joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a55d0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
jmp 0x4a55e8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x4a5629
mov dword [0x2c59334], 0x8e46a6f0
cmp dword [0x2c596cc], 0x3dc
jne 0x4a5627
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
jmp 0x4a55df
mov dword [ebp - 0x10], 0
jmp 0x4a563b
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x4a56d6
cmp dword [0x2c596cc], 0xa5f
jne 0x4a565c
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [ebp - 0x10], 0x84620b
jne 0x4a5681
mov eax, dword [0x4b2bf0]
mov dword [0x2c596cc], eax
mov ecx, dword [0x2c596cc]
add ecx, 0xa231
mov dword [0x2c596cc], ecx
cmp dword [0x2c596cc], 0x141
jne 0x4a56d1
xor edx, edx
mov word [ebp - 0x24], dx
xor eax, eax
mov word [ebp - 0x22], ax
xor ecx, ecx
mov word [ebp - 0x20], cx
xor edx, edx
mov word [ebp - 0x1e], dx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputA]
mov dword [0x4b41b8], 0xec58acac
mov dword [0x4b41bc], 0xffffffff
jmp 0x4a5632
call fcn.004a5380
jmp dword [0x2c5724c]
Function at 0x40107e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax]
mov eax, dword [0x46b5c8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x46b5cc]
xor ecx, ecx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ecx
call fcn.00401077
mov eax, dword [0x46b5d0]
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x46b5d4]
add ebx, 0x23f
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0x20
jmp 0x4010d0
xor ecx, ecx
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov eax, edi
shl eax, 4
cmp dword [0x47a80c], 0xc
mov dword [ebp - 4], eax
jne 0x4010fa
push ecx
lea eax, [ebp - 0x2c]
push eax
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
mov eax, dword [0x47a80c]
cmp eax, 0xfa9
jne 0x401116
mov dword [0x47a808], 0xedeb2e40
cmp eax, 0x3eb
jne 0x401137
push str.Zofuti
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and dword [0x47a760], 0
mov ecx, dword [ebp - 8]
and dword [ebp - 0x10], 0
mov edx, edi
lea eax, [ebx + edi]
shr edx, cl
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [0x47a804], 0xf4ea3dee
add edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor eax, edx
sub esi, eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov edx, esi
shr edx, cl
lea eax, [ebx + esi]
mov dword [ebp - 0x14], eax
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor dword [ebp - 4], edx
sub edi, dword [ebp - 4]
add ebx, 0x61c88647
dec dword [ebp - 0x18]
jne 0x4010ce
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
pop esi
pop ebx
leave
ret 4
Function at 0x40802f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46ad70]
jne 0x408039
repz ret
jmp fcn.0040c312

Function at 0x40a7c8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404be7
and dword [ebp - 4], 0
cmp dword [0x46f7f8], 0
mov ebx, eax
jne 0x40a879
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a92a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a92a
push eax
call fcn.00404b75
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x46f7f8], eax
call esi
push eax
call fcn.00404b75
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x46f7fc], eax
call esi
push eax
call fcn.00404b75
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x46f800], eax
call esi
push eax
call fcn.00404b75
pop ecx
mov dword [0x46f808], eax
test eax, eax
je 0x40a879
push 0x466f18
push edi
call esi
push eax
call fcn.00404b75
pop ecx
mov dword [0x46f804], eax
mov eax, dword [0x46f804]
cmp eax, ebx
je 0x40a8d1
cmp dword [0x46f808], ebx
je 0x40a8d1
push eax
call fcn.00404bf0
push dword [0x46f808]
mov esi, eax
call fcn.00404bf0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a8d1
test edi, edi
je 0x40a8d1
call esi
test eax, eax
je 0x40a8c8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a8c8
test byte [ebp - 0xc], 1
jne 0x40a8d1
or dword [ebp + 0x10], 0x200000
jmp 0x40a90a
mov eax, dword [0x46f7fc]
cmp eax, ebx
je 0x40a90a
push eax
call fcn.00404bf0
pop ecx
test eax, eax
je 0x40a90a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a90a
mov eax, dword [0x46f800]
cmp eax, ebx
je 0x40a90a
push eax
call fcn.00404bf0
pop ecx
test eax, eax
je 0x40a90a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46f7f8]
call fcn.00404bf0
pop ecx
test eax, eax
je 0x40a92a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a92c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404b24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x404b33
pop dword [ebp - 0x44]
mov eax, 0x404b33
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xcc8a10f9
add dword [ebp - 0x54], 0x81c83452
mov dword [ebp - 0x50], 0x859fd40c
sub dword [ebp - 0x50], 0x536c87c7
mov dword [ebp - 0x4c], 0x34290a8a
add dword [ebp - 0x4c], 0x182339a4
mov dword [ebp - 0x48], 0xd6822560
add dword [ebp - 0x48], 0x297ddaa0
lea eax, [ebp - 0x54]
push eax
mov eax, 0x42e32ab6
sub eax, 0x42a0fa42
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xc2a56260
add dword [ebp - 0x54], 0xb1cd06f6
mov dword [ebp - 0x50], 0x6fc5a99f
add dword [ebp - 0x50], 0xd1a6b7d6
mov dword [ebp - 0x4c], 0xbca0dd23
sub dword [ebp - 0x4c], 0x593170b7
mov dword [ebp - 0x48], 0xd123ad6c
sub dword [ebp - 0x48], 0xd123ad6c
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x28a4af2c
add eax, 0xd79d81f8
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3bfb0
push 0
call eax
mov ecx, 0x4108
xor edi, edi
add edi, eax
mov ebx, 0xcf0b8e87
add ebx, 0x3137b579
add ebx, dword [ebp - 0x44]
mov esi, 0xc15b9c6c
add dword [ebp - 0x40], ecx
mov edx, dword [ebx]
xor dword [ebp - 0x2c], 0x104635ad
xor edx, esi
sub dword [ebp - 0x10], eax
mov dword [edi], edx
sub dword [ebp - 0x24], eax
add edi, 0xa07cedef
sub edi, 0xa07cedeb
add ebx, 0x4ae675fa
sub ebx, 0x4ae675f6
loop 0x404c46
add eax, 0xf6f3
mov ebx, eax
add eax, 0xb645457
add eax, 0xf49babae
mov ecx, 0x30e8fa0e
sub ecx, 0x30a8fa0e
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x2a801bd0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2a919eec]
jne 0x2a801bda
repz ret
jmp fcn.2a85b1d0

Function at 0x2a808482
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x2a808491
pop dword [ebp - 0x28]
mov eax, 0x7ebc929b
add eax, 0xabc3f1f6
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x28332eb
add dword [ebp - 0x38], 0x4bcf1260
mov dword [ebp - 0x34], 0x9926d5f
add dword [ebp - 0x34], 0x28a0dee6
mov dword [ebp - 0x30], 0xfc933c11
add dword [ebp - 0x30], 0x4fb9081d
mov dword [ebp - 0x2c], 0xa628d1ec
sub dword [ebp - 0x2c], 0xa628d1ec
lea eax, [ebp - 0x38]
push eax
mov eax, 0x3bfb899a
sub eax, 0x116e583a
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x2efab8c6
sub dword [ebp - 0x38], 0xba884f70
mov dword [ebp - 0x34], 0xaad2744c
add dword [ebp - 0x34], 0x9699ed29
mov dword [ebp - 0x30], 0x4b53649c
add dword [ebp - 0x30], 0x181c07d0
mov dword [ebp - 0x2c], 0x672cf13c
add dword [ebp - 0x2c], 0x98d30ec4
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x480fc
push 0
call eax
mov ecx, 0x922fd1ea
add ecx, 0x6dd07a24
xor esi, esi
add esi, eax
mov edi, 0xb456e0e3
add edi, 0x763d551d
add edi, dword [ebp - 0x28]
mov edx, 0x6b4e87db
add edx, 0xc1df689b
mov ebx, dword [edi]
add dword [ebp - 0x18], 0xa770d3f4
xor ebx, edx
add dword [ebp - 4], 0xc8a20b3b
mov dword [esi], ebx
sub dword [ebp - 0x18], 0x3516d423
add esi, 0x7e9e86ef
add esi, 0x81617915
add edi, 0x994259a2
sub edi, 0x9942599e
loop 0x2a8085b0
add eax, 0xf946204d
sub eax, 0xf944fd42
xor ebx, ebx
add ebx, eax
add eax, 0xc7948c21
add eax, 0x386b73e4
mov ecx, 0xaac4af8e
add ecx, 0x7fbb5072
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x2a80b1e7
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.kernel32.dll_GetTickCount]
push edi
call esi
mov edi, eax
shr edi, 4
call esi
shr eax, 4
sub eax, edi
cmp eax, 0xc
jbe 0x2a80b1f6
pop edi
pop esi
ret
Function at 0x2a80bbb1
Capabilities:
Read file on windows

Disassembly:
push 0x90
mov eax, 0x2a8cd1ec
call fcn.2a801426
mov ebx, ecx
xor esi, esi
push 0x14
lea eax, [ebp - 0x64]
push esi
push eax
mov dword [ebp - 0x18], esi
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
push esi
push 1
push esi
call dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebx + 8]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ecx + 0x14]
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], ecx
cmp eax, 0xffffffff
jne 0x2a80bc36
push esi
push eax
push str.Failed_to_create_connection
lea ecx, [ebp - 0x50]
call fcn.2a8013d4
mov byte [ebp - 4], 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x38], vtable.RSException.0
call fcn.2a807c17
mov dword [ebp - 0x38], vtable.CMessageException.0
push 0x2a90b57c
lea eax, [ebp - 0x38]
push eax
call sub.MSVCR100.dll__CxxThrowException
mov edi, dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebx + 4]
call dword [sym.imp.kernel32.dll_ReadFile]
cmp eax, esi
jne 0x2a80bd10
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
je 0x2a80bcc0
cmp eax, 0x6d
je 0x2a80bd30
push esi
push 0xffffffffffffffff
push str.Read_Error
lea ecx, [ebp - 0x50]
call fcn.2a8013d4
mov byte [ebp - 4], 3
jmp 0x2a80bc0e
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push 2
call edi
cmp eax, 1
je 0x2a80bcce
push esi
push esi
push esi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
cmp eax, esi
je 0x2a80bcc0
cmp eax, 0xffffffff
je 0x2a80bd10
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push 2
call edi
test eax, eax
jne 0x2a80bc87
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x14]
push eax
push 2
call edi
sub eax, esi
je 0x2a80bcf9
dec eax
jne 0x2a80bc3c
lea ecx, [ebp - 0x80]
call fcn.2a80ba26
push 0x2a90b56c
lea eax, [ebp - 0x80]
jmp 0x2a80bc30
push 1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebx + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
je 0x2a80bd25
push dword [ebp - 0x1c]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a801635
ret 8
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x6d
jne 0x2a80bd4b
lea ecx, [ebp - 0x9c]
call fcn.2a80ba26
push 0x2a90b56c
lea eax, [ebp - 0x9c]
jmp 0x2a80bc30
push esi
push 0xffffffffffffffff
push str.unexpected_error
lea ecx, [ebp - 0x50]
call fcn.2a8013d4
mov byte [ebp - 4], 2
jmp 0x2a80bc0e
Function at 0x2a80bd7f
Capabilities:
Read file on windows

Disassembly:
push 0x90
mov eax, 0x2a8cd22a
call fcn.2a801426
mov edi, ecx
xor esi, esi
push 0x14
lea eax, [ebp - 0x64]
push esi
push eax
mov dword [ebp - 0x10], esi
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
push esi
push 1
push esi
call dword [sym.imp.kernel32.dll_CreateEventA]
mov ebx, eax
mov dword [ebp - 0x38], ebx
mov eax, dword [edi + 8]
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x34], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 4], esi
mov dword [ebp - 0x30], eax
cmp ebx, 0xffffffff
jne 0x2a80be06
push esi
push ebx
push str.Failed_to_create_connection
lea ecx, [ebp - 0x50]
call fcn.2a8013d4
mov byte [ebp - 4], 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], vtable.RSException.0
call fcn.2a807c17
mov dword [ebp - 0x2c], vtable.CMessageException.0
push 0x2a90b57c
lea eax, [ebp - 0x2c]
push eax
call sub.MSVCR100.dll__CxxThrowException
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_ReadFile]
cmp eax, esi
jne 0x2a80be77
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x2a80bec3
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x34]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, esi
je 0x2a80be60
dec eax
jne 0x2a80be06
lea ecx, [ebp - 0x9c]
call fcn.2a80ba26
push 0x2a90b56c
lea eax, [ebp - 0x9c]
jmp 0x2a80be00
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
je 0x2a80be8a
or dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a801635
ret 8
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x6d
jne 0x2a80beaa
lea ecx, [ebp - 0x80]
call fcn.2a80ba26
push 0x2a90b56c
lea eax, [ebp - 0x80]
jmp 0x2a80be00
push esi
push 0xffffffffffffffff
push str.unexpected_error
lea ecx, [ebp - 0x50]
call fcn.2a8013d4
mov byte [ebp - 4], 2
jmp 0x2a80bdde
cmp eax, 0x6d
je 0x2a80be95
push esi
push 0xffffffffffffffff
push str.Read_Error
lea ecx, [ebp - 0x50]
call fcn.2a8013d4
mov byte [ebp - 4], 3
jmp 0x2a80bdde
Function at 0x2a80bee1
Capabilities:
Write file on windows

Disassembly:
push 0x74
mov eax, 0x2a8cd260
call fcn.2a801426
mov edi, ecx
cmp dword [edi + 4], 0xffffffff
jne 0x2a80bf0b
lea ecx, [ebp - 0x80]
call fcn.2a80ba26
push 0x2a90b56c
lea eax, [ebp - 0x80]
push eax
call sub.MSVCR100.dll__CxxThrowException
xor esi, esi
push 0x14
lea eax, [ebp - 0x30]
push esi
push eax
mov dword [ebp - 0x10], esi
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
push esi
push 1
push esi
call dword [sym.imp.kernel32.dll_CreateEventA]
mov ebx, eax
mov dword [ebp - 0x14], ebx
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], eax
cmp ebx, 0xffffffff
jne 0x2a80bf7d
push esi
push ebx
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a8013d4
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x64], vtable.RSException.0
call fcn.2a807c17
mov dword [ebp - 0x64], vtable.CMessageException.0
push 0x2a90b57c
lea eax, [ebp - 0x64]
jmp 0x2a80bf05
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_WriteFile]
cmp eax, esi
jne 0x2a80bfd3
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x2a80bfe6
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, esi
je 0x2a80bfc0
dec eax
jne 0x2a80bf7d
jmp 0x2a80bef5
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
or dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a801635
ret 8
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
call edi
cmp eax, 0xe8
je 0x2a80bef5
call edi
cmp eax, 0xe9
je 0x2a80bef5
push esi
push 0xffffffffffffffff
push str.Connection_Closed
lea ecx, [ebp - 0x48]
call fcn.2a8013d4
mov byte [ebp - 4], 2
jmp 0x2a80bf59
Function at 0x2a81b719
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [0x2a91fa3c]
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x2a91fa40]
xor edi, edi
and dword [ebp - 4], edi
push str.Cstring
mov dword [ebp - 8], ecx
call dword [eax + 0x14]
movzx eax, ax
pop ecx
push eax
push dword [ebp + 8]
mov eax, dword [0x2a91fa3c]
call dword [eax + 0x54]
push eax
call dword [esi + 0x168]
push dword [ebp - 4]
mov eax, dword [0x2a91fa3c]
call dword [eax + 0x170]
add esp, 0x14
test eax, eax
je 0x2a81b7db
test byte [ebp + 0xc], 1
je 0x2a81b7c3
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x2a81b791
xor edi, edi
test edi, edi
je 0x2a81b7c3
lea eax, [ebp + 8]
push eax
push edi
call dword [sym.imp.kernel32.dll_GetFileSize]
mov edx, dword [ebp + 8]
xor ecx, ecx
xor esi, esi
or ecx, eax
or edx, esi
mov dword [ebp - 0xc], edx
ja 0x2a81b7b8
cmp ecx, 0x7fffffff
jbe 0x2a81b7c3
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
push edi
call dword [eax + 8]
xor edi, edi
mov eax, dword [0x2a91fa3c]
push dword [ebp - 4]
lea esi, [eax + 0x16c]
call dword [eax + 0x54]
push eax
call dword [esi]
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
leave
ret 8
Function at 0x2a81bccd
Capabilities:
Encode data using base64

Disassembly:
push 0x10
mov eax, 0x2a8ce50c
call fcn.2a801426
xor esi, esi
mov dword [ebp - 0x18], esi
mov edi, dword [ebp + 8]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], esi
mov byte [edi], 0
xor eax, eax
inc eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], eax
test byte [0x2a91fae8], al
jne 0x2a81bd2a
or dword [0x2a91fae8], eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xb]
push eax
push 0x2a8d3d90
mov ecx, 0x2a91fac8
call fcn.2a808482
push 0x2a8d2ef5
call fcn.2a808482
pop ecx
mov byte [ebp - 4], 0
cmp dword [ebp + 0x10], esi
je 0x2a81be69
mov eax, dword [ebp + 0xc]
dec dword [ebp + 0x10]
mov al, byte [eax]
mov byte [ebp + esi - 0x10], al
mov bl, byte [ebp - 0xf]
inc esi
inc dword [ebp + 0xc]
cmp esi, 3
jne 0x2a81bdb4
mov al, byte [ebp - 0x10]
shr al, 2
mov byte [ebp - 0x14], al
mov al, byte [ebp - 0x10]
and al, 3
shl al, 4
mov cl, bl
shr cl, 4
add al, cl
mov cl, byte [ebp - 0xe]
mov byte [ebp - 0x13], al
mov al, bl
and al, 0xf
shl al, 2
shr cl, 6
add al, cl
mov byte [ebp - 0x12], al
mov al, byte [ebp - 0xe]
and al, 0x3f
mov byte [ebp - 0x11], al
xor esi, esi
cmp dword [0x2a91fadc], 0x10
mov eax, dword [0x2a91fac8]
jae 0x2a81bd95
mov eax, 0x2a91fac8
movzx ecx, byte [ebp + esi - 0x14]
mov al, byte [ecx + eax]
mov byte [ebp - 0x1c], al
push dword [ebp - 0x1c]
mov ecx, edi
push 1
call fcn.2a808482
inc esi
cmp esi, 4
jl 0x2a81bd82
xor esi, esi
cmp dword [ebp + 0x10], 0
jne 0x2a81bd33
test esi, esi
je 0x2a81be69
cmp esi, 3
jge 0x2a81bde3
push 3
pop ecx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x10]
push 0
push eax
call sub.MSVCR100.dll_memset
mov bl, byte [ebp - 0xf]
add esp, 0xc
mov al, byte [ebp - 0x10]
mov cl, al
shr cl, 2
mov byte [ebp - 0x14], cl
and al, 3
mov cl, bl
shl al, 4
shr cl, 4
add al, cl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0xe]
and bl, 0xf
mov cl, al
shl bl, 2
shr cl, 6
add bl, cl
mov byte [ebp - 0x12], bl
and al, 0x3f
lea ebx, [esi + 1]
xor edi, edi
mov byte [ebp - 0x11], al
test ebx, ebx
jle 0x2a81be4e
cmp dword [0x2a91fadc], 0x10
mov eax, dword [0x2a91fac8]
jae 0x2a81be31
mov eax, 0x2a91fac8
movzx ecx, byte [ebp + edi - 0x14]
mov al, byte [ecx + eax]
mov ecx, dword [ebp + 8]
mov byte [ebp + 0x10], al
push dword [ebp + 0x10]
push 1
call fcn.2a808482
inc edi
cmp edi, ebx
jl 0x2a81be1e
push 3
pop edi
cmp esi, edi
jge 0x2a81be66
sub edi, esi
mov ecx, dword [ebp + 8]
push 0x3d
push 1
call fcn.2a808482
dec edi
jne 0x2a81be57
mov edi, dword [ebp + 8]
mov eax, edi
call fcn.2a801635
ret
Function at 0x2a823dad
Capabilities:
Encode data using base64

Disassembly:
push 8
mov eax, 0x2a8cf87b
call fcn.2a801426
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
cmp dword [eax + 0x14], 0x10
jb 0x2a823dce
mov edx, dword [eax]
mov dword [ebp - 0x10], edx
jmp 0x2a823dd1
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 8]
mov ebx, dword [eax + 0x10]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ecx
mov byte [edi], cl
push ecx
mov eax, ebx
shl eax, 2
push 3
mov dword [ebp - 4], ecx
pop ecx
cdq
idiv ecx
mov dword [ebp - 0x14], 1
add eax, ecx
push eax
mov ecx, edi
call fcn.2a808482
cmp dword [edi + 0x14], 0x10
jb 0x2a823e0d
mov esi, dword [edi]
jmp 0x2a823e0f
mov esi, edi
xor eax, eax
test ebx, ebx
jle 0x2a823eb1
mov edx, dword [ebp - 0x10]
movzx ecx, byte [eax + edx]
shr ecx, 2
mov cl, byte [ecx + 0x2a8d3d90]
mov byte [esi], cl
mov cl, byte [eax + edx]
and cl, 3
shl cl, 4
inc eax
cmp eax, ebx
jge 0x2a823e44
mov dl, byte [eax + edx]
shr dl, 4
or cl, dl
mov edx, dword [ebp - 0x10]
movzx ecx, cl
mov cl, byte [ecx + 0x2a8d3d90]
mov byte [esi + 1], cl
cmp eax, ebx
jge 0x2a823e86
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 0x10
jb 0x2a823e5f
mov ecx, dword [ecx]
mov cl, byte [ecx + eax]
and cl, 0xf
shl cl, 2
inc eax
cmp eax, ebx
jge 0x2a823e78
mov dl, byte [eax + edx]
shr dl, 6
or cl, dl
mov edx, dword [ebp - 0x10]
movzx ecx, cl
mov cl, byte [ecx + 0x2a8d3d90]
mov byte [esi + 2], cl
jmp 0x2a823e8a
mov byte [esi + 2], 0x3d
add esi, 3
cmp eax, ebx
jge 0x2a823ea4
mov cl, byte [eax + edx]
and cl, 0x3f
movzx ecx, cl
mov cl, byte [ecx + 0x2a8d3d90]
mov byte [esi], cl
jmp 0x2a823ea7
mov byte [esi], 0x3d
inc esi
inc eax
cmp eax, ebx
jl 0x2a823e19
cmp dword [edi + 0x14], 0x10
jb 0x2a823ebb
mov eax, dword [edi]
jmp 0x2a823ebd
mov eax, edi
push 0
sub esi, eax
push esi
mov ecx, edi
call fcn.2a808482
mov eax, edi
call fcn.2a801635
ret

Function at 0x2a827011
Capabilities:
Get hostname

Disassembly:
push 0x45c
mov eax, 0x2a8cfea0
call fcn.2a85a9c0
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x3ff
lea eax, [ebp - 0x40f]
push ebx
mov dword [ebp - 0x464], ebx
push eax
mov byte [ebp - 0x410], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x400
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x2a8270ae
push 0x8f
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x468], ebx
mov dword [ebp - 0x464], ebx
call fcn.2a808482
lea eax, [ebp - 0x45c]
push eax
lea ecx, [ebp - 0x468]
mov dword [ebp - 4], ebx
call fcn.2a81bf9d
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 1
call fcn.2a81bb58
push 0x2a90d9a8
lea eax, [ebp - 0x43c]
push eax
call sub.MSVCR100.dll__CxxThrowException
lea eax, [ebp - 0x45d]
push eax
lea eax, [ebp - 0x410]
push eax
mov ecx, esi
call fcn.2a808482
mov eax, esi
call fcn.2a85aa2f
ret