--join argument only works with --module argument

[ricardojrdez]

The optional --join argument works smoothly with the --module argument to extract a module from a given process PID. Unfortunately, the main module (from the process image file) cannot be extracted into a single file as in the case of modules. It would be great if we could run the tool as

.\WindowsMemoryExtractor_x64.exe --pid 1234 --join

And get a single file with the entire memory dump of the main module. I think GetProcessImageFileName can do the job, after getting the process handle by means of OpenProcess.