Function at 0x45278e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x522589
call fcn.0051f0b4
sub esp, 0x30
push ebx
push esi
push edi
push str.CDbgHelper::CDbgHelper
mov dword [0x577710], 0x5440cc
call fcn.004884a1
pop ecx
mov edi, 0x208
push edi
xor esi, esi
push esi
mov ebx, 0x577714
push ebx
call fcn.004ee670
add esp, 0xc
push edi
push esi
mov edi, 0x577b24
push edi
call fcn.004ee670
add esp, 0xc
push 0x104
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x56f16c
lea ecx, [ebp - 0x18]
call fcn.00402946
mov dword [ebp - 4], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
push ecx
mov byte [ebp - 4], 1
mov eax, esp
mov dword [ebp - 0x20], esp
push ecx
mov dword [eax], 1
mov eax, esp
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x20], esp
mov dword [eax], 0x10
call fcn.00401f5e
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push 0x53f8bc
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x452869
mov eax, dword [ebp - 0x1c]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
lea eax, [ebp - 0x18]
push str._d._d._d._d
push eax
call fcn.004142e8
add esp, 0x18
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x543c50
push ebx
call esi
push 0x56f16c
lea ecx, [ebp - 0x14]
call fcn.00402946
lea eax, [ebp - 0x14]
push str.iApple_dump_Full.dmp
push eax
mov byte [ebp - 4], 2
call fcn.004142e8
pop ecx
pop ecx
call fcn.004115ec
push edi
mov edx, eax
mov ecx, 0x103
call fcn.00411555
push str.dump_
push edi
call esi
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.00452f93
push dword [eax]
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0040297c
push dword [ebp - 0x14]
push edi
call esi
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edi, 0x57791c
push edi
mov edx, ebx
mov ecx, 0x104
call fcn.00411555
movzx eax, word [ebp - 0x30]
push eax
movzx eax, word [ebp - 0x32]
push eax
movzx eax, word [ebp - 0x34]
push eax
movzx eax, word [ebp - 0x36]
push eax
movzx eax, word [ebp - 0x3a]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push str.iApple_dump__s__02d_02d_02d_02d_02d.dmp
push eax
call fcn.004142e8
add esp, 0x20
push dword [ebp - 0x14]
push ebx
call esi
movzx eax, word [ebp - 0x30]
push eax
movzx eax, word [ebp - 0x32]
push eax
movzx eax, word [ebp - 0x34]
push eax
movzx eax, word [ebp - 0x36]
push eax
movzx eax, word [ebp - 0x3a]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push str.iApple_child_dump__s__02d_02d_02d_02d_02d.dmp
push eax
call fcn.004142e8
mov ebx, dword [ebp - 0x14]
add esp, 0x20
push ebx
push edi
call esi
xor esi, esi
push 0x543d3c
mov dword [0x578734], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x578738], eax
mov dword [0x571264], esi
cmp eax, esi
je 0x45298b
push str.MiniDumpWriteDump
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x571264], eax
push 0x577d2c
mov edx, 0x543c08
mov ecx, 0x104
call fcn.00411555
push 0x577f34
mov edx, 0x543be8
mov ecx, 0x400
call fcn.00411555
lea ecx, [ebx - 0x10]
call fcn.0040297c
cmp dword [ebp - 0x2c], esi
je 0x4529c9
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040297c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 0x577710
mov dword fs:[0], ecx
pop ebx
leave
ret