Function at 0x47fa50
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi + 0x1ac0], ebx
mov eax, dword [esi + 0x1ba0]
push edi
cmp eax, ebx
je 0x47fa7c
push eax
call fcn.0044c4f0
add esp, 4
mov dword [esi + 0x1ba0], ebx
xor eax, eax
mov dword [esi + 0x1b9c], eax
mov dword [esi + 0x1ba0], eax
mov dword [esi + 0x1ba4], eax
mov dword [esi + 0x1ba8], eax
mov dword [esi + 0x1bac], eax
mov dword [esi + 0x1bb0], eax
mov dword [esi + 0x1bb4], eax
mov dword [esi + 0x1bb8], eax
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x47ff4c
cmp word [eax], bx
je 0x47ff4c
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, ebx
je 0x47ff27
cmp edi, 0xffffffff
je 0x47ff27
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x47ff1b
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x47ff1b
cmp dword [ebp - 8], ebx
jne 0x47ff1b
push eax
call fcn.0044c4d0
add esp, 4
mov dword [esi + 0x1ba0], eax
cmp eax, ebx
je 0x47ff38
mov ecx, dword [ebp - 0xc]
push ebx
lea edx, [ebp - 8]
push edx
push ecx
push eax
push edi
mov dword [esi + 0x1b9c], ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47ff10
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x47ff10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x1ba0]
push 0xd
push eax
call fcn.004c9bca
add esp, 8
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x47fb87
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push str.Dump_file_invalid_format__title_
call fcn.004263e0
add esp, 0x14
jmp 0x47ff4c
xor ecx, ecx
mov word [eax], cx
mov edi, dword [ebp - 4]
push 6
add edi, 4
push str.Size:
push edi
call fcn.004ca915
add esp, 0xc
test eax, eax
je 0x47fbbd
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push str.Dump_file_invalid_format__Size_start_
call fcn.004263e0
add esp, 0x14
jmp 0x47ff4c
push 0xd
push edi
call fcn.004c9bca
add esp, 8
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x47fbe6
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push str.Dump_file_invalid_format__Size_line_end_
call fcn.004263e0
add esp, 0x14
jmp 0x47ff4c
push 0xa
lea edx, [ebp - 4]
push edx
add eax, 4
add edi, 0xc
push edi
mov dword [esi + 0x1bb4], eax
call fcn.004c9eb4
mov word [esi + 0x1ba8], ax
mov eax, dword [ebp - 4]
add esp, 0xc
cmp eax, ebx
je 0x47fefc
cmp word [eax], 0x78
jne 0x47fefc
push 0xa
lea ecx, [ebp - 4]
add eax, 2
push ecx
push eax
call fcn.004c9eb4
mov edi, dword [ebp - 4]
add esp, 0xc
mov word [esi + 0x1baa], ax
cmp edi, ebx
je 0x47fee8
movzx ecx, word [edi]
cmp cx, 0x20
je 0x47fc54
cmp cx, 0xd
jne 0x47fee8
xor edx, edx
dec eax
mov word [esi + 0x1bac], dx
mov word [esi + 0x1bae], ax
cmp word [edi], 0x20
jne 0x47fce1
jmp 0x47fc70
add edi, 2
cmp word [edi], 0x20
je 0x47fc70
push 8
push str.Cursor:
push edi
call fcn.004ca915
add esp, 0xc
test eax, eax
jne 0x47fce1
push 0xa
lea eax, [ebp - 4]
push eax
add edi, 0x10
push edi
call fcn.004c9eb4
mov di, ax
mov eax, dword [ebp - 4]
add esp, 0xc
cmp eax, ebx
je 0x47fd3e
cmp word [eax], 0x78
jne 0x47fd3e
push 0xa
lea ecx, [ebp - 4]
add eax, 2
push ecx
push eax
call fcn.004c9eb4
add esp, 0xc
cmp di, bx
jl 0x47fce1
cmp ax, bx
jl 0x47fce1
mov word [esi + 0x1bac], di
mov word [esi + 0x1bae], ax
movsx edi, word [esi + 0x1ba8]
movsx edx, word [esi + 0x1baa]
mov eax, dword [esi + 0x1bb4]
imul edi, edx
lea ecx, [edi + edi*2]
add ecx, ecx
add ecx, ecx
add ecx, ecx
sub ecx, dword [esi + 0x1ba0]
lea eax, [eax + edi*2]
add ecx, eax
mov dword [esi + 0x1bb8], eax
xor eax, eax
cmp ecx, dword [esi + 0x1b9c]
setle al
mov dword [esi + 0x1bb0], eax
cmp eax, ebx
jne 0x47fd55
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push str.Dump_file_invalid_format__Block1_
call fcn.004263e0
add esp, 0x14
jmp 0x47ff4c
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push str.Dump_file_invalid_format__Cursor_
call fcn.004263e0
add esp, 0x14
jmp 0x47ff4c
mov ecx, dword [esi + 0x50]
mov dword [esi], 5
call fcn.00488460
mov ecx, dword [esi + 0x50]
mov ebx, eax
call fcn.00488440
xor ecx, ecx
mov dword [esi + 0x1ac0], ecx
mov dword [esi + 0x1ac4], ecx
mov dword [esi + 0x1ac8], ecx
mov dword [esi + 0x1acc], ecx
mov dword [esi + 0x1ae8], 0xf
mov edx, 1
mov dword [esi + 0x1aec], edx
mov dword [esi + 0x1afc], ecx
mov dword [esi + 0x1b00], ecx
mov dword [esi + 0x1b04], ecx
mov dword [esi + 0x1b08], ecx
mov dword [esi + 0x1b0c], ecx
mov word [esi + 0x1b10], cx
mov ecx, 0x362
mov dword [esi + 0x1af4], ecx
mov dword [esi + 0x1af0], ecx
mov ecx, dword [esi + 0x1ba8]
mov dword [esi + 0x1afc], ecx
mov ecx, dword [esi + 0x1bac]
mov dword [esi + 0x1b00], ecx
mov ecx, 7
mov word [esi + 0x1b04], cx
xor ecx, ecx
mov word [esi + 0x1b06], cx
mov word [esi + 0x1b08], cx
lea ecx, [ebx - 1]
mov word [esi + 0x1b0a], cx
lea ecx, [eax - 1]
mov word [esi + 0x1b0c], cx
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x1af8], 0
mov ecx, dword [ecx + 0x41e4]
mov ecx, dword [ecx + 0x1b12]
mov dword [esi + 0x1b12], ecx
mov dword [esi + 0x1b0e], ecx
xor ecx, ecx
push ecx
mov dword [esi + 0x1b48], eax
movsx eax, word [esi + 0x1baa]
push ecx
mov word [esi + 0x1b16], cx
push ecx
mov ecx, esi
mov dword [esi + 0x1b44], ebx
mov dword [esi + 0x1b4c], eax
mov dword [esi + 0x1b5c], edx
call fcn.0047d500
test eax, eax
je 0x47ff4a
mov edx, dword [esi + 0x1bb4]
mov eax, dword [esi + 0x1b38]
mov ecx, dword [esi + 0x1bb8]
mov ebx, dword [esi + 0x1b3c]
push edi
push edx
push eax
mov dword [ebp + 8], ecx
call fcn.004087d0
add esp, 0xc
test edi, edi
jbe 0x47fed3
mov eax, dword [ebp + 8]
add eax, 8
lea esp, [esp]
mov ecx, dword [eax]
mov dx, word [eax]
shr ecx, 8
and ecx, 0xf
shl ecx, 4
and dx, 0xf
or cx, dx
mov word [ebx], cx
add eax, 0x18
add ebx, 2
sub edi, 1
jne 0x47feb0
pop edi
mov dword [esi + 0x1b78], 1
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push str.Dump_file_invalid_format__Size.Y_
call fcn.004263e0
add esp, 0x14
jmp 0x47ff4c
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push str.Dump_file_invalid_format__Size.X_
call fcn.004263e0
add esp, 0x14
jmp 0x47ff4c
push ebx
push ebx
push ebx
push ebx
push str.Dump_file_reading_failed
jmp 0x47ff30
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push str.Invalid_dump_file_size
jmp 0x47ff30
push ebx
push ebx
push ebx
push ebx
push str.Cant_open_dump_file_for_reading
call fcn.004263e0
add esp, 0x14
cmp edi, ebx
je 0x47ff4c
cmp edi, 0xffffffff
je 0x47ff4c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x47ff4c
xor ebx, ebx
mov eax, dword [esi + 0x1ba0]
cmp eax, ebx
je 0x47ff65
push eax
call fcn.0044c4f0
add esp, 4
mov dword [esi + 0x1ba0], ebx
xor eax, eax
mov dword [esi + 0x1b9c], eax
mov dword [esi + 0x1ba0], eax
mov dword [esi + 0x1ba4], eax
mov dword [esi + 0x1ba8], eax
mov dword [esi + 0x1bac], eax
mov dword [esi + 0x1bb0], eax
mov dword [esi + 0x1bb4], eax
pop edi
mov dword [esi + 0x1bb8], eax
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4