Function at 0x42da13
Capabilities:
Create process memory minidump
Get common file path
Get file size
Read file on windows

Disassembly:
push 0x670
mov eax, 0x475d55
call fcn.0044cfd2
mov eax, dword [ebp + 8]
mov edi, ecx
push dword [edi + 0xc]
xor esi, esi
push esi
push 0x1f0fff
mov dword [ebp - 0x660], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x658], eax
mov dword [ebp - 4], esi
cmp eax, esi
je 0x42dd8f
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x654]
push ecx
push 8
lea ecx, [ebp - 0x670]
push ecx
push dword [edi + 0x14]
push eax
call ebx
test eax, eax
je 0x42db72
cmp dword [ebp - 0x654], 8
jne 0x42db72
push 0x2cc
call fcn.0044ca20
pop ecx
lea ecx, [ebp - 0x654]
push ecx
push 0x2cc
push eax
push dword [ebp - 0x66c]
mov dword [ebp - 0x668], eax
push dword [ebp - 0x658]
call ebx
test eax, eax
je 0x42db72
cmp dword [ebp - 0x654], 0x2cc
jne 0x42db72
push 0x50
call fcn.0044ca20
pop ecx
lea ecx, [ebp - 0x654]
push ecx
push 0x50
push eax
push dword [ebp - 0x670]
mov dword [ebp - 0x65c], eax
push dword [ebp - 0x658]
call ebx
test eax, eax
je 0x42db72
cmp dword [ebp - 0x654], 0x50
jne 0x42db72
mov eax, dword [ebp - 0x65c]
jmp 0x42db48
push 0x50
call fcn.0044ca20
pop ecx
lea ecx, [ebp - 0x654]
push ecx
push 0x50
push eax
mov dword [ebp - 0x664], eax
mov eax, dword [ebp - 0x650]
push dword [eax + 8]
push dword [ebp - 0x658]
call ebx
test eax, eax
je 0x42db53
cmp dword [ebp - 0x654], 0x50
jne 0x42db53
mov eax, dword [ebp - 0x664]
mov ecx, dword [ebp - 0x650]
mov dword [ecx + 8], eax
mov dword [ebp - 0x650], eax
cmp dword [eax + 8], esi
jne 0x42db03
push 8
call fcn.0044ca20
pop ecx
mov ecx, dword [ebp - 0x65c]
mov dword [edi + 0x18], eax
mov dword [eax], ecx
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0x668]
mov dword [eax + 4], ecx
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x67c], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x678], eax
lea eax, [ebp - 0x21c]
push eax
push 0x104
mov dword [ebp - 0x674], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x640]
mov dword [ebp - 0x64c], esi
mov dword [ebp - 0x648], 0x200
mov dword [ebp - 0x644], eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x495c8c
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x64c]
push eax
call fcn.004031be
pop ecx
pop ecx
push eax
call fcn.004031be
pop ecx
pop ecx
push eax
call fcn.0042d9d5
pop ecx
pop ecx
push str..dmp
push 0x5f
push eax
call fcn.00406324
pop ecx
pop ecx
push eax
call fcn.004031be
mov edx, dword [ebp - 0x64c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x644]
push esi
push 0x4000180
push 2
push esi
push esi
xor eax, eax
push 0xc0000000
mov word [ecx + edx*2], ax
push dword [ebp - 0x644]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x650], eax
cmp eax, 0xffffffff
jne 0x42dc67
lea eax, [ebp - 0x640]
cmp dword [ebp - 0x644], eax
je 0x42dc56
push dword [ebp - 0x644]
call fcn.0044d937
pop ecx
push dword [ebp - 0x658]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42dd8f
lea ebx, [ebp - 0x22c]
mov dword [ebp - 0x65c], 0x140
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x22c], esi
call fcn.00401cdb
test al, al
je 0x42dcd7
lea ecx, [ebp - 0x23c]
mov eax, ebx
mov dword [ebp - 0x23c], 6
mov dword [ebp - 0x238], 1
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], 0x1db0
call fcn.0042ddae
test al, al
je 0x42dcd7
mov dword [ebp - 0x65c], 0x940
mov eax, dword [edi + 0x18]
push esi
neg eax
push esi
sbb eax, eax
lea ecx, [ebp - 0x67c]
and eax, ecx
push eax
push dword [ebp - 0x65c]
push dword [ebp - 0x650]
push dword [edi + 0xc]
push dword [ebp - 0x658]
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
push esi
push dword [ebp - 0x650]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call fcn.0044bd14
pop ecx
push esi
push esi
push esi
push dword [ebp - 0x650]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 0x654]
push eax
push edi
push ebx
push dword [ebp - 0x650]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x654], edi
jne 0x42dd5f
push edi
mov edi, dword [ebp - 0x660]
mov edx, ebx
xor ecx, ecx
mov ebx, str.crash.dmp
call fcn.004313a8
pop ecx
push dword [ebp - 0x650]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea eax, [ebp - 0x640]
cmp dword [ebp - 0x644], eax
je 0x42dd87
push dword [ebp - 0x644]
call fcn.0044d937
pop ecx
push dword [ebp - 0x658]
call esi
call fcn.0044d055
ret