Function at 0x4398ea
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x111d4
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Entered__s
call fcn.00449974
add esp, 0xc
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x111cc], edi
cmp edi, 0xffffffff
jne 0x43995d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Failed_to_open__s__Error0x_.8x
call fcn.00449974
add esp, 0x10
xor eax, eax
jmp 0x43a00f
push ebx
push ebx
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x111d4], eax
test eax, eax
jne 0x439997
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.RecoverSmartFTPPasswordsFromFile
push str._s_:_Failed_to_create_flle_mapping_for__s___Error0x_.8x
call fcn.00449974
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x439956
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x4399c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RecoverSmartFTPPasswordsFromFile
push str._s_:_Failed_to_map_view_of_flle__Error0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x439ffc
push esi
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_File_is_successfully_mapped_at_address__0x_.8x
call fcn.00449974
add esp, 0xc
mov dword [ebp - 0x111d0], ebx
lea eax, [ebp - 0x111d0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x111c0], eax
cmp dword [ebp - 0x111d0], ebx
je 0x439a12
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Critical_Situation___File_Size_is_higher_than_we_have_expected
call fcn.00449974
pop ecx
pop ecx
jmp 0x439ff5
push eax
push eax
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_File_size_is__u__0x_.8x_
call fcn.00449974
push 0x270f
lea eax, [ebp - 0x2757]
mov byte [ebp - 0x2758], bl
push ebx
push eax
call fcn.00626f50
push 0x270f
lea eax, [ebp - 0x9c87]
mov byte [ebp - 0x9c88], bl
push ebx
push eax
call fcn.00626f50
push 0x270f
lea eax, [ebp - 0x7577]
mov byte [ebp - 0x7578], bl
push ebx
push eax
call fcn.00626f50
push 0x270f
lea eax, [ebp - 0x4e67]
mov byte [ebp - 0x4e68], bl
push ebx
push eax
call fcn.00626f50
add esp, 0x40
xor eax, eax
mov word [ebp - 0x111b8], ax
lea eax, [ebp - 0x111b6]
push 0x4e1e
push ebx
push eax
call fcn.00626f50
push esi
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Searching_for_password_prefix...starting_at_0x_.8x
mov dword [ebp - 0x1c], 0xc000000
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0x1f
mov dword [ebp - 0x10], 0xd000000
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], 0x1f
mov dword [ebp - 0x38], 0x2d
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x30], 0x1f00
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x48], 0x35
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x40], 0x1f00
mov byte [ebp - 0x3c], bl
mov dword [ebp - 0x28], 0x7000000
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0x1f
call fcn.00449974
push 0xc
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x111c0]
push esi
call fcn.00449f17
add esp, 0x28
mov dword [ebp - 0x111bc], eax
test eax, eax
jne 0x439b42
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Could_not_find_Password_prefix___returning_now
jmp 0x439a06
push eax
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Found_password_prefix_at_0x_.8x
call fcn.00449974
mov edi, dword [ebp - 0x111bc]
mov edi, dword [edi + 0xc]
push edi
push edi
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Password_length__d__0x_.8x_
call fcn.00449974
add esp, 0x1c
cmp edi, 0x1f4
jbe 0x439b8f
push edi
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_password_length_is_abnormal__d__returning_now
call fcn.00449974
add esp, 0xc
jmp 0x439fef
mov eax, dword [ebp - 0x111bc]
mov ecx, dword [ebp - 0x111c0]
add ecx, esi
mov dword [ebp - 0x111c8], ecx
lea edx, [eax + 0x10]
lea eax, [eax + edi*2]
add eax, 0x10
cmp eax, ecx
jbe 0x439bc9
push ecx
push edx
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Current_Index_0x_.8x_has_crossed_the_File_boundary_0x_.8x....returning_now
call fcn.00449974
add esp, 0x10
jmp 0x439fef
push edi
push edx
mov edi, 0x2710
lea eax, [ebp - 0x111b8]
push edi
push eax
call fcn.00630a73
add esp, 0x10
lea eax, [ebp - 0x7578]
push ebx
push ebx
push edi
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x111b8]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x7578]
mov edi, str.RecoverSmartFTPPasswordsFromFile
push eax
push edi
push str._n_s_:_Got_the_password__s
call fcn.00449974
push esi
push edi
push str._n_s_:_Searching_for_username_prefix...starting_at_0x_.8x
call fcn.00449974
push 0xc
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x111c0]
push esi
call fcn.00449f17
mov edi, eax
add esp, 0x28
mov dword [ebp - 0x111bc], edi
test edi, edi
jne 0x439c5b
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Could_not_find_username_prefix___returning_now
call fcn.00449974
mov edi, dword [ebp - 0x111c8]
pop ecx
pop ecx
jmp 0x439d2a
push edi
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Found_Username_prefix_at_0x_.8x
call fcn.00449974
mov edi, dword [edi + 0xc]
push edi
push edi
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Username_length__d__0x_.8x_
mov dword [ebp - 0x111c4], edi
call fcn.00449974
add esp, 0x1c
cmp edi, 0x1f4
jbe 0x439ca8
push edi
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Username_length_is_abnormal__d__returning_now
call fcn.00449974
mov edi, dword [ebp - 0x111c8]
jmp 0x439d27
mov eax, dword [ebp - 0x111bc]
lea ecx, [eax + 0x10]
lea eax, [eax + edi*2]
mov edi, dword [ebp - 0x111c8]
add eax, 0x10
cmp eax, edi
jbe 0x439cd7
push edi
push ecx
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Current_Index_0x_.8x_has_crossed_the_File_boundary_0x_.8x....returning_now
call fcn.00449974
add esp, 0x10
jmp 0x439d2a
push dword [ebp - 0x111c4]
lea eax, [ebp - 0x111b8]
push ecx
push 0x2710
push eax
call fcn.00630a73
add esp, 0x10
lea eax, [ebp - 0x9c88]
push ebx
push ebx
push 0x2710
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x111b8]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x9c88]
push eax
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:__Got_the_Username__s
call fcn.00449974
add esp, 0xc
push esi
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Searching_for_Server_prefix...starting_at_0x_.8x
call fcn.00449974
push 0xd
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x111c0]
push esi
call fcn.00449f17
add esp, 0x1c
mov dword [ebp - 0x111bc], eax
test eax, eax
jne 0x439d95
push 0xd
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x111c0]
push esi
call fcn.00449f17
add esp, 0x10
mov dword [ebp - 0x111bc], eax
test eax, eax
jne 0x439d8e
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Could_not_find_Server_prefix___returning_now
call fcn.00449974
pop ecx
pop ecx
jmp 0x439e58
mov ecx, str._n_s_:_Found_Old_Server_prefix_at_0x_.8x
jmp 0x439d9a
mov ecx, str._n_s_:_Found_New_Server_prefix_at_0x_.8x
push eax
push str.RecoverSmartFTPPasswordsFromFile
push ecx
call fcn.00449974
mov eax, dword [ebp - 0x111bc]
mov eax, dword [eax + 0xd]
push eax
push eax
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Server_length__d__0x_.8x_
mov dword [ebp - 0x111c4], eax
call fcn.00449974
mov ecx, dword [ebp - 0x111c4]
add esp, 0x1c
cmp ecx, 0x1f4
jbe 0x439de4
push ecx
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Server_length_is_abnormal__d__returning_now
jmp 0x439e50
mov eax, dword [ebp - 0x111bc]
lea edx, [eax + 0x11]
lea eax, [eax + ecx*2]
add eax, 0x11
cmp eax, edi
jbe 0x439e0d
push edi
push edx
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Current_Index_0x_.8x_has_crossed_the_File_boundary_0x_.8x....returning_now
call fcn.00449974
add esp, 0x10
jmp 0x439e58
push ecx
push edx
mov edi, 0x2710
lea eax, [ebp - 0x111b8]
push edi
push eax
call fcn.00630a73
add esp, 0x10
lea eax, [ebp - 0x2758]
push ebx
push ebx
push edi
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x111b8]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x2758]
push eax
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Got_the_Server__s
call fcn.00449974
add esp, 0xc
push esi
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Searching_for_Account_prefix...starting_at_0x_.8x
call fcn.00449974
push 0xc
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x111c0]
push esi
call fcn.00449f17
mov edi, eax
add esp, 0x1c
mov dword [ebp - 0x111c4], edi
test edi, edi
jne 0x439e9f
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Could_not_find_Account_prefix___returning_now
call fcn.00449974
pop ecx
pop ecx
jmp 0x439f58
push edi
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Found_New_Account_prefix_at_0x_.8x
call fcn.00449974
mov edi, dword [edi + 0xc]
push edi
push edi
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Account_name_length__d__0x_.8x_
call fcn.00449974
add esp, 0x1c
cmp edi, 0x1f4
jbe 0x439edb
push edi
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Account_length_is_abnormal__d__returning_now
jmp 0x439f50
mov eax, dword [ebp - 0x111c4]
mov ecx, dword [ebp - 0x111c8]
lea edx, [eax + 0x10]
lea eax, [eax + edi*2]
add eax, 0x10
cmp eax, ecx
jbe 0x439f0a
push ecx
push edx
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Current_Index_0x_.8x_has_crossed_the_File_boundary_0x_.8x....returning_now
call fcn.00449974
add esp, 0x10
jmp 0x439f58
push edi
push edx
lea eax, [ebp - 0x111b8]
push 0x2710
push eax
call fcn.00630a73
add esp, 0x10
lea eax, [ebp - 0x4e68]
push ebx
push ebx
push 0x2710
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x111b8]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x2758]
push eax
push str.RecoverSmartFTPPasswordsFromFile
push str._n_s_:_Got_the_Account_name__s
call fcn.00449974
add esp, 0xc
push 0x270f
lea eax, [ebp - 0xc397]
mov byte [ebp - 0xc398], bl
push ebx
push eax
call fcn.00626f50
add esp, 0xc
cmp byte [ebp - 0x4e68], bl
je 0x439fa4
lea eax, [ebp - 0x4e68]
push eax
lea eax, [ebp - 0x2758]
push eax
push str._s___s_
lea eax, [ebp - 0xc398]
push 0x2710
push eax
call fcn.00445d6d
add esp, 0x14
jmp 0x439fbf
lea eax, [ebp - 0x2758]
push eax
lea eax, [ebp - 0xc398]
push 0x2710
push eax
call fcn.006311ec
add esp, 0xc
push 0xffffffffffffffff
mov ecx, 0x66ae5d
lea eax, [ebp - 0x7578]
push ecx
push eax
lea eax, [ebp - 0x9c88]
push eax
lea eax, [ebp - 0xc398]
push eax
push ecx
push 0x12e
push 4
call fcn.00412c85
xor ebx, ebx
add esp, 0x20
inc ebx
mov edi, dword [ebp - 0x111cc]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x111d4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret