword [rsp + 0x108]
mov edx, dword [rsp + 0x10c]
shl eax, 2
lea edi, [rax + rax*2]
mov r8, qword [rsi]
lea rcx, [rsp + 0x170]
mov r9d, edi
call fcn.140021bf0
cmp eax, edi
jne 0x14007515b
mov rdi, qword [rsp + 0x2b8]
mov rdx, qword [rsp + 0x2c0]
cmp rdi, rdx
je 0x140075016
cmp dword [rdi], 0
je 0x140075016
add rdi, 0xc
cmp rdx, rdi
jne 0x140074fff
jmp 0x140075070
xor esi, esi
jmp 0x140075177
cmp rdi, rdx
je 0x140075070
lea rax, [rdi + 0xc]
cmp rax, rdx
je 0x14007504c
cmp dword [rax], 0
je 0x140075039
mov ecx, dword [rax + 8]
mov dword [rdi + 8], ecx
mov rcx, qword [rax]
mov qword [rdi], rcx
add rdi, 0xc
add rax, 0xc
cmp rdx, rax
jne 0x140075024
mov rbx, qword [rsp + 0x2c0]
jmp 0x14007504f
mov rbx, rdx
cmp rdi, rdx
je 0x14007506d
sub rbx, rdx
mov rcx, rdi
mov r8, rbx
call fcn.1400f0ce0
add rbx, rdi
mov qword [rsp + 0x2c0], rbx
mov rdx, rbx
mov dword [rsp + 0x104], 0xa793
mov r8, qword [rsp + 0x2b8]
sub rdx, r8
sar rdx, 2
movabs rax, 0xaaaaaaaaaaaaaaab
imul rax, rdx
mov rcx, rax
shr rcx, 0x20
cmp rcx, 1
sbb ecx, ecx
not ecx
or ecx, eax
mov dword [rsp + 0x108], ecx
shl ecx, 2
lea edi, [rcx + rcx*2]
mov edx, dword [rsp + 0x10c]
lea rcx, [rsp + 0x170]
mov r9d, edi
call fcn.140021d80
cmp eax, edi
jne 0x14007515b
lea rdi, [rsp + 0x170]
lea r8, [rsp + 0x100]
xor edx, edx
mov r9d, 0x20
mov rcx, rdi
call fcn.140021d80
cmp eax, 0x20
jne 0x14007515b
mov qword [rsp + 0x2b0], rdi
xorps xmm0, xmm0
movaps xmmword [rsp + 0x120], xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
mov dword [rsp + 0x130], 0
mov rax, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x2c0]
cmp rax, rcx
je 0x1400755aa
cmp dword [rax], 0x43500001
je 0x1400751fe
add rax, 0xc
cmp rcx, rax
jne 0x140075141
jmp 0x1400755aa
lea rcx, [rsp + 0x2b8]
call fcn.1400e3770
xor esi, esi
lea rcx, [rsp + 0x170]
call fcn.1400219c0
lea rcx, [rsp + 0x150]
call fcn.1400138f0
lea rdi, [rsp + 0x50]
mov r9, qword [rdi]
mov r8, qword [r9]
lea rdx, [rsp + 0x170]
mov rcx, rdi
call fcn.14005b210
mov rcx, qword [rdi]
call fcn.1400edcd0
lea rcx, [rsp + 0x78]
call fcn.14008a120
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x1400751c8
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rcx, qword [rsp + 0x308]
xor rcx, rsp
call fcn.1400edc60
mov eax, esi
movaps xmm6, xmmword [rsp + 0x310]
movaps xmm7, xmmword [rsp + 0x320]
add rsp, 0x338
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp dword [rax + 4], 0x34
jne 0x1400755aa
mov edi, dword [rax + 8]
test rdi, rdi
je 0x1400755aa
lea rcx, [rsp + 0x170]
lea r8, [rsp + 0x100]
mov r9d, 0x34
mov rdx, rdi
call fcn.140021bf0
cmp eax, 0x34
jne 0x1400755aa
cmp dword [rsp + 0x100], 1
jne 0x1400755aa
mov rcx, qword [rsp + 0x2b0]
mov edx, 2
xor r8d, r8d
call fcn.140021b60
mov rbx, rax
cmp ebx, 0xffffffff
je 0x1400755aa
xorps xmm0, xmm0
movaps xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], 0
mov r12, qword [rsp + 0x50]
mov r14, qword [r12]
mov qword [rsp + 0xc8], r14
cmp r14, r12
je 0x140075404
xor r15d, r15d
mov qword [rsp + 0xc0], r15
cmp qword [r14 + 0x50], r15
je 0x1400753d4
mov dword [rsp + 0xc0], ebx
mov rax, qword [r14 + 0x30]
mov rcx, rax
shr rcx, 0x20
cmp rcx, 1
sbb ecx, ecx
not ecx
or ecx, eax
mov dword [rsp + 0xbc], ecx
mov rcx, qword [rsp + 0x2b0]
mov r8d, 4
lea rdx, [rsp + 0xbc]
call fcn.140021e40
mov ecx, 0xffffffff
cmp eax, ecx
je 0x14007559d
lea rdx, [r14 + 0x20]
mov r13d, dword [rsp + 0xbc]
cmp qword [r14 + 0x38], 0x10
jb 0x140075311
mov rdx, qword [rdx]
test r13d, r13d
js 0x14007559d
mov rcx, qword [rsp + 0x2b0]
mov r8d, r13d
call fcn.140021e40
cmp eax, 0xffffffff
je 0x14007559d
add ebx, 4
add ebx, r13d
mov dword [rsp + 0xc4], ebx
mov rax, qword [r14 + 0x50]
mov rcx, rax
shr rcx, 0x20
cmp rcx, 1
sbb ecx, ecx
not ecx
or ecx, eax
mov dword [rsp + 0xb8], ecx
mov rcx, qword [rsp + 0x2b0]
mov r8d, 4
lea rdx, [rsp + 0xb8]
call fcn.140021e40
mov ecx, 0xffffffff
cmp eax, ecx
je 0x14007559d
lea rdx, [r14 + 0x40]
mov ebp, dword [rsp + 0xb8]
cmp qword [r14 + 0x58], 0x10
jb 0x140075399
mov rdx, qword [rdx]
test ebp, ebp
js 0x14007559d
mov rcx, qword [rsp + 0x2b0]
mov r8d, ebp
call fcn.140021e40
cmp eax, 0xffffffff
je 0x14007559d
add ebx, 4
add ebx, ebp
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0xc0]
call fcn.1400d3840
lea rcx, [rsp + 0xc8]
call fcn.1400a5440
mov r14, qword [rsp + 0xc8]
cmp r14, r12
jne 0x14007529e
mov rcx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xd8]
jmp 0x140075408
xor ecx, ecx
xor eax, eax
sub rax, rcx
sar rax, 3
mov rcx, rax
shr rcx, 0x20
cmp rcx, 1
sbb ecx, ecx
not ecx
or ecx, eax
lea rdx, [rsp + 0xc8]
mov dword [rdx], ecx
mov rcx, qword [rsp + 0x2b0]
mov r8d, 4
call fcn.140021e40
mov ecx, 0xffffffff
cmp eax, ecx
je 0x14007559d
mov ebp, dword [rsp + 0xc8]
cmp ebp, 0xfffffff
ja 0x14007559d
shl ebp, 3
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x2b0]
mov r8d, ebp
call fcn.140021e40
cmp eax, 0xffffffff
je 0x14007559d
or ebp, 4
lea r8, [rsp + 0x100]
mov dword [r8 + 0x24], ebp
mov dword [r8 + 0x28], ebx
mov rcx, qword [rsp + 0x2b0]
mov r9d, 0x34
mov rdx, rdi
call fcn.140021d80
mov edi, eax
lea rcx, [rsp + 0xd0]
call fcn.1400d2130
mov rcx, rsi
call fcn.1400e3770
cmp edi, 0x34
jne 0x140075168
mov rax, qword [rsp + 0x88]
mov rdi, qword [rax]
xor esi, esi
lea rcx, [rsp + 0x170]
xor edx, edx
xor r8d, r8d
call fcn.140021b60
mov ecx, 0xffffffff
cmp rax, rcx
je 0x14007516a
xorps xmm0, xmm0
lea rcx, [rsp + 0x100]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
mov edx, 0x400
mov r8, rcx
call fcn.140005ab0
lea rsi, [rsp + 0x170]
lea r14, [rsp + 0x2d0]
mov rbx, qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, dword [rsp + 0x108]
mov rdx, qword [rsp + 0x100]
sub r8d, edx
mov rcx, rsi
call fcn.140021cd0
mov ebp, eax
cmp ebp, 0xffffffff
je 0x14007558b
test ebp, ebp
je 0x1400755b2
mov dword [rsp + 0x2d0], 0
mov rdx, qword [rsp + 0x100]
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov r8d, ebp
mov r9, r14
call rbx
test eax, eax
je 0x14007558b
cmp dword [rsp + 0x2d0], ebp
je 0x140075531
lea rcx, [rsp + 0x100]
call fcn.14000b370
jmp 0x140075168
lea rcx, [rsp + 0xd0]
call fcn.1400d2130
mov rcx, rsi
jmp 0x140075163
lea rsi, [rsp + 0x100]
mov rcx, rsi
call fcn.14000b370
lea rcx, [rsp + 0x78]
call fcn.14008a140
xorps xmm0, xmm0
movaps xmmword [rsi], xmm0
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x88]
lea r8, [rsp + 0x100]
call qword [rax + 0x18]
test eax, eax
sete sil
jmp 0x14007516a