Function at 0x1600cacf4
Capabilities:
Create process memory minidump
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1210]
mov eax, 0x1310
call fcn.160072500
sub rsp, rax
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x1368], rbx
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0x1200], rax
mov r12, r8
mov qword [rsp + 0x50], r8
mov r13, rdx
mov r14d, ecx
mov rax, qword [rbp + 0x1278]
mov qword [rsp + 0x58], rax
mov r15, qword [rbp + 0x1280]
mov rsi, qword [rbp + 0x1288]
mov edi, dword [rbp + 0x1290]
mov dword [rsp + 0x48], edi
mov ebx, 1
xor edx, edx
mov r8d, 0xf003f
lea rcx, [rbp + 0x8d0]
call fcn.16005a5e4
nop
mov r9d, 0x20019
lea r8, str.Gathering_Manager
lea rdx, [rbp + 0x8d0]
lea rcx, [rbp + 0x810]
call fcn.1600c96d4
nop
lea r8, [rsp + 0x40]
lea rdx, str.SaveHungMiniDumps
lea rcx, [rbp + 0x810]
call fcn.16005a9b0
test eax, eax
je 0x1600cb470
mov ecx, dword [rsp + 0x40]
cmp ecx, 0x64
jb 0x1600caded
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, 0xcccccccd
mul ecx
shr edx, 3
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
test ecx, ecx
jne 0x1600cb236
call fcn.16006f0b4
test al, al
je 0x1600cae26
call fcn.16006f0b4
test al, al
je 0x1600cae26
call fcn.16006f0b4
test al, al
je 0x1600cae26
call fcn.16006f0b4
test al, al
je 0x1600cae26
call fcn.16006f0b4
test al, al
je 0x1600cae26
mov al, 1
jmp 0x1600cae28
xor al, al
test al, al
je 0x1600cb470
lea rdi, [rdi*8]
xor edx, edx
mov rcx, qword [rdi + r13]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1600cb470
xor edx, edx
mov r8d, 0x8a0
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x70], 0x8a0
mov rcx, qword [rdi + r13]
mov qword [rsp + 0x78], rcx
mov r9d, 0x104
lea r8, [rbp + 0x200]
xor edx, edx
call qword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_K32GetModuleFileNameExW]
test eax, eax
jne 0x1600cae92
mov ebx, 0x80004005
jmp 0x1600caf0d
mov r9d, 0x80
lea r8, [rbp + 0x100]
lea rdx, [rbp + 0x200]
call fcn.1600cb674
test eax, eax
jne 0x1600caeb6
mov ebx, 0x80004005
jmp 0x1600caf0d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
lea rdx, str.MSSrch.dll
lea rcx, [rsp + 0x58]
call fcn.16000ece8
mov r9d, 0x200
lea r8, [rbp + 0x408]
mov edx, r14d
lea rcx, [rsp + 0x58]
call fcn.1600cb9fc
mov r9d, 0x80
lea r8, [rbp]
mov edx, 0x20a
lea rcx, [rsp + 0x58]
call fcn.1600cb9fc
lea rcx, [rsp + 0x58]
call fcn.16000ed28
xor edi, edi
mov qword [rsp + 0x40], rdi
test ebx, ebx
js 0x1600caf51
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
lea edx, [rdi + 3]
lea rcx, str.MsSearchTerminateProcess
call qword [sym.imp.ext_ms_win_wer_reporting_l1_1_0.dll_WerReportCreate]
mov ebx, eax
test eax, eax
js 0x1600caf51
lea r9, [rbp + 0x100]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ext_ms_win_wer_reporting_l1_1_0.dll_WerReportSetParameter]
mov ebx, eax
xor edx, edx
lea r8d, [rdx + 0x2a]
lea rcx, [rbp + 0x990]
call sub.msvcrt.dll_memset
test ebx, ebx
js 0x1600cb21d
lea rdx, [rbp + 0x990]
lea rcx, [rbp + 0x200]
call fcn.1600cb8bc
test eax, eax
jne 0x1600caf8c
mov ebx, 0x80004005
jmp 0x1600cb21d
lea r9, [rbp + 0x990]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ext_ms_win_wer_reporting_l1_1_0.dll_WerReportSetParameter]
mov ebx, eax
test eax, eax
js 0x1600cb21d
mov r9, r15
xor r8d, r8d
lea edx, [r8 + 2]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ext_ms_win_wer_reporting_l1_1_0.dll_WerReportSetParameter]
mov ebx, eax
test eax, eax
js 0x1600cb21d
mov esi, edi
mov r14d, dword [rbp + 0x1270]
test r14d, r14d
je 0x1600cb1ff
mov r15d, dword [rsp + 0x48]
xor edx, edx
mov rcx, qword [r13]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1600cb1ec
lea r9d, [rax + 2]
lea r8, [rbp + 0xff0]
xor edx, edx
mov rcx, qword [r13]
call qword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x1600cb034
mov r9d, 0x104
lea r8, [rbp + 0xbd0]
lea rdx, [rbp + 0xff0]
call fcn.1600cb674
test eax, eax
jne 0x1600cb053
lea r9, str.Unknown
lea r8, [0x1601fb2f8]
mov edx, 0x104
lea rcx, [rbp + 0xbd0]
call fcn.160059e34
xor r9d, r9d
lea r8d, [r9 + 0x23]
lea rdx, [rbp + 0x9c0]
xor ecx, ecx
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1600cb1ec
mov ecx, 0x104
lea rax, [rbp + 0x9c0]
cmp word [rax], di
je 0x1600cb091
add rax, 2
sub rcx, 1
jne 0x1600cb07d
jmp 0x1600cb1ec
test rcx, rcx
je 0x1600cb1ec
mov eax, 0x104
sub rax, rcx
lea rdx, [rbp + 0x9c0]
lea rdx, [rdx + rax*2]
mov r10d, edi
test rcx, rcx
je 0x1600cb0ec
mov eax, 0x7ffffffe
lea r9, str.WindowsSearchMiniDumps
sub r9, rdx
test rax, rax
je 0x1600cb0e7
movzx r8d, word [r9 + rdx]
test r8w, r8w
je 0x1600cb0e7
mov word [rdx], r8w
add rdx, 2
dec rax
sub rcx, 1
jne 0x1600cb0c4
jmp 0x1600cb0ec
test rcx, rcx
jne 0x1600cb0f6
sub rdx, 2
mov r10d, 0x8007007a
mov word [rdx], di
test r10d, r10d
js 0x1600cb1ec
lea r8, str._s_s__d.kdmp
cmp esi, r15d
lea rax, str._s_s__d.hdmp
cmovne r8, rax
mov dword [rsp + 0x28], esi
lea rax, [rbp + 0xbd0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x9c0]
mov edx, 0x104
lea rcx, [rbp + 0xde0]
call fcn.160059e34
test eax, eax
js 0x1600cb1ec
xor r8d, r8d
lea rdx, [rbp + 0x9c0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_shell_shdirectory_l1_1_0.dll_Ordinal_290]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0xde0]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1600cb1be
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov r9d, 0xb25
mov r8, rax
mov edx, dword [r12]
mov rcx, qword [r13]
call qword [sym.imp.api_ms_win_core_debug_minidump_l1_1_0.dll_MiniDumpWriteDump]
test eax, eax
je 0x1600cb203
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov r8d, 3
cmp esi, r15d
mov eax, 5
cmovne r8d, eax
lea r9d, [rax - 4]
lea rdx, [rbp + 0xde0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ext_ms_win_wer_reporting_l1_1_0.dll_WerReportAddFile]
mov ebx, eax
test eax, eax
js 0x1600cb21d
inc esi
add r12, 4
add r13, 8
cmp esi, r14d
jb 0x1600cafe5
test ebx, ebx
js 0x1600cb21d
xor r9d, r9d
lea edx, [r9 + 1]
mov r8d, 0x104
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ext_ms_win_wer_reporting_l1_1_0.dll_WerReportSubmit]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1600cb470
call qword [sym.imp.ext_ms_win_wer_reporting_l1_1_0.dll_WerReportCloseHandle]
jmp 0x1600cb470
cmp ecx, 1
jne 0x1600cb470
xor edi, edi
mov r15d, edi
mov r12d, dword [rbp + 0x1270]
test r12d, r12d
je 0x1600cb464
lea r14, str._s_s__s__d.mdmp
xor edx, edx
mov rcx, qword [r13]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1600cb447
lea r9d, [rax + 2]
lea r8, [rbp + 0xff0]
xor edx, edx
mov rcx, qword [r13]
call qword [sym.imp.api_ms_win_core_psapi_l1_1_0.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x1600cb2aa
mov r9d, 0x104
lea r8, [rbp + 0xbd0]
lea rdx, [rbp + 0xff0]
call fcn.1600cb674
test eax, eax
jne 0x1600cb2c9
lea r9, str.Unknown
lea r8, [0x1601fb2f8]
mov edx, 0x104
lea rcx, [rbp + 0xbd0]
call fcn.160059e34
xor r9d, r9d
lea r8d, [r9 + 0x23]
lea rdx, [rbp + 0x9c0]
xor ecx, ecx
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1600cb447
mov ecx, 0x104
lea rax, [rbp + 0x9c0]
cmp word [rax], di
je 0x1600cb307
add rax, 2
sub rcx, 1
jne 0x1600cb2f3
jmp 0x1600cb447
test rcx, rcx
je 0x1600cb447
mov eax, 0x104
sub rax, rcx
lea rdx, [rbp + 0x9c0]
lea rdx, [rdx + rax*2]
mov r10d, edi
test rcx, rcx
je 0x1600cb362
mov eax, 0x7ffffffe
lea r9, str.WindowsSearchMiniDumps
sub r9, rdx
test rax, rax
je 0x1600cb35d
movzx r8d, word [rdx + r9]
test r8w, r8w
je 0x1600cb35d
mov word [rdx], r8w
add rdx, 2
dec rax
sub rcx, 1
jne 0x1600cb33a
jmp 0x1600cb362
test rcx, rcx
jne 0x1600cb36c
sub rdx, 2
mov r10d, 0x8007007a
mov word [rdx], di
test r10d, r10d
js 0x1600cb447
lea r8, str._s_s__s__d.kdmp
cmp r15d, dword [rsp + 0x48]
cmovne r8, r14
mov eax, dword [rsi]
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0xbd0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x9c0]
mov edx, 0x104
lea rcx, [rbp + 0xde0]
call fcn.160059e34
test eax, eax
js 0x1600cb447
xor r8d, r8d
lea rdx, [rbp + 0x9c0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_shell_shdirectory_l1_1_0.dll_Ordinal_290]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0xde0]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1600cb440
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov r9d, 0xb25
mov r8, rax
mov rax, qword [rsp + 0x50]
mov edx, dword [rax]
mov rcx, qword [r13]
call qword [sym.imp.api_ms_win_core_debug_minidump_l1_1_0.dll_MiniDumpWriteDump]
test eax, eax
je 0x1600cb45f
mov ebx, edi
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
lea r14, str._s_s__s__d.mdmp
inc r15d
add qword [rsp + 0x50], 4
add r13, 8
cmp r15d, r12d
jb 0x1600cb25b
jmp 0x1600cb464
mov ebx, 1
inc dword [rsi]
mov eax, dword [rsi]
cmp eax, 0xa
cmovae eax, edi
mov dword [rsi], eax
lea rcx, [rbp + 0x810]
call fcn.16005ab2c
nop
lea rcx, [rbp + 0x8d0]
call fcn.16005ab2c
mov eax, ebx
mov rcx, qword [rbp + 0x1200]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0x1368]
add rsp, 0x1310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret