Function at 0x42d157
Capabilities:
Create process memory minidump
Get common file path
Get file size
Read file on windows

Disassembly:
push 0x670
mov eax, 0x474558
call fcn.0044b825
mov eax, dword [ebp + 8]
mov edi, ecx
push dword [edi + 0xc]
xor esi, esi
push esi
push 0x1f0fff
mov dword [ebp - 0x660], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x658], eax
mov dword [ebp - 4], esi
cmp eax, esi
je 0x42d4d3
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x654]
push ecx
push 8
lea ecx, [ebp - 0x670]
push ecx
push dword [edi + 0x14]
push eax
call ebx
test eax, eax
je 0x42d2b6
cmp dword [ebp - 0x654], 8
jne 0x42d2b6
push 0x2cc
call fcn.0044b273
pop ecx
lea ecx, [ebp - 0x654]
push ecx
push 0x2cc
push eax
push dword [ebp - 0x66c]
mov dword [ebp - 0x668], eax
push dword [ebp - 0x658]
call ebx
test eax, eax
je 0x42d2b6
cmp dword [ebp - 0x654], 0x2cc
jne 0x42d2b6
push 0x50
call fcn.0044b273
pop ecx
lea ecx, [ebp - 0x654]
push ecx
push 0x50
push eax
push dword [ebp - 0x670]
mov dword [ebp - 0x65c], eax
push dword [ebp - 0x658]
call ebx
test eax, eax
je 0x42d2b6
cmp dword [ebp - 0x654], 0x50
jne 0x42d2b6
mov eax, dword [ebp - 0x65c]
jmp 0x42d28c
push 0x50
call fcn.0044b273
pop ecx
lea ecx, [ebp - 0x654]
push ecx
push 0x50
push eax
mov dword [ebp - 0x664], eax
mov eax, dword [ebp - 0x650]
push dword [eax + 8]
push dword [ebp - 0x658]
call ebx
test eax, eax
je 0x42d297
cmp dword [ebp - 0x654], 0x50
jne 0x42d297
mov eax, dword [ebp - 0x664]
mov ecx, dword [ebp - 0x650]
mov dword [ecx + 8], eax
mov dword [ebp - 0x650], eax
cmp dword [eax + 8], esi
jne 0x42d247
push 8
call fcn.0044b273
pop ecx
mov ecx, dword [ebp - 0x65c]
mov dword [edi + 0x18], eax
mov dword [eax], ecx
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0x668]
mov dword [eax + 4], ecx
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x67c], eax
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x678], eax
lea eax, [ebp - 0x21c]
push eax
push 0x104
mov dword [ebp - 0x674], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x640]
mov dword [ebp - 0x64c], esi
mov dword [ebp - 0x648], 0x200
mov dword [ebp - 0x644], eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x493b40
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x64c]
push eax
call fcn.004031a5
pop ecx
pop ecx
push eax
call fcn.004031a5
pop ecx
pop ecx
push eax
call fcn.0042d119
pop ecx
pop ecx
push 0x493cc8
push 0x5f
push eax
call fcn.0040630a
pop ecx
pop ecx
push eax
call fcn.004031a5
mov edx, dword [ebp - 0x64c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x644]
push esi
push 0x4000180
push 2
push esi
push esi
xor eax, eax
push 0xc0000000
mov word [ecx + edx*2], ax
push dword [ebp - 0x644]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x650], eax
cmp eax, 0xffffffff
jne 0x42d3ab
lea eax, [ebp - 0x640]
cmp dword [ebp - 0x644], eax
je 0x42d39a
push dword [ebp - 0x644]
call fcn.0044c187
pop ecx
push dword [ebp - 0x658]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42d4d3
lea ebx, [ebp - 0x22c]
mov dword [ebp - 0x65c], 0x140
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x22c], esi
call fcn.00401cc9
test al, al
je 0x42d41b
lea ecx, [ebp - 0x23c]
mov eax, ebx
mov dword [ebp - 0x23c], 6
mov dword [ebp - 0x238], 1
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], 0x1db0
call fcn.0042d4f2
test al, al
je 0x42d41b
mov dword [ebp - 0x65c], 0x940
mov eax, dword [edi + 0x18]
push esi
neg eax
push esi
sbb eax, eax
lea ecx, [ebp - 0x67c]
and eax, ecx
push eax
push dword [ebp - 0x65c]
push dword [ebp - 0x650]
push dword [edi + 0xc]
push dword [ebp - 0x658]
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
push esi
push dword [ebp - 0x650]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call fcn.0044a56c
pop ecx
push esi
push esi
push esi
push dword [ebp - 0x650]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 0x654]
push eax
push edi
push ebx
push dword [ebp - 0x650]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x654], edi
jne 0x42d4a3
push edi
mov edi, dword [ebp - 0x660]
mov edx, ebx
xor ecx, ecx
mov ebx, 0x493cd4
call fcn.00430a89
pop ecx
push dword [ebp - 0x650]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea eax, [ebp - 0x640]
cmp dword [ebp - 0x644], eax
je 0x42d4cb
push dword [ebp - 0x644]
call fcn.0044c187
pop ecx
push dword [ebp - 0x658]
call esi
call fcn.0044b8a8
ret