Function at 0x407400
Capabilities:
Terminate process

Disassembly:
sub esp, 0x844
mov eax, dword [0x429008]
xor eax, esp
mov dword [esp + 0x83c], eax
push ebx
mov ebx, dword [esp + 0x84c]
push ebp
push esi
mov esi, dword [esp + 0x858]
mov ebp, 1
push edi
mov edi, ecx
mov dword [esp + 0x20], esi
lea eax, [ebx - 2]
mov dword [esp + 0x14], ebp
mov dword [edi + 0xe194], ebp
cmp eax, 0xb
ja 0x407e73
cmp ebx, 2
jne 0x407472
mov ecx, dword [esi + 4]
movzx eax, word [ecx]
cmp eax, 0x2d
je 0x40745c
cmp eax, 0x2f
jne 0x407472
movzx eax, word [ecx + 2]
cmp eax, 0x3f
je 0x407e73
cmp eax, 0x68
je 0x407e73
lea eax, [ebx - 1]
mov dword [esp + 0x1c], 0
push eax
push str.Input_parameters:__d_supplied
push 2
push 0x429048
lfence
call fcn.00404d90
add esp, 0x10
mov esi, ebp
cmp ebx, 1
jle 0x4074c5
mov ebp, dword [esp + 0x20]
push dword [ebp + esi*4]
push esi
push str._tParameter__d:__s
push 2
push 0x429048
call fcn.00404d90
inc esi
add esp, 0x14
cmp esi, ebx
jl 0x4074a0
mov ebp, 1
jmp 0x4074cd
test ebx, ebx
jle 0x4077a1
xor eax, eax
mov ecx, ebx
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x20]
mov ebx, dword [edx + eax*4]
cmp word [ebx], 0x2d
jne 0x40782a
movzx eax, word [ebx + 2]
lea esi, [ebx + 2]
cmp eax, 0x49
jne 0x407500
lea eax, [ebx + 4]
mov dword [edi + 0xf328], eax
jmp 0x407790
cmp eax, 0x53
jne 0x407513
lea eax, [ebx + 4]
mov dword [edi + 0xf32c], eax
jmp 0x407790
mov ecx, str.remoteservers:print
mov eax, esi
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407546
test dx, dx
je 0x407542
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407546
add eax, 4
add ecx, 4
test dx, dx
jne 0x407520
xor eax, eax
jmp 0x40754b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40755b
or dword [edi + 0x2dc98], 3
jmp 0x407789
mov ecx, str.remoteservers:dump
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407588
test dx, dx
je 0x407584
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407588
add eax, 4
add ecx, 4
test dx, dx
jne 0x407562
xor eax, eax
jmp 0x40758d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40759d
or dword [edi + 0x2dc98], 0x25
jmp 0x407789
mov ecx, str.remoteservers:freeze
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4075ca
test dx, dx
je 0x4075c6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4075ca
add eax, 4
add ecx, 4
test dx, dx
jne 0x4075a4
xor eax, eax
jmp 0x4075cf
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4075df
or dword [edi + 0x2dc98], 0x29
jmp 0x407789
mov ecx, str.remoteservers:resume
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40760c
test dx, dx
je 0x407608
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40760c
add eax, 4
add ecx, 4
test dx, dx
jne 0x4075e6
xor eax, eax
jmp 0x407611
sbb eax, eax
or eax, 1
test eax, eax
jne 0x407621
or dword [edi + 0x2dc98], 0x31
jmp 0x407789
push 0x1a
push str.remoteservers:remoteinvoke
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x40764f
push ebx
mov ecx, edi
call fcn.0040b900
mov ebp, eax
mov dword [esp + 0x14], ebp
mov dword [edi + 0x2dc9c], ebp
jmp 0x407789
push 9
push str._DumpUID:
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x407707
lea ecx, [esp + 0x38]
lea eax, [ebx + 0x12]
push ecx
push eax
mov dword [edi + 0x2def4], eax
call dword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
je 0x407789
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x400
mov esi, eax
lea eax, [esp + 0x50]
push eax
push 0x400
push esi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x4076de
lea eax, [esp + 0x48]
push eax
push esi
push str.Guid_format_for_DumpUID_is_incorrect
push str._s_0x_x____ls
push 1
push 0x429048
call fcn.00404d90
add esp, 0x18
mov dword [edi + 0x2def4], 0
jmp 0x407789
push esi
push str.Guid_format_for_DumpUID_is_incorrect
push str._s_0x_x
push 1
push 0x429048
call fcn.00404d90
add esp, 0x14
mov dword [edi + 0x2def4], 0
jmp 0x407789
push 8
push str._Upload:
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x407819
movaps xmm0, xmmword [0x425e80]
xor esi, esi
movups xmmword [esp + 0x28], xmm0
nop
mov ebp, dword [esp + esi*4 + 0x28]
mov edx, dword [ebp*4 + 0x418aa8]
mov eax, edx
lea ecx, [eax + 2]
mov dword [esp + 0x24], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407744
sub eax, dword [esp + 0x24]
sar eax, 1
push eax
push edx
lea eax, [ebx + 0x10]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4077e2
inc esi
cmp esi, 4
jl 0x407730
xor ebp, ebp
push ebx
mov dword [esp + 0x18], ebp
push str.Invalid_dump_upload_mode_specified:__ls
push 1
push 0x429048
call fcn.00404d90
add esp, 0x10
mov ecx, dword [esp + 0x858]
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, ecx
jl 0x4074d5
mov eax, dword [edi + 0x2def4]
lea ebx, [edi + 0x2def4]
test eax, eax
jne 0x407b54
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x407b1d
push eax
push str.UuidCreate_failed._Unable_to_create_a_dump_UID._Status:_I64d
push 1
push 0x429048
call fcn.00404d90
add esp, 0x10
jmp 0x407be1
cmp byte [edi + 0xe192], 0
je 0x407803
push ebx
push str.DumpUploadMode_parameter_already_specified___ls
push 1
push 0x429048
call fcn.00404d90
mov ebp, dword [esp + 0x24]
jmp 0x407786
mov dword [edi + 0x2def8], ebp
mov ebp, dword [esp + 0x14]
mov byte [edi + 0xe192], 1
jmp 0x407789
xor ebp, ebp
push ebx
mov dword [esp + 0x18], ebp
push str.Invalid_parameter_specified:__ls
jmp 0x40777a
mov ecx, dword [esp + 0x1c]
cmp ecx, 9
ja case.default.0x407837
jmp dword [ecx*4 + 0x408084]
push 0xa
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
add esp, 0xc
mov dword [edi + 0xf30c], eax
cmp ebx, dword [esp + 0x18]
jne 0x4079b2
push ebx
push str.Invalid_value_for_process_id____ls
push 1
xor ebp, ebp
push 0x429048
mov dword [esp + 0x24], ebp
call fcn.00404d90
mov eax, dword [esp + 0x20]
add esp, 0x10
inc dword [esp + 0x1c]
mov ecx, dword [esp + 0x858]
jmp 0x407794
push 0xa
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
add esp, 0xc
mov dword [edi + 0xf310], eax
cmp ebx, dword [esp + 0x18]
jne 0x4079b2
push ebx
push str.Invalid_value_for_thread_id____ls
push 1
xor ebp, ebp
push 0x429048
mov dword [esp + 0x24], ebp
call fcn.00404d90
mov eax, dword [esp + 0x20]
add esp, 0x10
inc dword [esp + 0x1c]
mov ecx, dword [esp + 0x858]
jmp 0x407794
lea esi, [edi + 0xe7e8]
push esi
lea ebp, [edi + 0xe7e4]
push ebp
push str._X:_X
push ebx
call fcn.00404620
add esp, 0x10
test eax, eax
jne 0x40792d
push ebx
push str.Invalid_value_for_dump_flags____ls
push 1
xor ebp, ebp
push 0x429048
mov dword [esp + 0x24], ebp
call fcn.00404d90
mov eax, dword [esp + 0x20]
add esp, 0x10
inc dword [esp + 0x1c]
mov ecx, dword [esp + 0x858]
jmp 0x407794
mov eax, dword [ebp]
mov dword [edi + 0xf308], eax
test eax, 0x800
je 0x40794f
and eax, 0xfffff7ff
or dword [esi], 0x1160
mov ecx, dword [esi]
mov dword [ebp], eax
jmp 0x407955
mov ecx, dword [edi + 0xe7e8]
test al, 0x10
je 0x407964
and eax, 0xffffffef
or ecx, 2
mov dword [ebp], eax
mov dword [esi], ecx
test al, 8
je 0x407973
and eax, 0xfffffff7
or ecx, 0x40
mov dword [ebp], eax
mov dword [esi], ecx
test eax, 0x1000
je 0x40798d
and eax, 0xffffefff
or eax, 0x20
or ecx, 0x1826
mov dword [ebp], eax
mov dword [esi], ecx
test eax, 0x8000
je 0x4079a4
or eax, 0x8020
or ecx, 0x1826
mov dword [ebp], eax
mov dword [esi], ecx
test al, 1
je 0x4079ae
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc dword [esp + 0x1c]
mov ecx, dword [esp + 0x858]
jmp 0x407794
lea esi, [edi + 0xf304]
push esi
push 0x41b1e0
push ebx
call fcn.00404620
add esp, 0xc
test eax, eax
jne 0x4079b2
push ebx
push str.Invalid_value_for_DumpInfo____ls
push 1
xor ebp, ebp
mov dword [esi], eax
push 0x429048
mov dword [esp + 0x24], ebp
call fcn.00404d90
mov eax, dword [esp + 0x20]
add esp, 0x10
inc dword [esp + 0x1c]
mov ecx, dword [esp + 0x858]
jmp 0x407794
inc dword [esp + 0x1c]
mov ecx, dword [esp + 0x858]
mov dword [edi + 0xf314], ebx
jmp 0x407794
lea esi, [edi + 0xf318]
push esi
push 0x41b1e0
push ebx
call fcn.00404620
add esp, 0xc
test eax, eax
jne 0x4079b2
push ebx
push str.Invalid_value_for_exception_record____ls
push 1
xor ebp, ebp
mov dword [esi], eax
push 0x429048
mov dword [esp + 0x24], ebp
call fcn.00404d90
mov eax, dword [esp + 0x20]
add esp, 0x10
inc dword [esp + 0x1c]
mov ecx, dword [esp + 0x858]
jmp 0x407794
lea esi, [edi + 0xf31c]
push esi
push 0x41b1e0
push ebx
call fcn.00404620
add esp, 0xc
test eax, eax
jne 0x4079b2
push ebx
push str.Invalid_value_for_exception_context____ls
push 1
xor ebp, ebp
mov dword [esi], eax
push 0x429048
mov dword [esp + 0x24], ebp
call fcn.00404d90
mov eax, dword [esp + 0x20]
add esp, 0x10
inc dword [esp + 0x1c]
mov ecx, dword [esp + 0x858]
jmp 0x407794
inc dword [esp + 0x1c]
mov ecx, dword [esp + 0x858]
mov dword [edi + 0xf320], ebx
jmp 0x407794
inc dword [esp + 0x1c]
mov ecx, dword [esp + 0x858]
mov dword [edi + 0xf324], ebx
jmp 0x407794
push ebx
push str.Unknown_parameter____ls
push 1
xor ebp, ebp
push 0x429048
mov dword [esp + 0x24], ebp
call fcn.00404d90
mov eax, dword [esp + 0x20]
add esp, 0x10
inc dword [esp + 0x1c]
mov ecx, dword [esp + 0x858]
jmp 0x407794
movups xmm0, xmmword [esp + 0x28]
push ebx
lea eax, [esp + 0x2c]
push eax
movups xmmword [edi + 8], xmm0
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
je 0x407be1
push eax
push str.UuidToStringW_call_failed.Unable_to_convert_the_dump_UID._Status:_I64d
push 1
push 0x429048
call fcn.00404d90
add esp, 0x10
jmp 0x407be1
lea ecx, [esp + 0x28]
push ecx
push eax
call dword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
je 0x407bd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x400
mov esi, eax
lea eax, [esp + 0x50]
push eax
push 0x400
push esi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x407bb6
lea eax, [esp + 0x48]
push eax
push esi
push str.Guid_format_for_DumpUID_is_incorrect
push str._s_0x_x____ls
push 1
push 0x429048
call fcn.00404d90
add esp, 0x18
mov dword [ebx], 0
jmp 0x407be1
push esi
push str.Guid_format_for_DumpUID_is_incorrect
push str._s_0x_x
push 1
push 0x429048
call fcn.00404d90
add esp, 0x14
mov dword [ebx], 0
jmp 0x407be1
movups xmm0, xmmword [esp + 0x28]
movups xmmword [edi + 8], xmm0
mov edx, dword [edi + 0x2dc98]
mov ecx, edx
and ecx, 0xffffffde
lea eax, [ecx - 1]
test ecx, eax
je 0x407c0f
push str.Only_one_distributed_dumping_option_should_be_present
push 1
push 0x429048
call fcn.00404d90
mov edx, dword [edi + 0x2dc98]
add esp, 0xc
xor ebp, ebp
test edx, edx
je 0x407e0b
test dword [edi + 0xe7e4], 0x40000
je 0x407e0b
push str.Cannot_specify_remote_options_with_no_remote_activation_flag
push 1
push 0x429048
call fcn.00404d90
add esp, 0xc
xor ebp, ebp
or dword [0x429040], 0x20001000
push str.Parameter_error
push 1
push 0x429048
call fcn.00404d90
add esp, 0xc
test dword [edi + 0xe7e4], 0x100
mov ecx, 1
movzx eax, byte [0x42d460]
push str.Parsed_parameters:
cmovne eax, ecx
push 2
push 0x429048
mov byte [0x42d460], al
call fcn.00404d90
add esp, 0xc
push dword [edi + 0xf30c]
push str.____ProcessID___d
push 2
push 0x429048
call fcn.00404d90
push dword [edi + 0xf310]
push str.____ThreadId___d
push 2
push 0x429048
call fcn.00404d90
push dword [edi + 0xe7e4]
push str.____Flags__0x_X
push 2
push 0x429048
call fcn.00404d90
push dword [edi + 0xe7e8]
push str.____MiniDumpFlags__0x_X
push 2
push 0x429048
call fcn.00404d90
add esp, 0x40
push dword [edi + 0xf304]
push str.____SqlInfoPtr__0x_p
push 2
push 0x429048
call fcn.00404d90
mov eax, dword [edi + 0xf314]
mov esi, str._NULL_
test eax, eax
mov ecx, esi
cmovne ecx, eax
push ecx
push str.____DumpDir___ls
push 2
push 0x429048
call fcn.00404d90
push dword [edi + 0xf318]
push str.____ExceptionRecordPtr__0x_p
push 2
push 0x429048
call fcn.00404d90
push dword [edi + 0xf31c]
push str.____ContextPtr__0x_p
push 2
push 0x429048
call fcn.00404d90
mov eax, dword [edi + 0xf320]
add esp, 0x40
test eax, eax
mov ecx, esi
cmovne ecx, eax
push ecx
push str.____ExtraFile___ls
push 2
push 0x429048
call fcn.00404d90
mov eax, dword [edi + 0xf324]
mov ecx, esi
test eax, eax
cmovne ecx, eax
push ecx
push str.____PatternForExtraFiles___ls
push 2
push 0x429048
call fcn.00404d90
mov eax, dword [edi + 0xf328]
mov ecx, esi
test eax, eax
cmovne ecx, eax
push ecx
push str.____InstanceName___ls
push 2
push 0x429048
call fcn.00404d90
mov eax, dword [edi + 0xf32c]
mov ecx, esi
test eax, eax
cmovne ecx, eax
push ecx
push str.____ServiceName___ls
push 2
push 0x429048
call fcn.00404d90
mov eax, dword [ebx]
add esp, 0x40
test eax, eax
cmovne esi, eax
push esi
push str.____DumpUID___ls
push 2
push 0x429048
call fcn.00404d90
add esp, 0x10
cmp byte [edi + 0xe192], 0
je 0x407e22
mov eax, dword [edi + 0x2def8]
mov eax, dword [eax*4 + 0x418aa8]
jmp 0x407e27
test ebp, ebp
je 0x407c3d
mov dword [edi + 0xe194], 2
jmp 0x407c5b
mov eax, str._NULL_
push eax
push str.____DumpUploadMode___ls
push 2
push 0x429048
call fcn.00404d90
add esp, 0x10
test ebp, ebp
jne 0x407e56
push str.ParseParameters_...__return_false.
lea eax, [edi + 0x46]
push 0x104
push eax
call fcn.00401fd0
add esp, 0xc
mov ecx, dword [esp + 0x84c]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00414600
add esp, 0x844
ret 8
push dword [esi]
push str.Usage:__ls__ProcessID__ThreadId__Flags_:MiniDumpFlags___SqlInfoPtr__DumpDir__ExceptionRecordPtr__ContextPtr__ExtraFile__PatternForExtraFiles____________I_InstanceName_____S_ServiceName____remoteservers:_printdumpfreezeresumeremote:guiddumporigin_signaturelocalIdportoperationType____DumpUID:guid____Upload:WERAPIAWDumpLinkAWDumpMoveAWDumpCopy__n
call fcn.004045b0
add esp, 8
cmp ebx, 2
jne 0x408078
mov ecx, dword [esi + 4]
movzx eax, word [ecx]
cmp eax, 0x2d
je 0x407e9f
cmp eax, 0x2f
jne 0x408078
movzx eax, word [ecx + 2]
cmp eax, 0x3f
je 0x407eb1
cmp eax, 0x68
jne 0x408078
push str.__Flags:_n
call fcn.004045b0
add esp, 4
push str.____dbgbreak__________________________0x0001_n
call fcn.004045b0
add esp, 4
push str.____nominidump________________________0x0002_n
call fcn.004045b0
add esp, 4
push str.____validate_image____________________0x0004_n
call fcn.004045b0
add esp, 4
push str.____referenced_memory_________________0x0008_n
call fcn.004045b0
add esp, 4
push str.____all_memory________________________0x0010_n
call fcn.004045b0
add esp, 4
push str.____dump_all_threads__________________0x0020_n
call fcn.004045b0
add esp, 4
push str.____match_file_name___________________0x0040_n
call fcn.004045b0
add esp, 4
push str.____no_longer_used_flag_______________0x0080_n
call fcn.004045b0
add esp, 4
push str.____verbose___________________________0x0100_n
call fcn.004045b0
add esp, 4
push str.____wait_at_exit______________________0x0200_n
call fcn.004045b0
add esp, 4
push str.____send_to_watson____________________0x0400_n
call fcn.004045b0
add esp, 4
push str.____defaultflags______________________0x0800_n
call fcn.004045b0
add esp, 4
push str.____maximumdump_______________________0x1000_n
call fcn.004045b0
add esp, 4
push str.____mini_and_maxdump__________________0x2000_n
call fcn.004045b0
add esp, 4
push str.____force_send_to_watson______________0x4000_n
call fcn.004045b0
add esp, 4
push str.____full_filtered_dump________________0x8000_n
call fcn.004045b0
add esp, 4
push str.____no_auto_remote_dump_invocation____0x40000_n
call fcn.004045b0
add esp, 4
push str.____process_name_in_dump_name_________0x1000000_n
call fcn.004045b0
add esp, 4
push 0x41a8e4
call fcn.004045b0
add esp, 4
push 0x41a8e8
call fcn.004045b0
add esp, 4
push str.____Normal____________________________0x0000_n
call fcn.004045b0
add esp, 4
push str.____WithDataSegs______________________0x0001_n
call fcn.004045b0
add esp, 4
push str.____WithFullMemory____________________0x0002_n
call fcn.004045b0
add esp, 4
push str.____WithHandleData____________________0x0004_n
call fcn.004045b0
add esp, 4
push str.____FilterMemory______________________0x0008_n
call fcn.004045b0
add esp, 4
push str.____ScanMemory________________________0x0010_n
call fcn.004045b0
add esp, 4
push str.____WithUnloadedModules_______________0x0020_n
call fcn.004045b0
add esp, 4
push str.____WithIndirectlyReferencedMemory____0x0040_n
call fcn.004045b0
add esp, 4
push str.____FilterModulePaths_________________0x0080_n
call fcn.004045b0
add esp, 4
push str.____WithProcessThreadData_____________0x0100_n
call fcn.004045b0
add esp, 4
push str.____WithPrivateReadWriteMemory________0x0200_n
call fcn.004045b0
add esp, 4
push str.____WithoutOptionalData_______________0x0400_n
call fcn.004045b0
add esp, 4
push str.____WithFullMemoryInfo________________0x0800_n
call fcn.004045b0
add esp, 4
push str.____WithThreadInfo____________________0x1000_n
call fcn.004045b0
add esp, 4
push 0x20001000
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov dh, 0x79
inc eax
add byte [esi], bh
js 0x4080cb
add byte [esi - 0x21ffbf88], cl
js 0x4080d3
add dh, al
jns 0x4080d7
add byte [eax], dl
jp 0x4080db
add byte [esi], ah
jp 0x4080df
add byte [edx + edi*2 + 0x40], dh
add dl, al
jp 0x4080e7
add al, bl
jp 0x4080eb
add ah, cl
int3
or byte [eax - 0x3bccffbe], dl
mov dword [esp + 0x148c], eax
push ebx
push ebp
and al, 0x8c
adc al, 0
add byte [ebx + 0x55], dl
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
and al, 0xc
add byte [eax], al
add byte [eax], al
push edi
xor edi, edi
cmp dword [esi + 0xe194], 2
inc dword [ebx + 0xe194be]
loope 0x4080ed
add byte [edx], al
jb 0x4087d5
mov eax, dword [esi + 0xe804]
test eax, eax
je 0x408114
push eax
push str.Dump_is_associated_with_file__ls
push 2
push 0x429048
call fcn.00404d90
add esp, 0x10
test dword [esi + 0xe7e4], 0x400040
je 0x408277
lea ebp, [esi + 0xe3cc]
mov ecx, esi
push ebp
push str..mdmp
lea eax, [esi + 0xe7f0]
push eax
call fcn.0040ff80
test eax, eax
je 0x408277
mov ebx, dword [esi + 0xe82c]
mov dword [esi + 0xe7e0], 0xffffffff
test ebx, ebx
je 0x408233
test dword [esi + 0xe7e4], 0x400000
je 0x408233
cmp word [esi + 0xdd82], 0
lea edi, [esi + 0xdd82]
je 0x40821e
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40821e
push edi
push str.Signature_file_exists:__ls
push 2
push 0x429048
call fcn.00404d90
push ebx
push str.Not_creating_an_additional_dump__because_dump_for_stack_signature__p_already_exists.
push 2
push 0x429048
mov byte [esi + 0xdd80], 1
mov byte [esi + 0x24e], 1
call fcn.00404d90
push ebx
push str.Not_creating_an_additional_dump__because_dump_for_stack_signature__p_already_exists.
lea eax, [esi + 0x46]
mov dword [esi + 0x40], 0x50
push 0x104
push eax
call fcn.00401fd0
mov esi, dword [esi + 0xe804]
add esp, 0x30
test esi, esi
je 0x408217
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
add esp, 4
cmp eax, 0xffffffff
jne 0x408217
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
push esi
push str.Unable_to_delete_additional_dump_file__s__errno__d_
push 2
push 0x429048
call fcn.00404d90
add esp, 0x14
xor eax, eax
jmp 0x40880a
push edi
push str.Signature_file_doesnt_exist:__ls
push 2
push 0x429048
call fcn.00404d90
add esp, 0x10
push 0
push 0x80
push 1
push 0
push 3
push 0xc0000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0xe7e0], eax
cmp eax, 0xffffffff
jne 0x408418
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push str.CreateFileW_failed_to_create_dump_file:__ls._GetLastError:__d
push 1
push 0x429048
call fcn.00404d90
add esp, 0x14
cmp dword [esi + 0xe808], 0
jne 0x40836f
mov ecx, dword [esi + 0xe818]
test ecx, ecx
jne 0x40829a
cmp dword [esi + 0xf304], ecx
je 0x40836f
push dword [esi + 0xe7e4]
mov edx, dword [esi + 0xe81c]
call fcn.00405610
mov ebp, eax
test ebp, ebp
je 0x4083d6
push 0x20a
lea eax, [esp + 0xc9c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x268], 0x20a
cmp dword [esi + 0xe818], 0
lea eax, [esp + 0x268]
mov ecx, str.ErrorReportingDir
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0xc9c]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
mov eax, str.ErrorDumpDir
cmove eax, ecx
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408368
cmp dword [esp + 0x14], 1
jne 0x408368
lea ebx, [esi + 0xf538]
mov edx, 0x103
lea edi, [esp + 0xc98]
mov ecx, ebx
sub edi, ebx
lea eax, [edx + 0x7ffffefb]
test eax, eax
je 0x408351
movzx eax, word [ecx + edi]
test ax, ax
je 0x408351
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x408333
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edx, edx
je 0x408368
mov dword [esi + 0xe808], ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
lea ebp, [esi + 0xe3cc]
push ebp
push str..mdmp
push dword [esi + 0xe808]
lea eax, [esi + 0xe1c2]
mov ecx, esi
push eax
call fcn.00410650
test eax, eax
je 0x4083b9
push 0
push 0x80
push 1
push 0
push 3
push 0xc0000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0xe7e0], eax
cmp eax, 0xffffffff
jne 0x408418
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x50
jne 0x40875e
inc edi
cmp edi, 5
jge 0x4087bd
jmp 0x408377
or dword [0x429040], 0x20000002
push str.OpenCPEKey_...__failed._Not_able_to_get_ErrorDumpDir_or_ErrorReportingDir_from_registry.
push 1
push 0x429048
call fcn.00404d90
add esp, 0xc
mov dword [esi + 0x40], 2
lea eax, [esi + 0x46]
push str.OpenCPEKey_...__failed._Not_able_to_get_ErrorDumpDir_or_ErrorReportingDir_from_registry.
push 0x104
push eax
call fcn.00401fd0
add esp, 0xc
xor eax, eax
jmp 0x40880a
mov ebp, 1
lea ecx, [esi + 0xe5d6]
mov dword [esp + 0x10], ebp
lea edi, [esi + 0xe3cc]
mov edx, 0x104
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x408453
movzx eax, word [ecx - 0x20a]
test ax, ax
je 0x408453
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x408432
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov eax, dword [esi + 0xe804]
test eax, eax
jne 0x408483
push str.Remote_process_didnt_specify_a_dump_file_name
push 2
push 0x429048
call fcn.00404d90
add esp, 0xc
jmp 0x408806
push 0
push 0
push 0x104
lea ecx, [esp + 0xa9c]
push ecx
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
add esp, 0x24
test eax, eax
je 0x4084e2
push dword [esi + 0xe804]
push str.Failed_to_get_the_root_dump_file_name_from__ls
push 1
push 0x429048
call fcn.00404d90
push dword [esi + 0xe804]
push str.Failed_to_get_the_root_dump_file_name_from__ls
lea eax, [esi + 0x46]
push 0x104
push eax
call fcn.00401fd0
add esp, 0x20
jmp 0x408806
push 0
push 0
push 0x104
lea eax, [esp + 0x894]
push eax
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
add esp, 0x24
test eax, eax
je 0x40851e
push edi
push str.Failed_to_get_the_root_dump_file_name_from__ls
push 1
push 0x429048
call fcn.00404d90
push edi
jmp 0x4084c7
lea eax, [esp + 0x888]
push eax
lea eax, [esp + 0xa94]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x408554
push str.Dump_file_has_original_name__no_need_to_rename_companion_files
push 2
push 0x429048
call fcn.00404d90
add esp, 0xc
jmp 0x408806
mov eax, dword [esi + 0x2def8]
cmp eax, 1
je 0x408806
cmp eax, 2
je 0x408806
mov ebx, dword [esi + 0xe804]
test ebx, ebx
je 0x408806
push 0
push 0
push 0x101
lea eax, [esp + 0x27c]
push eax
push 0x101
lea eax, [esp + 0x2c]
push eax
push 4
lea eax, [esp + 0x284]
push eax
push ebx
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
add esp, 0x24
lea eax, [esp + 0x270]
push eax
push str._s_
lea eax, [esp + 0x688]
push 0x101
push eax
call fcn.00401fd0
add esp, 0x10
test eax, eax
jns 0x4085ed
push eax
push ebx
push str.Failed_to_generate_wild_card_from_file_name__ls_HRESULT_0x_08x
push 1
push 0x429048
lfence
call fcn.00404d90
add esp, 0x14
jmp 0x408806
xor eax, eax
mov word [esp + 0x26e], ax
mov word [esp + 0x218], ax
mov word [esp + 0x880], ax
lea eax, [esp + 0x680]
push str..cab
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x274]
push eax
lea eax, [esp + 0xca8]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmakepath_s]
add esp, 0x18
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xc9c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x408806
lea eax, [esp + 0x44]
push eax
push str.Found_companion_cab_file_for_the_dump__ls
push 2
push 0x429048
call fcn.00404d90
lea eax, [esp + 0x54]
push eax
push dword [esi + 0xe808]
lea eax, [esp + 0x490]
push 0x4192c8
push 0x104
push eax
call fcn.00401fd0
add esp, 0x24
test eax, eax
js 0x40872b
mov edx, dword [esi + 0xe804]
lea eax, [esp + 0x270]
push eax
push edi
lea ecx, [esp + 0x480]
call fcn.004103a0
cmp eax, 1
jne 0x40871f
lea eax, [esp + 0x270]
push eax
lea eax, [esp + 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4086f2
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x408655
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x408806
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x274]
push eax
lea eax, [esp + 0x480]
push eax
push str.Failed_to_move_companion_file__ls_to__ls._GetLastError:__d
push 1
push 0x429048
call fcn.00404d90
add esp, 0x18
jmp 0x408743
lea eax, [esp + 0x44]
push eax
push str.Failed_to_generate_new_name_for_companion_file__ls
jmp 0x408734
push eax
lfence
push str.Failed_to_generate_full_companion_file_name_0x_08x
push 1
push 0x429048
call fcn.00404d90
add esp, 0x10
xor eax, eax
cmp byte [esi + 0xe193], al
cmovne eax, ebp
mov dword [esp + 0x10], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x408806
push 0
push 0x400
lea eax, [esp + 0xca0]
push eax
push 0x400
push ebx
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x4087a4
lea eax, [esp + 0xc98]
push eax
push ebx
push ebp
push str.Create_dump_file__ls_failed__0x_x____ls
push 1
push 0x429048
call fcn.00404d90
add esp, 0x18
jmp 0x4087ba
push ebx
push ebp
push str.Create_dump_file__ls_failed_Error_Code_0x_x
push 1
push 0x429048
call fcn.00404d90
add esp, 0x14
cmp edi, 5
jne 0x4087d5
push 5
push str.Create_dump_file_failed_after__d_retries
push 1
push 0x429048
call fcn.00404d90
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x40], eax
lea ecx, [esi + 0x46]
lea eax, [esi + 0xe3cc]
push eax
push edi
push str.Create_dump_file_failed_after__d_retries:__ls
push 0x104
push ecx
call fcn.00401fd0
add esp, 0x14
or dword [0x429040], 0x20000002
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x149c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00414600
add esp, 0x1494
ret