Function at 0x42cf03
Capabilities:
Get common file path
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1b9c
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x40b]
push edi
mov edi, 0x3e7
xor ebx, ebx
push edi
push ebx
push eax
mov byte [ebp - 0x40c], bl
call fcn.00626f50
push edi
lea eax, [ebp - 0x1793]
mov byte [ebp - 0x1794], bl
push ebx
push eax
call fcn.00626f50
push esi
mov dword [ebp - 0x24], 0x612e4d53
mov dword [ebp - 0x20], 0x686372
call fcn.00631510
add esp, 0x1c
cmp eax, 1
jae 0x42cfae
lea eax, [ebp - 0x1794]
push eax
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x42cfa1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RecoverGlobalDownloaderPasswords
push str._s_Failed_to_find_appdata_folder__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x42d521
mov eax, str._sGlobal_DownloaderData_s
lea esi, [ebp - 0x1794]
jmp 0x42cfb3
mov eax, 0x66c218
lea ecx, [ebp - 0x24]
push ecx
push esi
push eax
lea eax, [ebp - 0x40c]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x40c]
push eax
push str._n_Final_file_path_is____s
call fcn.00449974
add esp, 0x1c
lea eax, [ebp - 0x40c]
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x1b9c], edi
cmp edi, 0xffffffff
jne 0x42d029
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x40c]
push eax
push str.RecoverGlobalDownloaderPasswords
push str._n_s_:_Failed_to_open__s__Error0x_.8x
call fcn.00449974
add esp, 0x10
jmp 0x42cf9a
push ebx
push ebx
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
mov dword [ebp - 0x1b98], esi
test esi, esi
jne 0x42d06e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x40c]
push eax
push str.RecoverGlobalDownloaderPasswords
push str._s_:_Failed_to_create_flle_mapping_for__s___Error0x_.8x
call fcn.00449974
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42cf9a
push ebx
push ebx
push ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x1b84], eax
test eax, eax
jne 0x42d0ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RecoverGlobalDownloaderPasswords
push str._s_:_Failed_to_map_view_of_flle__Error0x_.8x
call fcn.00449974
add esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
jmp 0x42cf9a
push eax
push str.RecoverGlobalDownloaderPasswords
push str._n_s_:_File_is_successfully_mapped_at_address__0x_.8x
call fcn.00449974
add esp, 0xc
mov dword [ebp - 0x1b94], ebx
lea eax, [ebp - 0x1b94]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp dword [ebp - 0x1b94], ebx
je 0x42d0f8
push str.RecoverGlobalDownloaderPasswords
push str._n_s_:_Critical_Situation___File_Size_is_higher_than_we_have_expected
call fcn.00449974
pop ecx
pop ecx
push dword [ebp - 0x1b98]
jmp 0x42d09e
push esi
push str.RecoverGlobalDownloaderPasswords
push str._n_s_:_File_size_is__u
call fcn.00449974
push 7
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x3000000
push eax
push esi
push dword [ebp - 0x1b84]
mov word [ebp - 0x18], 0x5446
mov byte [ebp - 0x16], 0x50
mov dword [ebp - 0x1b90], 0x50544603
mov dword [ebp - 0xc], 0x50544604
mov byte [ebp - 8], 0x53
mov dword [ebp - 0x14], 0x54465304
mov byte [ebp - 0x10], 0x50
call fcn.00449f17
mov edi, eax
add esp, 0x1c
test edi, edi
jne 0x42d16a
push str.RecoverGlobalDownloaderPasswords
push str._n_s_:_No_start_signature__FTP__found...returning_now
call fcn.00449974
pop ecx
pop ecx
jmp 0x42d4fd
mov eax, edi
sub eax, dword [ebp - 0x1b84]
push eax
push edi
push str._n_Found_first_FTP_record_at_0x_.8x__offset__0x_.8x_
call fcn.00449974
mov ecx, dword [ebp - 0x1b84]
add esp, 0xc
add edi, 7
add esi, ecx
mov byte [ebp - 0xfc4], bl
mov byte [ebp - 0x7f4], bl
mov byte [ebp - 0x1b7c], bl
mov byte [ebp - 0xbdc], bl
mov byte [ebp - 0x13ac], bl
cmp edi, esi
ja 0x42d4eb
mov eax, edi
sub eax, ecx
push eax
push edi
push str._n_Reading_next_FTP_record_at_0x_.8x__offset__0x_.8x_
call fcn.00449974
movzx ecx, byte [edi]
add esp, 0xc
inc ecx
add ecx, edi
cmp ecx, esi
ja 0x42d4e7
movzx eax, byte [ecx]
inc ecx
add ecx, eax
cmp ecx, esi
ja 0x42d4e7
movzx edi, byte [ecx]
inc edi
add edi, ecx
cmp edi, esi
ja 0x42d4de
mov al, byte [edi]
mov byte [ebp - 0x1b7d], al
test al, al
je 0x42d2ae
movzx ecx, al
mov dword [ebp - 0x1b88], ecx
lea eax, [ecx + 1]
add eax, edi
cmp eax, esi
ja 0x42d4de
push ecx
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x7f4]
push eax
call fcn.006269d0
mov eax, dword [ebp - 0x1b88]
lea ecx, [ebp - 0x7f4]
push ecx
push eax
push str._n_Found_encoded_password___d_____s
mov byte [ebp + eax - 0x7f4], bl
call fcn.00449974
lea eax, [ebp - 0x7f4]
push str.__GD_ENCRYPTED
push eax
call fcn.00627320
add esp, 0x20
test eax, eax
je 0x42d25f
mov byte [eax], bl
lea eax, [ebp - 0x7f4]
push eax
push dword [ebp - 0x1b88]
push str._n_Final_encoded_password___d_____s
call fcn.00449974
push 0x3e8
lea eax, [ebp - 0xfc4]
push eax
lea eax, [ebp - 0x7f4]
push eax
call fcn.0040b651
add esp, 0x18
test eax, eax
je 0x42d2a8
lea eax, [ebp - 0xfc4]
push eax
push str._n_Successfully_decryped_Password_s
call fcn.00449974
pop ecx
pop ecx
mov al, byte [ebp - 0x1b7d]
movzx ecx, al
inc ecx
add ecx, edi
cmp ecx, esi
ja 0x42d4e7
movzx edi, byte [ecx]
inc edi
add edi, ecx
cmp edi, esi
ja 0x42d4de
movzx eax, byte [edi]
mov dword [ebp - 0x1b8c], eax
add eax, edi
mov dword [ebp - 0x1b88], eax
lea eax, [ebp - 0xfc4]
push eax
call fcn.00631510
test eax, eax
mov eax, dword [ebp - 0x1b88]
pop ecx
je 0x42d339
inc eax
cmp eax, esi
ja 0x42d4de
push dword [ebp - 0x1b8c]
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x13ac]
push eax
call fcn.006269d0
mov eax, dword [ebp - 0x1b8c]
lea ecx, [ebp - 0x13ac]
push ecx
push eax
push str._n_Found_host___d_____s
mov byte [ebp + eax - 0x13ac], bl
call fcn.00449974
mov eax, dword [ebp - 0x1b88]
add esp, 0x18
lea ecx, [eax + 1]
cmp ecx, esi
ja 0x42d4e7
movzx edi, byte [ecx]
inc edi
add edi, ecx
cmp edi, esi
ja 0x42d4de
mov al, byte [edi]
mov byte [ebp - 0x1b7d], al
lea eax, [ebp - 0xfc4]
push eax
call fcn.00631510
pop ecx
test eax, eax
je 0x42d41c
movzx ecx, byte [ebp - 0x1b7d]
mov dword [ebp - 0x1b8c], ecx
lea eax, [ecx + 1]
add eax, edi
cmp eax, esi
ja 0x42d4de
push ecx
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0xbdc]
push eax
call fcn.006269d0
mov eax, dword [ebp - 0x1b8c]
lea ecx, [ebp - 0xbdc]
push ecx
push eax
push str._n_Found_encoded_username___d_____s
mov byte [ebp + eax - 0xbdc], bl
call fcn.00449974
lea eax, [ebp - 0xbdc]
push str.__GD_ENCRYPTED
push eax
call fcn.00627320
add esp, 0x20
test eax, eax
je 0x42d3d3
mov byte [eax], bl
lea eax, [ebp - 0xbdc]
push eax
push dword [ebp - 0x1b8c]
push str._n_Final_encoded_Username___d_____s
call fcn.00449974
push 0x3e8
lea eax, [ebp - 0x1b7c]
push eax
lea eax, [ebp - 0xbdc]
push eax
call fcn.0040b651
add esp, 0x18
test eax, eax
je 0x42d41c
lea eax, [ebp - 0x1b7c]
push eax
push str._n_Successfully_decryped_Username_s
call fcn.00449974
pop ecx
pop ecx
lea eax, [ebp - 0xfc4]
push eax
call fcn.00631510
pop ecx
test eax, eax
je 0x42d45a
push 0xffffffffffffffff
mov ecx, 0x66ae5d
lea eax, [ebp - 0xfc4]
push ecx
push eax
lea eax, [ebp - 0x1b7c]
push eax
lea eax, [ebp - 0x13ac]
push eax
push ecx
push 0x155
push 4
call fcn.00412c85
add esp, 0x20
movzx eax, byte [ebp - 0x1b7d]
add eax, 5
add edi, eax
cmp edi, esi
ja 0x42d4de
push 4
lea eax, [ebp - 0x1b90]
push eax
push edi
call fcn.0062534d
add esp, 0xc
test eax, eax
jne 0x42d484
push 4
jmp 0x42d4ac
push 5
lea eax, [ebp - 0xc]
push eax
push edi
call fcn.0062534d
add esp, 0xc
push 5
test eax, eax
je 0x42d4ac
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.0062534d
add esp, 0xc
test eax, eax
jne 0x42d4d1
push 5
pop eax
add edi, eax
mov eax, edi
sub eax, dword [ebp - 0x1b84]
push eax
push edi
push str._n_n_Found_ending_signature__FTP_or_FTPS_...Next_record_at_0x_.8x__offset__0x_.8x_
call fcn.00449974
mov ecx, dword [ebp - 0x1b84]
add esp, 0xc
jmp 0x42d18c
push str._n_Failed_to_find_ending_signature...._FTP_or_FTPSBreaking_now
call fcn.00449974
pop ecx
jmp 0x42d4fa
push esi
push edi
push str._n_Error___Next_data__0x_.8x__is_outside_file_boundary__0x_.8x_...._Breaking_now
jmp 0x42d4f2
push esi
push ecx
jmp 0x42d4e0
push esi
push edi
push str._n_Error___Next_SITE_RECORD__0x_.8x__is_outside_file_boundary__0x_.8x_...._Breaking_now
call fcn.00449974
add esp, 0xc
xor ebx, ebx
inc ebx
push dword [ebp - 0x1b84]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x1b98]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1b9c]
call esi
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret