Function at 0x1401f0220
Capabilities:
Create process memory minidump
Get common file path
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x288]
sub rsp, 0x388
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov r14, r9
mov r15, r8
mov dword [rsp + 0x40], edx
mov r13, rcx
mov r8d, edx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x1401f02ca
lea rdi, str.0cg_
mov rax, qword [str.0cg_]
cmp rax, rdi
je 0x1401f02be
test byte [rax + 0x1c], 1
je 0x1401f02be
cmp byte [rax + 0x19], 2
jb 0x1401f02be
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [r12 + 0xd]
mov dword [rsp + 0x20], eax
mov r9d, 0xcc
lea r8, [0x140608588]
mov rcx, qword [str.0cg_]
mov rcx, qword [rcx + 0x10]
call fcn.140084bf0
mov rax, 0xffffffffffffffff
jmp 0x1401f080f
mov rdx, r12
lea rcx, [rbp + 0x38]
call fcn.1401d2c90
nop
lea rbx, [rbp + 0x38]
cmp qword [rbp + 0x50], 8
cmovae rbx, qword [rbp + 0x38]
mov edx, 0x5c
mov rcx, rbx
call fcn.14035b2dc
test rax, rax
je 0x1401f02fb
lea rbx, [rax + 2]
xor eax, eax
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], ax
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], ax
jne 0x1401f0320
mov rdx, rbx
lea rcx, [rbp + 0x18]
call fcn.1400739a0
nop
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 8]
call fcn.1401efde0
nop
xor ebx, ebx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], bx
mov rdx, qword [r14 + 0x10]
lea rdi, str.0cg_
test rdx, rdx
je 0x1401f03dd
movabs rax, 0x7ffffffffffffffe
sub rax, rdx
cmp rax, qword [rbp + 8]
jb 0x1401f0838
lfence
cmp qword [r14 + 0x18], 8
jb 0x1401f038f
mov r14, qword [r14]
lea rcx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rcx, qword [rbp - 8]
mov rax, qword [rbp + 8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov r9, r14
lea rcx, [rsp + 0x68]
call fcn.14007d050
lea rcx, [rbp - 0x48]
call fcn.140073b90
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rsp + 0x78]
movups xmmword [rbp - 0x38], xmm1
jmp 0x1401f0574
mov word [rbp + 0x60], bx
mov r8d, 0x105
lea rdx, [rbp + 0x60]
lea rcx, str.HMPA_DUMP_FOLDER
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1401f046a
mov word [rbp + 0x60], bx
lea rdx, [rbp + 0x60]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1401f046a
mov rax, qword [str.0cg_]
cmp rax, rdi
je 0x1401f0450
test byte [rax + 0x1c], 1
je 0x1401f0450
cmp byte [rax + 0x19], 2
jb 0x1401f0450
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.0cg_]
mov edx, 0xb
mov r9d, eax
lea r8, [0x140608588]
mov rcx, qword [rcx + 0x10]
call fcn.140082b10
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bx
jmp 0x1401f04dd
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], bx
lea rax, [rbp + 0x60]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x1401f0485
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x28]
call fcn.1400739a0
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1401f04cb
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rax, qword [rbp - 0x28]
cmp word [rax + rcx*2 - 2], 0x5c
je 0x1401f04cb
mov edx, 0x5c
lea rcx, [rbp - 0x28]
call fcn.1400847d0
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rsp + 0x58], xmm1
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
lea rcx, [rsp + 0x48]
call fcn.140073720
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm0
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rcx, [rbp - 0x48]
call fcn.140073b90
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rbp - 0x28]
movups xmmword [rbp - 0x38], xmm1
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1401f0574
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401f056f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401f083e
call fcn.140359090
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1401f05eb
mov rax, qword [str.0cg_]
cmp rax, rdi
je 0x1401f06fd
test byte [rax + 0x1c], 1
je 0x1401f06fd
cmp byte [rax + 0x19], 2
jb 0x1401f06fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [r14 + 0xe]
mov r9d, 0xe9
jmp 0x1401f06a0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbp - 0x68], eax
mov qword [rbp - 0x64], r13
mov dword [rbp - 0x5c], ebx
lea rcx, [rbp - 0x68]
test r13, r13
cmove rcx, rbx
mov dword [rbp - 0x58], 0xb
mov eax, dword [r15 + 0x10]
lea eax, [rax*2 + 2]
mov dword [rbp - 0x54], eax
cmp qword [r15 + 0x18], 8
jb 0x1401f0625
mov r15, qword [r15]
mov qword [rbp - 0x50], r15
mov dword [rbp - 0x78], 1
lea rax, [rbp - 0x58]
mov qword [rbp - 0x74], rax
mov qword [rsp + 0x30], rbx
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9d, 0x41826
mov r8, r14
mov edx, dword [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
mov ebx, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1401f06bd
mov rax, qword [str.0cg_]
cmp rax, rdi
je 0x1401f06fd
test byte [rax + 0x1c], 1
je 0x1401f06fd
cmp byte [rax + 0x19], 2
jb 0x1401f06fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [rbx + 0xe]
mov r9d, 0x110
mov dword [rsp + 0x20], eax
mov rcx, qword [str.0cg_]
lea r8, [0x140608588]
mov rcx, qword [rcx + 0x10]
call fcn.140084bf0
jmp 0x1401f06fd
mov rcx, qword [str.0cg_]
cmp rcx, rdi
je 0x1401f06f8
test byte [rcx + 0x1c], 1
je 0x1401f06f8
cmp byte [rcx + 0x19], 2
jb 0x1401f06f8
lea r9, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae r9, qword [rbp - 0x48]
mov edx, 0xf
lea r8, [0x140608588]
mov rcx, qword [rcx + 0x10]
call fcn.1400786c0
mov esi, 1
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x1401f073d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401f0738
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401f0844
call fcn.140359090
xor eax, eax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], ax
mov rdx, qword [rbp + 0x10]
cmp rdx, 8
jb 0x1401f0790
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401f078a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401f084a
call fcn.140359090
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x1401f07d1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401f07cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401f0850
call fcn.140359090
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 8
jb 0x1401f080d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401f0808
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401f0832
call fcn.140359090
mov eax, esi
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.140359070
add rsp, 0x388
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140368068
nop
call fcn.1400737a0
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
int3