Function at 0x485cc3
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x4ad97b
call fcn.004ace8c
sub esp, 0x8c
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x14], ecx
cmp dword [ebx + 0x120], 0xffffffff
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x68], ebx
jne 0x485d20
mov dl, byte [ebx + 0x112]
lea ecx, [ebx + 0xf8]
movzx esi, word [ebx + 0x110]
call fcn.00489639
push 0
push 0
push edx
push dword [ebx + 0x168]
mov ecx, ebx
push esi
push eax
call fcn.004864b0
test al, al
je 0x486498
and dword [ebp - 4], 0
mov esi, dword [sym.imp.mfc140.dll_Ordinal_265]
push 0x37
call esi
mov dword [ebp - 0x1c], eax
pop ecx
test eax, eax
jne 0x485d4f
push 0x198
lea ecx, [ebp - 0x3c]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x4864a9
push 0xff
call esi
mov edi, eax
mov dword [ebp - 0x20], edi
pop ecx
test edi, edi
jne 0x485d79
push 0x198
lea ecx, [ebp - 0x40]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x4864a9
and dword [ebp - 0x24], 0
xor esi, esi
mov dword [ebp - 0x5c], 0x36
lea ecx, [ebx + 0x14c]
call fcn.0048945b
cmp esi, eax
jae 0x485e4e
push esi
lea ecx, [ebx + 0x14c]
call fcn.00489451
mov ecx, eax
call fcn.00489639
push eax
push 0xff
push edi
call fcn.0048a8a2
push 0x4d9de0
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x485de6
push 0x194
lea ecx, [ebp - 0x44]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x4864a9
and dword [ebp - 0x18], 0
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
pop ecx
jmp 0x485e11
push edi
push 0x36
pop eax
push eax
push 1
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add dword [ebp - 0x18], eax
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
add esp, 0x14
test eax, eax
je 0x485df4
mov edi, dword [ebp - 0x24]
add edi, dword [ebp - 0x18]
mov eax, edi
mov dword [ebp - 0x24], edi
and eax, 0xfffffc00
cmp eax, 0x500000
jbe 0x485e45
push 0x195
lea ecx, [ebp - 0x48]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x4864a9
mov edi, dword [ebp - 0x20]
inc esi
jmp 0x485d86
lea ecx, [ebx + 0x1c]
call fcn.00484f23
test eax, eax
jne 0x485e73
push 0xc9
lea ecx, [ebp - 0x4c]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x4864a9
push 9
pop ecx
call fcn.004854f1
lea ecx, [ebx + 0x1c]
mov edi, eax
call fcn.00489639
push eax
push str.MAIL_FROM:__s__r_n
push 0x2800
push dword [ebx + 0x118]
call fcn.0048a8a2
add esp, 0x10
mov ecx, ebx
push edi
call fcn.00488438
push edi
mov ecx, ebx
call fcn.00488e4f
lea ecx, [ebx + 0x128]
call fcn.0048954c
test eax, eax
jne 0x485ed6
push 0xcb
lea ecx, [ebp - 0x50]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x4864a9
push 0xa
pop ecx
call fcn.004854f1
mov esi, eax
xor edi, edi
lea ecx, [ebx + 0x128]
call fcn.0048954c
cmp edi, eax
jae 0x485f31
push edi
lea ecx, [ebx + 0x128]
call fcn.0048951d
lea ecx, [eax + 0x18]
call fcn.00489639
push eax
push str.RCPT_TO:__s__r_n
push 0x2800
push dword [ebx + 0x118]
call fcn.0048a8a2
add esp, 0x10
mov ecx, ebx
push esi
call fcn.00488438
push esi
mov ecx, ebx
call fcn.00488e4f
inc edi
jmp 0x485ee2
xor edi, edi
lea ecx, [ebx + 0x134]
call fcn.0048954c
cmp edi, eax
jae 0x485f82
push edi
lea ecx, [ebx + 0x134]
call fcn.0048951d
lea ecx, [eax + 0x18]
call fcn.00489639
push eax
push str.RCPT_TO:__s__r_n
push 0x2800
push dword [ebx + 0x118]
call fcn.0048a8a2
add esp, 0x10
mov ecx, ebx
push esi
call fcn.00488438
push esi
mov ecx, ebx
call fcn.00488e4f
inc edi
jmp 0x485f33
xor edi, edi
lea ecx, [ebx + 0x140]
call fcn.0048954c
cmp edi, eax
jae 0x485fd3
push edi
lea ecx, [ebx + 0x140]
call fcn.0048951d
lea ecx, [eax + 0x18]
call fcn.00489639
push eax
push str.RCPT_TO:__s__r_n
push 0x2800
push dword [ebx + 0x118]
call fcn.0048a8a2
add esp, 0x10
mov ecx, ebx
push esi
call fcn.00488438
push esi
mov ecx, ebx
call fcn.00488e4f
inc edi
jmp 0x485f84
push 0xb
pop ecx
call fcn.004854f1
push str.DATA_r_n
push 0x2800
push dword [ebx + 0x118]
mov esi, eax
call fcn.0048a8a2
add esp, 0xc
mov ecx, ebx
push esi
call fcn.00488438
push esi
mov ecx, ebx
call fcn.00488e4f
push 0xc
pop ecx
call fcn.004854f1
push dword [ebx + 0x118]
mov edi, eax
mov ecx, ebx
mov dword [ebp - 0x28], edi
call 0x4878c9
push edi
mov ecx, ebx
call fcn.00488438
mov ecx, ebx
call fcn.004886f7
test eax, eax
je 0x48606b
xor esi, esi
mov ecx, ebx
call fcn.004886f7
cmp esi, eax
jae 0x486090
push esi
mov ecx, ebx
call 0x4886ae
push eax
push str._s_r_n
push 0x2800
push dword [ebx + 0x118]
call fcn.0048a8a2
add esp, 0x10
mov ecx, ebx
push edi
call fcn.00488438
inc esi
jmp 0x486034
push 0x4dac74
push str._s_r_n
push 0x2800
push dword [ebx + 0x118]
call fcn.0048a8a2
add esp, 0x10
mov ecx, ebx
push edi
call fcn.00488438
and dword [ebp - 0x2c], 0
xor esi, esi
lea ecx, [ebx + 0x14c]
mov dword [ebp - 0x18], esi
call fcn.0048945b
cmp esi, eax
jae 0x486403
push esi
lea ecx, [ebx + 0x14c]
call fcn.00489451
mov ecx, eax
call fcn.00489639
push eax
push 0xff
push dword [ebp - 0x20]
call fcn.0048a8a2
push str.__MESSAGE__ID__54yg6f6h6y456345
push str.___s_r_n
push 0x2800
push dword [ebx + 0x118]
call fcn.0048a8a2
mov edi, dword [ebx + 0x118]
add esp, 0x1c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4860f1
push 0xb
pop ecx
mov esi, str.Content_Type:_application_x_msdownload__name_
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x18]
lea ecx, [ebx + 0x14c]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00489451
push ecx
push ecx
mov ecx, eax
call fcn.004895d1
mov edx, dword [ebp - 0x20]
inc edx
add edx, eax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x486125
mov edi, dword [ebx + 0x118]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x486135
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x118]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x486152
mov eax, dword [0x4dacb4]
mov dword [edi], eax
mov edi, dword [ebx + 0x118]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x486168
push 9
pop ecx
mov esi, str.Content_Transfer_Encoding:_base64_r_n
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebx + 0x118]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x486181
push 0xb
pop ecx
push dword [ebp - 0x18]
mov esi, str.Content_Disposition:_attachment__filename_
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x14c]
call fcn.00489451
push ecx
push ecx
mov ecx, eax
call fcn.004895d1
mov edx, dword [ebp - 0x20]
inc edx
add edx, eax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x4861b2
mov edi, dword [ebx + 0x118]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4861c2
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x118]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4861df
mov eax, dword [0x4dacb4]
mov dword [edi], eax
mov ecx, dword [ebx + 0x118]
dec ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4861f5
mov ax, word [0x4dad08]
push dword [ebp - 0x28]
mov word [ecx], ax
mov al, byte [0x4dad0a]
mov byte [ecx + 2], al
mov ecx, ebx
call fcn.00488438
push 0x4d9de0
push dword [ebp - 0x20]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
mov dword [ebp - 0x60], esi
pop ecx
pop ecx
test esi, esi
jne 0x48624a
push 0x194
lea ecx, [ebp - 0x54]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x4864a9
xor edi, edi
push esi
mov dword [ebp - 0x30], edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
pop ecx
jmp 0x486278
push esi
push 0x36
pop eax
push eax
push 1
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add edi, eax
push esi
mov dword [ebp - 0x30], edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
add esp, 0x14
test eax, eax
je 0x486259
mov eax, dword [ebp - 0x2c]
add eax, edi
mov dword [ebp - 0x2c], eax
and eax, 0xfffffc00
cmp eax, 0x500000
jbe 0x4862a9
push 0x195
lea ecx, [ebp - 0x58]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x4864a9
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
xor edi, edi
add esp, 0xc
mov dword [ebp - 0x24], edi
xor ecx, ecx
mov eax, dword [ebp - 0x30]
xor edx, edx
div dword [ebp - 0x5c]
mov dword [ebp - 0x34], ecx
inc eax
cmp ecx, eax
jae 0x4863e3
push esi
push 0x36
pop eax
push eax
push 1
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, dword [ebp - 0x1c]
add esp, 0x10
mov dword [ebp - 0x64], eax
push eax
test edi, edi
je 0x48633e
lea ecx, [ebp - 0x98]
call fcn.00484bdd
pop ecx
mov ecx, dword [ebp - 0x14]
or ecx, 1
mov dword [ebp - 0x14], ecx
mov ecx, eax
call fcn.00489639
mov edx, eax
mov esi, eax
mov al, byte [edx]
inc edx
test al, al
jne 0x486310
mov edi, dword [ebx + 0x118]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x486320
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x60]
mov edi, dword [ebp - 0x24]
jmp 0x486367
lea ecx, [ebp - 0x80]
call fcn.00484bdd
pop ecx
mov ecx, dword [ebp - 0x14]
or ecx, 2
mov dword [ebp - 0x14], ecx
mov ecx, eax
call fcn.00489639
mov edx, dword [ebx + 0x118]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x48635d
mov eax, dword [ebp - 0x14]
test al, 2
je 0x48637f
and eax, 0xfffffffd
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x14], eax
call fcn.00484f47
mov eax, dword [ebp - 0x14]
and dword [ebp - 4], 0
test al, 1
je 0x486398
and eax, 0xfffffffe
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x14], eax
call fcn.00484f47
mov ecx, dword [ebx + 0x118]
dec ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x48639f
mov ax, word [0x4dad08]
mov word [ecx], ax
mov al, byte [0x4dad0a]
mov byte [ecx + 2], al
mov eax, dword [ebp - 0x64]
add eax, 2
add edi, eax
mov dword [ebp - 0x24], edi
cmp edi, 0x1400
jb 0x4863da
push dword [ebp - 0x28]
xor edi, edi
mov ecx, ebx
mov dword [ebp - 0x24], edi
call fcn.00488438
mov ecx, dword [ebp - 0x34]
inc ecx
jmp 0x4862be
test edi, edi
mov edi, dword [ebp - 0x28]
je 0x4863f2
push edi
mov ecx, ebx
call fcn.00488438
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov esi, dword [ebp - 0x18]
pop ecx
inc esi
jmp 0x486096
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.mfc140.dll_Ordinal_266]
call esi
push dword [ebp - 0x20]
call esi
pop ecx
pop ecx
lea ecx, [ebx + 0x14c]
call fcn.0048945b
test eax, eax
je 0x486449
push str.__MESSAGE__ID__54yg6f6h6y456345
push str._r_n___s___r_n
push 0x2800
push dword [ebx + 0x118]
call fcn.0048a8a2
add esp, 0x10
mov ecx, ebx
push edi
call fcn.00488438
push 0xd
pop ecx
call fcn.004854f1
push str._r_n._r_n
push 0x2800
push dword [ebx + 0x118]
mov esi, eax
call fcn.0048a8a2
add esp, 0xc
mov ecx, ebx
push esi
call fcn.00488438
push esi
mov ecx, ebx
call fcn.00488e4f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
push 0x6a
lea ecx, [ebp - 0x38]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3