Function at 0x140003a60
Capabilities:
Capture process snapshot data
Get common file path
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r13, r9
mov rsi, r8
xor ebp, ebp
mov qword [rsp + 0x48], rbp
mov dword [r9], ebp
call fcn.140004ad0
mov r15d, eax
mov dword [rsp + 0x40], eax
mov ebx, 0x80
mov edx, ebx
mov rcx, rsi
call fcn.14000af10
mov rdi, rax
lea r12, [rax + 8]
cmp r12, rbx
cmovae r12, rbx
mov r14d, 2
mov edx, r14d
mov rcx, r12
call fcn.140002350
mov rbx, rax
mov qword [rsp + 0x50], rax
mov r9, rdi
mov r8, rsi
mov rdx, r12
mov rcx, rax
call fcn.14001151c
cmp r15d, 0xffffffff
jne 0x140003b19
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x48]
mov edx, 0x1981
mov r8d, 0x10001f
call sub.KERNEL32.dll_PssCaptureSnapshot
mov dword [r13], eax
test eax, eax
jne 0x140003fa4
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140003dd6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140003c89
mov ecx, r14d
call fcn.14000d0b0
mov rcx, rax
mov r8, rbx
lea rdx, str._nFailed_to_create_file__ws_as_it_already_exists._n
call fcn.140004ae0
mov edi, 1
mov rbp, rsi
mov r13, qword [rsp + 0xd0]
xor r15d, r15d
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x140003ba5
cmp rbp, 0xffffffffffffffff
jne 0x140003c70
cmp rdi, 0xa
jae 0x140003c70
mov edx, 0x80
mov rcx, rbx
call fcn.14000af10
sub rax, 4
lea rsi, [rbx + rax*2]
mov r8d, 4
lea rbp, [0x14001ed90]
mov rdx, rbp
mov rcx, rsi
call fcn.14000cf64
test eax, eax
jne 0x140003be4
mov word [rsi], r15w
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9d, 0x78
lea r8, str._.s___zu__s
mov rdx, r12
mov rcx, rbx
call fcn.140004b30
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140003c65
mov ecx, r14d
call fcn.14000d0b0
mov rcx, rax
mov r8, rbx
lea rdx, str._nFailed_to_create_file__ws_as_it_already_exists._n
call fcn.140004ae0
mov r8, r13
mov rdx, r12
mov rcx, rbx
call fcn.14000ce00
inc rdi
mov rbp, rsi
jmp 0x140003b90
cmp rsi, 0xffffffffffffffff
mov r15d, dword [rsp + 0x40]
mov r13, qword [rsp + 0xd8]
jne 0x140003dd4
xor ebp, ebp
mov rdx, r14
mov ecx, 0x105
call fcn.140002350
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, r14d
call fcn.14000d0b0
mov rcx, rax
mov r9d, esi
mov r8, rbx
lea rdx, str._nFailed_to_create_file__ws_with_error__x_nTrying_temporary_path._n
call fcn.140004ae0
mov rdx, rdi
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140003cdf
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbp, str._nGetTempPathW_failed_with_error___x_._n
jmp 0x140003d06
mov r9, rdi
xor r8d, r8d
lea rdx, [0x14001fc80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x140003d2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbp, str._nGetTempFileNameW_failed_with_error___x_._n
mov esi, eax
mov dword [r13], eax
mov ecx, r14d
call fcn.14000d0b0
mov rcx, rax
mov r8d, esi
mov rdx, rbp
call fcn.140004ae0
mov rcx, rdi
call fcn.1400023d0
jmp 0x140003fa4
lea rdx, str..tmp
mov rcx, rdi
call fcn.140005eb8
test rax, rax
je 0x140003d57
lea r8, str..dmp
mov edx, 5
mov rcx, rax
call fcn.14000ce00
mov rcx, rbx
call fcn.1400023d0
mov rbx, rdi
mov qword [rsp + 0x50], rbx
mov rdi, rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140003dcb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, r14d
call fcn.14000d0b0
mov rcx, rax
mov r9d, esi
mov r8, rbx
lea rdx, str._nFailed_to_create_temp_dump_file__ws_with_error__x_n
call fcn.140004ae0
mov rcx, rbp
call fcn.1400023d0
jmp 0x140003fa4
xor ecx, ecx
call fcn.1400023d0
jmp 0x140003dd6
xor ebp, ebp
xor edx, edx
mov r8d, 0x800
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r13, rax
test rax, rax
je 0x140003fa4
lea rdx, str.MiniDumpWriteDump
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rax, rax
je 0x140003fa4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x64], ebp
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x5c], rax
cmp r15d, 0xffffffff
je 0x140003eb9
mov edi, 0x410
cmp r15d, 2
ja 0x140003e54
test r15d, r15d
je 0x140003eb2
sub r15d, 1
je 0x140003eab
cmp r15d, 1
jne 0x140003e5e
mov ebp, 0x51b27
mov edi, 0x450
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140003fa4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, ebp
mov r8, rsi
mov rcx, rdi
call r12
xor ebp, ebp
jmp 0x140003efc
mov ebp, 0x40121
jmp 0x140003e5e
mov ebp, 0x1001a4
jmp 0x140003e59
lea rax, [0x1400047d0]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbp
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x21003
mov r8, rsi
mov rcx, qword [rsp + 0x48]
call r12
test eax, eax
jne 0x140003f27
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, r14d
call fcn.14000d0b0
mov rcx, rax
mov r9d, edi
mov r8, rbx
lea rdx, str._nFailed_to_save_dump_to___ws__with_error___x_._n
call fcn.140004ae0
jmp 0x140003f41
mov ecx, r14d
call fcn.14000d0b0
mov rcx, rax
mov r8, rbx
lea rdx, str._nSuccesfully_saved_dump_to___ws__n
call fcn.140004ae0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x48]
mov qword [rsp + 0xd8], rbp
mov r9d, 8
lea r8, [rsp + 0xd8]
mov edx, 1
mov rcx, rdi
call sub.KERNEL32.dll_PssQuerySnapshot
test eax, eax
jne 0x140003f92
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rdi
call sub.KERNEL32.dll_PssFreeSnapshot
nop
mov rcx, rbx
call fcn.1400023d0
mov eax, 1
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret