Function at 0x433bb0
Capabilities:
Create process memory minidump
Get common file path
Get file size
Read file on windows

Disassembly:
push 0x6a0
mov eax, 0x46d9ec
call fcn.0043b363
mov ebx, edx
mov dword [ebp - 0x690], ebx
mov dword [ebp - 0x698], ecx
push dword [ebx + 0xc]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
lea ecx, [ebp - 0x68c]
call fcn.0042026a
and dword [ebp - 4], 0
lea ecx, [ebp - 0x68c]
call fcn.0041a336
test eax, eax
je 0x433efa
lea eax, [ebp - 0x688]
push eax
push 8
lea eax, [ebp - 0x6a0]
push eax
push dword [ebx + 0x14]
lea ecx, [ebp - 0x68c]
call fcn.0041a336
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push eax
call edi
test eax, eax
je 0x433d1c
cmp dword [ebp - 0x688], 8
jne 0x433d1c
mov esi, 0x2cc
push esi
call fcn.0043ae82
pop ecx
lea ecx, [ebp - 0x688]
mov dword [ebp - 0x694], eax
push ecx
push esi
push eax
push dword [ebp - 0x69c]
lea ecx, [ebp - 0x68c]
call fcn.0041a336
push eax
call edi
test eax, eax
je 0x433d1c
cmp dword [ebp - 0x688], esi
jne 0x433d1c
push 0x50
call fcn.0043ae82
pop ecx
mov esi, eax
lea ecx, [ebp - 0x68c]
lea eax, [ebp - 0x688]
push eax
push 0x50
push esi
push dword [ebp - 0x6a0]
call fcn.0041a336
push eax
call edi
test eax, eax
je 0x433d1c
cmp dword [ebp - 0x688], 0x50
jne 0x433d1c
cmp dword [esi + 8], 0
je 0x433d03
mov ebx, esi
push 0x50
call fcn.0043ae82
pop ecx
mov edi, eax
lea ecx, [ebp - 0x68c]
lea eax, [ebp - 0x688]
push eax
push 0x50
push edi
push dword [ebx + 8]
call fcn.0041a336
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x433cfd
cmp dword [ebp - 0x688], 0x50
jne 0x433cfd
mov dword [ebx + 8], edi
mov ebx, edi
cmp dword [edi + 8], 0
jne 0x433cbc
mov ebx, dword [ebp - 0x690]
push 8
call fcn.0043ae82
mov dword [ebx + 0x18], eax
pop ecx
mov ecx, dword [ebp - 0x694]
mov dword [eax], esi
mov eax, dword [ebx + 0x18]
mov dword [eax + 4], ecx
mov eax, dword [ebx + 0x10]
and dword [ebp - 0x6a4], 0
mov dword [ebp - 0x6ac], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x6a8], eax
lea eax, [ebp - 0x258]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
and dword [ebp - 0x684], 0
lea eax, [ebp - 0x678]
mov dword [ebp - 0x680], 0x200
mov dword [ebp - 0x67c], eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [ebp - 0x258]
mov edi, eax
lea ecx, [ebp - 0x684]
call fcn.0040b793
mov edx, str._se_crashdump_
mov ecx, eax
call fcn.0040b793
push 0xa
mov esi, eax
lea eax, [ebp - 0x50]
push 0x20
push eax
push edi
call fcn.00442e0c
add esp, 0x10
lea edx, [ebp - 0x50]
mov ecx, esi
call fcn.0040b793
push 0x5f
pop edx
mov ecx, eax
call fcn.0040c6e2
mov edx, str..dmp
mov ecx, eax
call fcn.0040b793
mov eax, dword [ebp - 0x684]
xor edx, edx
mov ecx, dword [ebp - 0x67c]
mov word [ecx + eax*2], dx
xor eax, eax
push eax
push 0x4000180
push 2
push eax
push eax
push 0xc0000000
push dword [ebp - 0x67c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x433ee0
lea ecx, [ebp - 0x278]
mov edi, 0x140
call fcn.00424d09
lea edx, [ebp - 0x278]
call fcn.0040d059
test al, al
je 0x433e5f
and dword [ebp - 0x260], 0
xor eax, eax
mov dword [ebp - 0x268], 6
mov dword [ebp - 0x264], 1
mov dword [ebp - 0x25c], 0x1db0
mov ecx, dword [ebp + eax - 0x268]
cmp dword [ebp + eax - 0x278], ecx
ja 0x433e5a
jb 0x433e5f
add eax, 4
cmp eax, 0x10
jl 0x433e40
mov edi, 0x940
xor ecx, ecx
lea eax, [ebp - 0x6ac]
cmp dword [ebx + 0x18], ecx
push 0
push 0
cmove eax, ecx
lea ecx, [ebp - 0x68c]
push eax
push edi
push esi
push dword [ebx + 0xc]
call fcn.0041a336
push eax
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call fcn.0043b0ea
pop ecx
mov ebx, eax
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x688]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x688], edi
jne 0x433ed9
push ecx
mov ecx, dword [ebp - 0x698]
mov edx, str.crash.dmp
push edi
push ebx
call fcn.00435ef5
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x678]
cmp dword [ebp - 0x67c], eax
je 0x433efa
push dword [ebp - 0x67c]
call fcn.00440047
pop ecx
lea ecx, [ebp - 0x68c]
call fcn.0042024f
call fcn.0043b30d
ret