Function at 0x420d95
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2160
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov edi, str.RecoverBatPasswordFromFile
push edi
push str._n_n_s_:_Entered___s_
call fcn.00449974
add esp, 0xc
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x420dff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push edi
push str._n_s_:_Failed_to_open__s__Error0x_.8x
call fcn.00449974
add esp, 0x10
xor eax, eax
jmp 0x421510
xor eax, eax
push eax
push eax
push eax
push 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
mov dword [ebp - 0x2158], edi
test edi, edi
jne 0x420e3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.RecoverBatPasswordFromFile
push str._s_:_Failed_to_create_flle_mapping_for__s___Error0x_.8x
call fcn.00449974
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x420df8
xor eax, eax
push eax
push eax
push eax
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x2150], esi
test esi, esi
jne 0x420e81
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RecoverBatPasswordFromFile
push str._s_:_Failed_to_map_view_of_flle__Error0x_.8x
call fcn.00449974
add esp, 0xc
push edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
jmp 0x420df8
push esi
push str.RecoverBatPasswordFromFile
push str._n_s_:_File_is_successfully_mapped_at_address__0x_.8x
call fcn.00449974
and dword [ebp - 0x215c], 0
lea eax, [ebp - 0x215c]
add esp, 0xc
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 0x215c], 0
mov edi, eax
je 0x420ed4
push str.RecoverBatPasswordFromFile
push str._n_s_:_Critical_Situation___File_Size_is_higher_than_we_have_expected
call fcn.00449974
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x2158]
jmp 0x420e71
push edi
push edi
push str.RecoverBatPasswordFromFile
push str._n_s_:_File_size_is__u__0x_.8x_
call fcn.00449974
push 0x3e7
lea eax, [ebp - 0x138b]
mov byte [ebp - 0x138c], 0
push 0
push eax
call fcn.00626f50
push 0x3e7
lea eax, [ebp - 0x7d3]
mov byte [ebp - 0x7d4], 0
push 0
push eax
call fcn.00626f50
push 0x3e7
lea eax, [ebp - 0x1b5b]
mov byte [ebp - 0x1b5c], 0
push 0
push eax
call fcn.00626f50
push 0x3e7
lea eax, [ebp - 0x1773]
mov byte [ebp - 0x1774], 0
push 0
push eax
call fcn.00626f50
add esp, 0x40
mov byte [ebp - 0xfa4], 0
lea eax, [ebp - 0xfa3]
push 0x3e7
push 0
push eax
call fcn.00626f50
push 0x3e7
lea eax, [ebp - 0xbbb]
mov byte [ebp - 0xbbc], 0
push 0
push eax
call fcn.00626f50
push 0x3e7
lea eax, [ebp - 0x1f43]
mov byte [ebp - 0x1f44], 0
push 0
push eax
call fcn.00626f50
push 0x3e7
lea eax, [ebp - 0x3eb]
mov byte [ebp - 0x3ec], 0
push 0
push eax
call fcn.00626f50
mov esi, dword [esi]
push esi
push esi
push str.RecoverBatPasswordFromFile
push str._n_s_:_Total_number_of_BAT_records_0x_.8x___d_
mov dword [ebp - 0x2160], esi
call fcn.00449974
add esp, 0x40
imul esi, esi, 0xd
add esi, 0xc
push esi
push esi
push 0xd
push str.RecoverBatPasswordFromFile
push str._n_s_:_size_of_record__d___final_check_size__d___0x_.8x
call fcn.00449974
add esp, 0x14
cmp esi, edi
jbe 0x421014
push edi
push esi
push str.RecoverBatPasswordFromFile
push str._n_s_:_Record_size___d__is_more_than_file_size___d__...something_is_wrong__n_Aborting_now
call fcn.00449974
mov edi, dword [ebp - 0x2150]
add esp, 0x10
push edi
jmp 0x420ec6
mov edi, dword [ebp - 0x2150]
add esi, edi
push esi
push esi
push str.RecoverBatPasswordFromFile
push str._n_s_:_Start_of_data_is_0x_.8x__nData_is_n_s_
mov dword [ebp - 0x214c], esi
call fcn.00449974
push str.RecoverBatPasswordFromFile
push str._n_n_n_s_:__Rolling_through_each_dice...
call fcn.00449974
and dword [ebp - 0x2154], 0
lea eax, [edi + 4]
add esp, 0x18
mov dword [ebp - 0x2150], eax
cmp dword [ebp - 0x2160], 0
jbe 0x42146a
push 0xd
push eax
lea eax, [ebp - 0x2148]
push eax
call fcn.006269d0
mov ecx, dword [ebp - 0x2147]
add esp, 0xc
cmp ecx, 0x8100
jb 0x421433
cmp ecx, 0x8200
ja 0x42145d
movzx eax, byte [ebp - 0x2148]
push eax
mov eax, dword [ebp - 0x2154]
push ecx
push dword [ebp - 0x2150]
inc eax
push eax
push str._n_Record__d___Start_Address0x_.8x___Code_0x_.8x__Type_d
call fcn.00449974
mov eax, dword [ebp - 0x2147]
mov ecx, 0x8195
add esp, 0x14
cmp eax, ecx
ja 0x42121b
je 0x4211c6
sub eax, 0x8159
je 0x421171
sub eax, 0x20
je 0x42111c
sub eax, 5
je 0x421105
dec eax
sub eax, 1
je 0x4210f8
sub eax, 0x14
je 0x421241
jmp 0x421433
push dword [ebp - 0x2143]
push str._n__Found_SMTP_port__d
jmp 0x421110
push dword [ebp - 0x2143]
push str._n__Found_POP_IMAP_port__d
call fcn.00449974
pop ecx
pop ecx
jmp 0x421433
add esi, dword [ebp - 0x2143]
lea eax, [ebp - 0x7d4]
cmp byte [ebp - 0x2148], 3
jne 0x421148
xor ecx, ecx
push ecx
push ecx
push 0x3e8
push eax
push 0xffffffffffffffff
push esi
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x421157
push esi
push 0x2710
push eax
call fcn.006311ec
add esp, 0xc
lea eax, [ebp - 0x7d4]
push eax
movzx eax, byte [ebp - 0x2148]
push esi
push eax
push str._n__Found_POP_IMAP_server__type_d___0x_.8x___s
jmp 0x421425
add esi, dword [ebp - 0x2143]
lea eax, [ebp - 0x138c]
cmp byte [ebp - 0x2148], 3
jne 0x42119d
xor ecx, ecx
push ecx
push ecx
push 0x3e8
push eax
push 0xffffffffffffffff
push esi
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x4211ac
push esi
push 0x2710
push eax
call fcn.006311ec
add esp, 0xc
lea eax, [ebp - 0x138c]
push eax
movzx eax, byte [ebp - 0x2148]
push esi
push eax
push str._n__Found_Email_address__type_d___0x_.8x___s
jmp 0x421425
add esi, dword [ebp - 0x2143]
lea eax, [ebp - 0xbbc]
cmp byte [ebp - 0x2148], 3
jne 0x4211f2
xor ecx, ecx
push ecx
push ecx
push 0x3e8
push eax
push 0xffffffffffffffff
push esi
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x421201
push esi
push 0x2710
push eax
call fcn.006311ec
add esp, 0xc
lea eax, [ebp - 0xbbc]
push eax
movzx eax, byte [ebp - 0x2148]
push esi
push eax
push str._n__Found_SMTP_username__type_d___0x_.8x___s
jmp 0x421425
sub eax, 0x819e
je 0x4213d5
sub eax, 8
je 0x421351
sub eax, 1
je 0x4212cd
sub eax, 0x16
jne 0x421433
add esi, dword [ebp - 0x2143]
lea eax, [ebp - 0x3ec]
xor ecx, ecx
cmp byte [ebp - 0x2148], 3
mov byte [ebp - 0x3ec], cl
jne 0x421273
push ecx
push ecx
push 0x3e8
push eax
push 0xffffffffffffffff
push esi
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x421282
push esi
push 0x2710
push eax
call fcn.006311ec
add esp, 0xc
lea eax, [ebp - 0x3ec]
push eax
movzx eax, byte [ebp - 0x2148]
push esi
push eax
push str._n__Found_SMTP_password__type_d___0x_.8x___s
call fcn.00449974
push 0x3e8
lea eax, [ebp - 0x1f44]
push eax
lea eax, [ebp - 0x3ec]
push eax
call fcn.004077e0
lea eax, [ebp - 0x1f44]
push eax
push str._n_Final_Decoded_SMTP_password__s
call fcn.00449974
add esp, 0x24
jmp 0x42142d
add esi, dword [ebp - 0x2143]
lea eax, [ebp - 0x3ec]
xor ecx, ecx
cmp byte [ebp - 0x2148], 3
mov byte [ebp - 0x3ec], cl
jne 0x4212ff
push ecx
push ecx
push 0x3e8
push eax
push 0xffffffffffffffff
push esi
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x42130e
push esi
push 0x2710
push eax
call fcn.006311ec
add esp, 0xc
lea eax, [ebp - 0x3ec]
push eax
movzx eax, byte [ebp - 0x2148]
push esi
push eax
push str._n__Found_POP_username__type_d___0x_.8x___s
call fcn.00449974
push 0x3e8
lea eax, [ebp - 0x1b5c]
push eax
lea eax, [ebp - 0x3ec]
push eax
call fcn.004077e0
lea eax, [ebp - 0x1b5c]
push eax
push str._n_Final_Decoded_POP_username__s
jmp 0x4212c0
add esi, dword [ebp - 0x2143]
lea eax, [ebp - 0x3ec]
xor ecx, ecx
cmp byte [ebp - 0x2148], 3
mov byte [ebp - 0x3ec], cl
jne 0x421383
push ecx
push ecx
push 0x3e8
push eax
push 0xffffffffffffffff
push esi
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x421392
push esi
push 0x2710
push eax
call fcn.006311ec
add esp, 0xc
lea eax, [ebp - 0x3ec]
push eax
movzx eax, byte [ebp - 0x2148]
push esi
push eax
push str._n__Found_POP_password__type_d___0x_.8x___s
call fcn.00449974
push 0x3e8
lea eax, [ebp - 0x1774]
push eax
lea eax, [ebp - 0x3ec]
push eax
call fcn.004077e0
lea eax, [ebp - 0x1774]
push eax
push str._n_Final_Decoded_POP_password__s
jmp 0x4212c0
add esi, dword [ebp - 0x2143]
lea eax, [ebp - 0xfa4]
cmp byte [ebp - 0x2148], 3
jne 0x421401
xor ecx, ecx
push ecx
push ecx
push 0x3e8
push eax
push 0xffffffffffffffff
push esi
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x421410
push esi
push 0x2710
push eax
call fcn.006311ec
add esp, 0xc
lea eax, [ebp - 0xfa4]
push eax
movzx eax, byte [ebp - 0x2148]
push esi
push eax
push str._n__Found_SMTP_server__type_d___0x_.8x___s
call fcn.00449974
add esp, 0x10
mov esi, dword [ebp - 0x214c]
mov ecx, dword [ebp - 0x2154]
mov eax, dword [ebp - 0x2150]
inc ecx
add eax, 0xd
mov dword [ebp - 0x2154], ecx
mov dword [ebp - 0x2150], eax
cmp ecx, dword [ebp - 0x2160]
jb 0x421062
jmp 0x42146a
push ecx
push str._n_Current_item_code0x_.8x__has_exceeded_the_range_0x8200__n_finished_parsing....breaking_now
call fcn.00449974
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x2158]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
lea eax, [ebp - 0x7d4]
push str.imap
push eax
call fcn.00627320
test eax, eax
mov edx, str.IMAP
mov ecx, str.POP3
lea eax, [ebp - 0x2138]
cmovne ecx, edx
push ecx
push 0x1f4
push eax
call fcn.006311ec
push 0xffffffffffffffff
mov edi, 0x66ae5d
lea eax, [ebp - 0x1774]
push edi
push eax
lea eax, [ebp - 0x1b5c]
mov esi, 0x101
push eax
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0x2138]
push eax
push esi
push 2
call fcn.00412c85
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x1f44]
push eax
lea ecx, [ebp - 0xbbc]
push ecx
lea ecx, [ebp - 0xfa4]
push ecx
push str.SMTP
push esi
push 2
call fcn.00412c85
xor eax, eax
add esp, 0x54
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret