Function at 0x409be9
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13a4
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov esi, str.DecryptFDMPasswords
push esi
push str._n_n_s_:_mapping_file__s
call fcn.00449974
add esp, 0xc
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push SysReAllocString
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x409c51
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push esi
push str._n_s_:_Failed_to_open__s__Error0x_.8x
call fcn.00449974
add esp, 0x10
jmp 0x409fd3
xor eax, eax
push eax
push eax
push eax
push 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
test esi, esi
jne 0x409c8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.DecryptFDMPasswords
push str._s_:_Failed_to_create_flle_mapping_for__s___Error0x_.8x
call fcn.00449974
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409fd3
xor eax, eax
push eax
push eax
push eax
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
jne 0x409cbe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DecryptFDMPasswords
push str._s_:_Failed_to_map_view_of_flle__Error0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x409fc7
push ebx
push str.DecryptFDMPasswords
push str._n_s_:_File_is_successfully_mapped_at_address__0x_.8x
call fcn.00449974
and dword [ebp - 0x139c], 0
lea eax, [ebp - 0x139c]
add esp, 0xc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 0x139c], 0
mov dword [ebp - 0x13a4], eax
je 0x409d04
push str.DecryptFDMPasswords
push str._n_s_:_Critical_Situation___File_Size_is_higher_than_we_have_expected
jmp 0x409fc0
push eax
push str.DecryptFDMPasswords
push str._n_s_:_File_size_is__u
call fcn.00449974
mov eax, dword [ebx + 0x10]
and dword [ebp - 0x1398], 0
push eax
push str._n_n_Total_FDM_Accounts____d
mov dword [ebp - 0x13a0], eax
call fcn.00449974
mov ecx, dword [ebp - 0x13a0]
add esp, 0x14
lea eax, [ecx - 1]
cmp eax, 0x3e7
ja 0x409fb6
lea edx, [ebx + 0x14]
mov dword [ebp - 0x1390], edx
test ecx, ecx
je 0x409f9e
mov eax, dword [ebp - 0x1398]
xor ecx, ecx
inc eax
push edx
push eax
push str.DecryptFDMPasswords
push str._n_n_s_:_Found_new_Account__d__at_0x_.8x_
mov byte [ebp - 0x3ec], cl
mov byte [ebp - 0x7d4], cl
mov byte [ebp - 0xbbc], cl
mov dword [ebp - 0x1398], eax
call fcn.00449974
mov ecx, dword [ebp - 0x1390]
add esp, 0x10
mov eax, dword [ecx]
mov dword [ebp - 0x1394], eax
push eax
cmp eax, 0x3e8
ja 0x409f8c
lea eax, [ecx + 4]
xor edx, edx
push eax
lea eax, [ebp - 0x138c]
mov word [ebp - 0x138c], dx
push 0x3e8
push eax
call fcn.00630a73
add esp, 0x10
lea eax, [ebp - 0xbbc]
xor ecx, ecx
push ecx
push ecx
push 0x3e8
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x138c]
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0xbbc]
push eax
push str.DecryptFDMPasswords
push str._n_s_:_Download_Website___s
call fcn.00449974
mov eax, dword [ebp - 0x1394]
add esp, 0xc
mov ecx, dword [ebp - 0x1390]
lea ecx, [ecx + eax*2]
add ecx, 4
mov dword [ebp - 0x1390], ecx
mov eax, dword [ecx]
mov dword [ebp - 0x1394], eax
push eax
cmp eax, 0x3e8
ja 0x409f80
lea eax, [ecx + 4]
xor edx, edx
push eax
lea eax, [ebp - 0x138c]
mov word [ebp - 0x138c], dx
push 0x3e8
push eax
call fcn.00630a73
add esp, 0x10
lea eax, [ebp - 0x3ec]
xor ecx, ecx
push ecx
push ecx
push 0x3e8
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x138c]
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x3ec]
push eax
push str.DecryptFDMPasswords
push str._n_s_:_Password____s
call fcn.00449974
mov eax, dword [ebp - 0x1394]
add esp, 0xc
mov ecx, dword [ebp - 0x1390]
lea ecx, [ecx + eax*2]
add ecx, 4
mov dword [ebp - 0x1390], ecx
mov eax, dword [ecx]
mov dword [ebp - 0x1394], eax
push eax
cmp eax, 0x3e8
ja 0x409f74
lea eax, [ecx + 4]
xor edx, edx
push eax
lea eax, [ebp - 0x138c]
mov word [ebp - 0x138c], dx
push 0x3e8
push eax
call fcn.00630a73
add esp, 0x10
lea eax, [ebp - 0x7d4]
xor ecx, ecx
push ecx
push ecx
push 0x3e8
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x138c]
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x7d4]
push eax
push str.DecryptFDMPasswords
push str._n_s_:_Username____s
call fcn.00449974
push 0xffffffffffffffff
mov ecx, 0x66ae5d
lea eax, [ebp - 0x3ec]
push ecx
push eax
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0xbbc]
push eax
push ecx
push 0x85
push 5
call fcn.00412c85
mov eax, dword [ebp - 0x1394]
add esp, 0x2c
mov ecx, dword [ebp - 0x1390]
add eax, 0xc
lea edx, [ecx + eax*2]
mov eax, dword [ebp - 0x13a4]
sub eax, edx
mov dword [ebp - 0x1390], edx
add eax, ebx
cmp eax, 0xc
jb 0x409f9e
mov eax, dword [ebp - 0x1398]
cmp eax, dword [ebp - 0x13a0]
jb 0x409d5d
jmp 0x409f9e
push str.DecryptFDMPasswords
push str._n_s_:_Invalid_username_length____d__returning_now
jmp 0x409f96
push str.DecryptFDMPasswords
push str._n_s_:_Invalid_password_length____d__returning_now
jmp 0x409f96
push str.DecryptFDMPasswords
push str._n_s_:_Invalid_website_length____d__returning_now
call fcn.00449974
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
xor eax, eax
inc eax
jmp 0x409fd5
push str.DecryptFDMPasswords
push str._n_s_:_No_FDM_Accounts_found__returning_now
call fcn.00449974
pop ecx
pop ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret