Function at 0x4606e6
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x47cdbb
call fcn.0047c7d4
sub esp, 0x8c
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x14], ecx
cmp dword [ebx + 0x120], 0xffffffff
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x68], ebx
jne 0x460742
movzx eax, byte [ebx + 0x112]
push ecx
push ecx
push eax
push dword [ebx + 0x168]
movzx eax, word [ebx + 0x110]
lea ecx, [ebx + 0xf8]
push eax
call fcn.00463fc4
push eax
mov ecx, ebx
call fcn.00460ed2
test al, al
je 0x460eba
and dword [ebp - 4], 0
mov esi, dword [sym.imp.mfc140u.dll_operator]
push 0x37
call esi
mov dword [ebp - 0x1c], eax
pop ecx
test eax, eax
jne 0x460771
push 0x198
lea ecx, [ebp - 0x3c]
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x460ecb
push 0xff
call esi
mov edi, eax
mov dword [ebp - 0x20], edi
pop ecx
test edi, edi
jne 0x46079b
push 0x198
lea ecx, [ebp - 0x40]
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x460ecb
and dword [ebp - 0x24], 0
xor esi, esi
mov dword [ebp - 0x5c], 0x36
lea ecx, [ebx + 0x14c]
call fcn.00463e4b
cmp esi, eax
jae 0x460870
push esi
lea ecx, [ebx + 0x14c]
call fcn.00463e41
mov ecx, eax
call fcn.00463fc4
push eax
push 0xff
push edi
call fcn.00465127
push 0x4a50f0
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x460808
push 0x194
lea ecx, [ebp - 0x44]
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x460ecb
and dword [ebp - 0x18], 0
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
pop ecx
jmp 0x460833
push edi
push 0x36
pop eax
push eax
push 1
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add dword [ebp - 0x18], eax
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
add esp, 0x14
test eax, eax
je 0x460816
mov edi, dword [ebp - 0x24]
add edi, dword [ebp - 0x18]
mov eax, edi
mov dword [ebp - 0x24], edi
and eax, 0xfffffc00
cmp eax, 0x500000
jbe 0x460867
push 0x195
lea ecx, [ebp - 0x48]
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x460ecb
mov edi, dword [ebp - 0x20]
inc esi
jmp 0x4607a8
lea ecx, [ebx + 0x1c]
call fcn.0045fb31
test eax, eax
jne 0x460895
push 0xc9
lea ecx, [ebp - 0x4c]
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x460ecb
push 9
pop ecx
call fcn.00460067
lea ecx, [ebx + 0x1c]
mov edi, eax
call fcn.00463fc4
push eax
push str.MAIL_FROM:__s__r_n
push 0x2800
push dword [ebx + 0x118]
call fcn.00465127
add esp, 0x10
mov ecx, ebx
push edi
call fcn.00462e88
push edi
mov ecx, ebx
call fcn.0046383f
lea ecx, [ebx + 0x128]
call fcn.00463f20
test eax, eax
jne 0x4608f8
push 0xcb
lea ecx, [ebp - 0x50]
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x460ecb
push 0xa
pop ecx
call fcn.00460067
mov esi, eax
xor edi, edi
lea ecx, [ebx + 0x128]
call fcn.00463f20
cmp edi, eax
jae 0x460953
push edi
lea ecx, [ebx + 0x128]
call fcn.00463ef1
lea ecx, [eax + 0x18]
call fcn.00463fc4
push eax
push str.RCPT_TO:__s__r_n
push 0x2800
push dword [ebx + 0x118]
call fcn.00465127
add esp, 0x10
mov ecx, ebx
push esi
call fcn.00462e88
push esi
mov ecx, ebx
call fcn.0046383f
inc edi
jmp 0x460904
xor edi, edi
lea ecx, [ebx + 0x134]
call fcn.00463f20
cmp edi, eax
jae 0x4609a4
push edi
lea ecx, [ebx + 0x134]
call fcn.00463ef1
lea ecx, [eax + 0x18]
call fcn.00463fc4
push eax
push str.RCPT_TO:__s__r_n
push 0x2800
push dword [ebx + 0x118]
call fcn.00465127
add esp, 0x10
mov ecx, ebx
push esi
call fcn.00462e88
push esi
mov ecx, ebx
call fcn.0046383f
inc edi
jmp 0x460955
xor edi, edi
lea ecx, [ebx + 0x140]
call fcn.00463f20
cmp edi, eax
jae 0x4609f5
push edi
lea ecx, [ebx + 0x140]
call fcn.00463ef1
lea ecx, [eax + 0x18]
call fcn.00463fc4
push eax
push str.RCPT_TO:__s__r_n
push 0x2800
push dword [ebx + 0x118]
call fcn.00465127
add esp, 0x10
mov ecx, ebx
push esi
call fcn.00462e88
push esi
mov ecx, ebx
call fcn.0046383f
inc edi
jmp 0x4609a6
push 0xb
pop ecx
call fcn.00460067
push str.DATA_r_n
push 0x2800
push dword [ebx + 0x118]
mov esi, eax
call fcn.00465127
add esp, 0xc
mov ecx, ebx
push esi
call fcn.00462e88
push esi
mov ecx, ebx
call fcn.0046383f
push 0xc
pop ecx
call fcn.00460067
push dword [ebx + 0x118]
mov edi, eax
mov ecx, ebx
mov dword [ebp - 0x28], edi
call 0x4622d5
push edi
mov ecx, ebx
call fcn.00462e88
mov ecx, ebx
call fcn.0046311d
test eax, eax
je 0x460a8d
xor esi, esi
mov ecx, ebx
call fcn.0046311d
cmp esi, eax
jae 0x460ab2
push esi
mov ecx, ebx
call 0x4630d4
push eax
push str._s_r_n
push 0x2800
push dword [ebx + 0x118]
call fcn.00465127
add esp, 0x10
mov ecx, ebx
push edi
call fcn.00462e88
inc esi
jmp 0x460a56
push 0x4a5128
push str._s_r_n
push 0x2800
push dword [ebx + 0x118]
call fcn.00465127
add esp, 0x10
mov ecx, ebx
push edi
call fcn.00462e88
and dword [ebp - 0x2c], 0
xor esi, esi
lea ecx, [ebx + 0x14c]
mov dword [ebp - 0x18], esi
call fcn.00463e4b
cmp esi, eax
jae 0x460e25
push esi
lea ecx, [ebx + 0x14c]
call fcn.00463e41
mov ecx, eax
call fcn.00463fc4
push eax
push 0xff
push dword [ebp - 0x20]
call fcn.00465127
push str.__MESSAGE__ID__54yg6f6h6y456345
push str.___s_r_n
push 0x2800
push dword [ebx + 0x118]
call fcn.00465127
mov edi, dword [ebx + 0x118]
add esp, 0x1c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x460b13
push 0xb
pop ecx
mov esi, str.Content_Type:_application_x_msdownload__name_
rep movsd dword es:[edi], dword [esi]
push ecx
push ecx
push dword [ebp - 0x18]
movsw word es:[edi], word [esi]
lea ecx, [ebx + 0x14c]
movsb byte es:[edi], byte [esi]
call fcn.00463e41
mov ecx, eax
call fcn.00463f66
mov edx, dword [ebp - 0x20]
inc edx
add edx, eax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x460b47
mov edi, dword [ebx + 0x118]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x460b57
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x118]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x460b74
mov eax, dword [0x4a5168]
mov dword [edi], eax
mov edi, dword [ebx + 0x118]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x460b8a
push 9
pop ecx
mov esi, str.Content_Transfer_Encoding:_base64_r_n
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebx + 0x118]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x460ba3
push 0xb
pop ecx
mov esi, str.Content_Disposition:_attachment__filename_
rep movsd dword es:[edi], dword [esi]
push ecx
push ecx
push dword [ebp - 0x18]
lea ecx, [ebx + 0x14c]
call fcn.00463e41
mov ecx, eax
call fcn.00463f66
mov edx, dword [ebp - 0x20]
inc edx
add edx, eax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x460bd4
mov edi, dword [ebx + 0x118]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x460be4
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x118]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x460c01
mov eax, dword [0x4a5168]
mov dword [edi], eax
mov ecx, dword [ebx + 0x118]
dec ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x460c17
mov ax, word [0x4a51bc]
push dword [ebp - 0x28]
mov word [ecx], ax
mov al, byte [0x4a51be]
mov byte [ecx + 2], al
mov ecx, ebx
call fcn.00462e88
push 0x4a50f0
push dword [ebp - 0x20]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
mov dword [ebp - 0x60], esi
pop ecx
pop ecx
test esi, esi
jne 0x460c6c
push 0x194
lea ecx, [ebp - 0x54]
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x460ecb
xor edi, edi
push esi
mov dword [ebp - 0x30], edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
pop ecx
jmp 0x460c9a
push esi
push 0x36
pop eax
push eax
push 1
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add edi, eax
push esi
mov dword [ebp - 0x30], edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
add esp, 0x14
test eax, eax
je 0x460c7b
mov eax, dword [ebp - 0x2c]
add eax, edi
mov dword [ebp - 0x2c], eax
and eax, 0xfffffc00
cmp eax, 0x500000
jbe 0x460ccb
push 0x195
lea ecx, [ebp - 0x58]
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x460ecb
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
xor edi, edi
add esp, 0xc
mov dword [ebp - 0x24], edi
xor ecx, ecx
mov eax, dword [ebp - 0x30]
xor edx, edx
div dword [ebp - 0x5c]
mov dword [ebp - 0x34], ecx
inc eax
cmp ecx, eax
jae 0x460e05
push esi
push 0x36
pop eax
push eax
push 1
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, dword [ebp - 0x1c]
add esp, 0x10
mov dword [ebp - 0x64], eax
push eax
test edi, edi
je 0x460d60
lea ecx, [ebp - 0x98]
call fcn.0045f7eb
pop ecx
mov ecx, dword [ebp - 0x14]
or ecx, 1
mov dword [ebp - 0x14], ecx
mov ecx, eax
call fcn.00463fc4
mov edx, eax
mov esi, eax
mov al, byte [edx]
inc edx
test al, al
jne 0x460d32
mov edi, dword [ebx + 0x118]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x460d42
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x60]
mov edi, dword [ebp - 0x24]
jmp 0x460d89
lea ecx, [ebp - 0x80]
call fcn.0045f7eb
pop ecx
mov ecx, dword [ebp - 0x14]
or ecx, 2
mov dword [ebp - 0x14], ecx
mov ecx, eax
call fcn.00463fc4
mov edx, dword [ebx + 0x118]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x460d7f
mov eax, dword [ebp - 0x14]
test al, 2
je 0x460da1
and eax, 0xfffffffd
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x14], eax
call fcn.0045fb55
mov eax, dword [ebp - 0x14]
and dword [ebp - 4], 0
test al, 1
je 0x460dba
and eax, 0xfffffffe
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x14], eax
call fcn.0045fb55
mov ecx, dword [ebx + 0x118]
dec ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x460dc1
mov ax, word [0x4a51bc]
mov word [ecx], ax
mov al, byte [0x4a51be]
mov byte [ecx + 2], al
mov eax, dword [ebp - 0x64]
add eax, 2
add edi, eax
mov dword [ebp - 0x24], edi
cmp edi, 0x1400
jb 0x460dfc
push dword [ebp - 0x28]
xor edi, edi
mov ecx, ebx
mov dword [ebp - 0x24], edi
call fcn.00462e88
mov ecx, dword [ebp - 0x34]
inc ecx
jmp 0x460ce0
test edi, edi
mov edi, dword [ebp - 0x28]
je 0x460e14
push edi
mov ecx, ebx
call fcn.00462e88
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov esi, dword [ebp - 0x18]
pop ecx
inc esi
jmp 0x460ab8
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.mfc140u.dll_operator_1]
call esi
push dword [ebp - 0x20]
call esi
pop ecx
pop ecx
lea ecx, [ebx + 0x14c]
call fcn.00463e4b
test eax, eax
je 0x460e6b
push str.__MESSAGE__ID__54yg6f6h6y456345
push str._r_n___s___r_n
push 0x2800
push dword [ebx + 0x118]
call fcn.00465127
add esp, 0x10
mov ecx, ebx
push edi
call fcn.00462e88
push 0xd
pop ecx
call fcn.00460067
push str._r_n._r_n
push 0x2800
push dword [ebx + 0x118]
mov esi, eax
call fcn.00465127
add esp, 0xc
mov ecx, ebx
push esi
call fcn.00462e88
push esi
mov ecx, ebx
call fcn.0046383f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
push 0x6a
lea ecx, [ebp - 0x38]
call fcn.00460048
push 0x4aedb8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3