Function at 0x473528
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 1
push esi
sub esp, 0x30
xor esi, esi
mov dword [esp + 4], edi
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea edi, [ebp - 0x28]
mov dword [esp], str.Memory_dump:_n
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 0xd
mov dword [esp + 8], eax
call sub.msvcrt.dll_fwrite
mov eax, 0x1c
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
cmp eax, 0x1c
jne 0x47370f
mov eax, dword [ebp - 0x18]
cmp eax, 0x2000
je 0x473923
ja 0x473740
cmp eax, 0x1000
je 0x47396a
mov dword [esp], 0x3f
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
call fcn.004f07b8
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov edx, eax
mov dword [esp + 8], eax
mov eax, str._0x_x___0x_x
add edx, ecx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
dec edx
mov dword [esp + 0xc], edx
add eax, 0x40
mov dword [esp], eax
call fcn.00471dd0
cmp dword [ebp - 0x18], 0x10000
je 0x4736ce
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], eax
mov eax, str.__0x_x_
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00471dd0
mov eax, dword [ebp - 0x14]
and eax, 0xfffffcff
cmp eax, 8
je 0x47393b
ja 0x473798
cmp eax, 2
je 0x4739db
ja 0x4738aa
dec eax
je 0x473a0a
lea esi, [esi]
mov dword [esp], 0x3f
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
call fcn.004f07b8
mov eax, dword [ebp - 0x14]
test ah, 1
jne 0x4737ec
test ah, 2
jne 0x473830
mov dword [esp], 0x20
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
call fcn.004f07b8
mov eax, dword [ebp - 0x10]
cmp eax, 0x40000
je 0x473880
ja 0x473763
cmp eax, 0x20000
je 0x473982
mov dword [esp], str.MEM__
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 5
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 0xa
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
call fcn.004f07b8
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x1c]
add esi, eax
mov eax, 0x1c
mov dword [esp + 8], eax
mov dword [esp], esi
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
cmp eax, 0x1c
je 0x473580
mov dword [esp], str.End_of_memory_dump._n
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov ecx, 0x14
mov dword [esp + 8], ecx
mov edx, 1
mov dword [esp + 4], edx
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
cmp eax, 0x10000
jne 0x47359f
mov dword [esp], 0x2d
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
jmp 0x4735b2
cmp eax, 0x1000000
jne 0x4736a4
mov dword [esp], str.MEM_IMAGE
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov esi, 1
mov dword [esp + 4], esi
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 9
mov dword [esp + 8], eax
jmp 0x4736c9
cmp eax, 0x20
je 0x4739ac
ja 0x4738e2
cmp eax, 0x10
jne 0x473640
mov dword [esp], 0x566d02
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 4
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
lea esi, [esi]
mov eax, dword [ebp - 0x14]
test ah, 1
je 0x473664
mov dword [esp], str._PAGE_GUARD
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 0xb
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0x14]
test ah, 2
je 0x47366d
lea esi, [esi]
lea edi, [edi]
mov dword [esp], str._PAGE_NOCACHE
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 0xd
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 0x20
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
call fcn.004f07b8
mov eax, dword [ebp - 0x10]
cmp eax, 0x40000
jne 0x473693
mov dword [esp], str.MEM_MAPPED
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov ecx, 0xa
mov dword [esp + 8], ecx
mov edx, 1
mov dword [esp + 4], edx
add eax, 0x40
mov dword [esp + 0xc], eax
jmp 0x4736c9
cmp eax, 4
jne 0x473640
mov dword [esp], str._RW
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov esi, 1
mov dword [esp + 4], esi
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 4
mov dword [esp + 8], eax
call sub.msvcrt.dll_fwrite
jmp 0x4737e0
cmp eax, 0x40
je 0x473a39
add eax, 0xffffff80
jne 0x473640
mov dword [esp], str.XRWC
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov esi, 4
mov dword [esp + 8], esi
mov ecx, 1
mov dword [esp + 4], ecx
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x4737e0
mov dword [esp], 0x2b
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
jmp 0x4735b2
mov dword [esp], str._RWC
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov ecx, 4
mov dword [esp + 8], ecx
mov edx, 1
mov dword [esp + 4], edx
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x4737e0
mov dword [esp], 0x2a
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
jmp 0x4735b2
mov dword [esp], str.MEM_PRIVATE
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 0xb
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
jmp 0x4736c9
mov dword [esp], str.XR
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 4
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
jmp 0x4737e0
mov dword [esp], 0x566d4c
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 4
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
jmp 0x4737e0
mov dword [esp], 0x566d51
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov edx, 4
mov dword [esp + 8], edx
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
jmp 0x4737e0
mov dword [esp], str.XRW
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 4
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
jmp 0x4737e0