Function at 0x421be0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa7f8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4e0240]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx + 0x74]
mov ebx, dword [eax]
mov dword [ebp - 0x14], ebx
cmp ebx, eax
je 0x421d48
lea edi, [ecx + 0x60]
mov edi, edi
mov eax, dword [edi + 4]
lea esi, [ebx + 0x10]
cmp esi, eax
jae 0x421c94
mov edx, dword [edi]
cmp edx, esi
ja 0x421c94
mov ecx, dword [edi + 8]
sub esi, edx
sar esi, 2
mov dword [ebp - 0x1c], esi
cmp eax, ecx
jne 0x421c7c
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x421e38
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x421c7c
mov edx, ecx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x421c6c
xor ecx, ecx
jmp 0x421c6e
add ecx, edx
cmp ecx, eax
jae 0x421c74
mov ecx, eax
push ecx
mov ecx, edi
call fcn.0040dc40
mov eax, dword [edi]
mov ecx, dword [ebp - 0x1c]
lea edx, [eax + ecx*4]
mov eax, dword [edi + 4]
push edx
push eax
lea ecx, [edi + 0xc]
push ecx
call fcn.0040cfc0
jmp 0x421ceb
mov ecx, dword [edi + 8]
cmp eax, ecx
jne 0x421cdd
mov edx, dword [edi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x421e38
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x421cdd
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x421cca
xor ecx, ecx
jmp 0x421ccc
add ecx, edx
cmp ecx, eax
jae 0x421cd2
mov ecx, eax
push ecx
mov ecx, edi
call fcn.0040dc40
mov ebx, dword [ebp - 0x14]
mov edx, dword [edi + 4]
push esi
push edx
lea eax, [edi + 0xc]
push eax
call fcn.0040d0e0
add dword [edi + 4], 4
add esp, 0xc
cmp byte [ebx + 0x15], 0
jne 0x421d3c
mov ecx, dword [ebx + 8]
cmp byte [ecx + 0x15], 0
jne 0x421d1e
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
jne 0x421d1a
lea esp, [esp]
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
je 0x421d10
mov ebx, ecx
jmp 0x421d39
mov eax, dword [ebx + 4]
cmp byte [eax + 0x15], 0
jne 0x421d37
cmp ebx, dword [eax + 8]
jne 0x421d37
mov ebx, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x421d27
mov ebx, eax
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x10]
cmp ebx, dword [ecx + 0x74]
jne 0x421c20
mov edx, dword [ecx + 0x74]
mov ebx, dword [edx + 4]
cmp byte [ebx + 0x15], 0
lea edi, [ecx + 0x70]
mov esi, ebx
jne 0x421d8e
lea esp, [esp]
mov eax, dword [esi + 8]
push eax
mov ecx, edi
call fcn.0042cf90
mov esi, dword [esi]
lea ecx, [ebx + 0xc]
push ecx
lea eax, [edi + 0xd]
push eax
call fcn.00420fe0
push ebx
call fcn.0046d5e2
add esp, 0xc
cmp byte [esi + 0x15], 0
mov ebx, esi
je 0x421d60
mov ecx, dword [ebp - 0x10]
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
xor esi, esi
mov dword [edi + 8], esi
mov edx, dword [ecx + 0x64]
sub edx, dword [ecx + 0x60]
test edx, 0xfffffffc
je 0x422080
mov eax, dword [0x4e0004]
mov edx, dword [eax + 0xc]
mov ecx, 0x4e0004
call edx
lea edi, [eax + 0x10]
mov dword [ebp - 0x1c], edi
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x64]
sub eax, dword [ebx + 0x60]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
test eax, 0xfffffffc
jle 0x421f4e
mov edx, dword [0x4e0004]
mov eax, dword [edx + 0xc]
mov ecx, 0x4e0004
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [ebx + 0x60]
mov edx, dword [ebp - 0x18]
mov esi, dword [ecx + edx*4]
lea eax, [ecx + edx*4]
push ecx
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x10], esp
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], esp
call edx
cmp dword [esi - 4], 0
lea edx, [esi - 4]
jl 0x421e42
cmp eax, dword [esi - 0x10]
jne 0x421e42
lea edi, [esi - 0x10]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x421e7a
push str.vector_T__too_long
call fcn.0046caf8
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x422003
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.0046df79
add esp, 0x10
mov ecx, dword [ebp - 0x10]
add edi, 0x10
lea edx, [ebp - 0x14]
mov dword [ecx], edi
push edx
mov ecx, ebx
call fcn.00420ed0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x24]
push str.dump:
push ecx
call fcn.004033d0
push 0x4b7b50
push eax
lea edx, [ebp - 0x20]
push edx
mov byte [ebp - 4], 2
call fcn.0040336c
add esp, 0x18
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.0040d020
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421eeb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421f0e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421f31
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebx + 0x64]
sub ecx, dword [ebx + 0x60]
mov eax, dword [ebp - 0x18]
inc eax
sar ecx, 2
mov dword [ebp - 0x18], eax
cmp eax, ecx
jl 0x421de5
mov edi, dword [ebp - 0x1c]
xor esi, esi
lea edx, [ebp - 0x20]
push edx
call fcn.0041c3c0
push str.currentDump.desc
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 4
call fcn.0040336c
mov eax, dword [eax]
add esp, 0x10
push esi
push 0x80
push 4
push esi
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421fa7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421fca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, 0xffffffff
jne 0x422008
add edi, 0xfffffff0
mov dword [ebp - 4], esi
lea ecx, [edi + 0xc]
or edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422080
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0040128b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x422038
push 0
push 0
push 0
push esi
call ebx
push 0
lea eax, [ebp - 0x28]
push eax
push 2
push 0x4b7b58
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 2
push 0
push 0
push esi
call ebx
mov eax, dword [edi - 0xc]
push 0
lea ecx, [ebp - 0x28]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422080
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret