joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464d0b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x464da8
push ebx
push esi
call fcn.00464cd4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00464c68
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x464d55
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x464da7
push edi
push eax
call fcn.004618bf
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x464d75
call fcn.0045fec3
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x464da6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00464c68
add esp, 0x20
test eax, eax
jne 0x464d94
push edi
call fcn.0045fec3
jmp 0x464d9c
push ebx
call fcn.0045fec3
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4673ac
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0045ed7e
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x46741b
cmp esi, dword [ebp - 4]
je 0x467416
cmp dword [ebp + 0xc], 0
je 0x467416
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4673f3
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.00466efe
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x46741d
xor eax, eax
inc eax
jmp 0x46741d
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x467482
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x493040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0045ed7e
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0045ed7e
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x4674f9
cmp word [ecx], dx
je 0x4674f9
mov eax, dword [0x477aec]
push edi
dec eax
push eax
push 0x4779d8
call fcn.00467421
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x46756c
cmp word [eax], dx
je 0x46756c
mov eax, dword [edi]
test eax, eax
je 0x46751d
cmp word [eax], dx
je 0x46751d
lea eax, [ebp - 0x10]
push eax
call fcn.00466e04
jmp 0x467526
lea eax, [ebp - 0x10]
push eax
call fcn.00466e9f
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x467596
mov eax, dword [0x4779d4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x4776c8
call fcn.00467421
add esp, 0xc
test al, al
je 0x467596
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x467561
cmp word [eax], di
je 0x467561
lea eax, [ebp - 0x10]
push eax
call fcn.00466e04
pop ecx
jmp 0x467598
lea eax, [ebp - 0x10]
push eax
call fcn.00466e9f
jmp 0x46755e
mov eax, dword [edi]
test eax, eax
je 0x467583
cmp word [eax], dx
je 0x467583
lea eax, [ebp - 0x10]
push eax
call fcn.00466db9
pop ecx
jmp 0x467596
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x467661
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.004672a6
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x467661
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x467661
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x467661
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4675ee
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0046058b
test ebx, ebx
je 0x46765c
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0046058b
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x467661
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x467661
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0045e697
add esp, 0x10
xor eax, eax
inc eax
jmp 0x467663
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044848a
leave
ret
Function at 0x46c955
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0046c8d1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x46cac4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x46cac4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x46ca79
jg 0x46c9b1
test eax, eax
je 0x46ca6f
push 1
push 0x1000
call fcn.0045fe66
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x46c9d4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x46ca66
push 0x8000
push ebx
call fcn.0045b419
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x46c9fd
jg 0x46c9f8
cmp ecx, 0x1000
jb 0x46c9fd
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00461339
add esp, 0x10
cmp eax, 0xffffffff
je 0x46ca42
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x46c9f8
jl 0x46ca29
test ecx, ecx
jne 0x46c9ea
push dword [ebp - 0xc]
push ebx
call fcn.0045b419
push esi
call fcn.0045fec3
add esp, 0xc
xor ebx, ebx
jmp 0x46cad2
cmp byte [edi + 0x24], 0
je 0x46ca59
cmp dword [edi + 0x20], 5
jne 0x46ca59
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x46ca64
mov ebx, dword [edi + 0x18]
jmp 0x46ca66
xor ebx, ebx
push esi
call fcn.0045fec3
pop ecx
jmp 0x46cad2
test ecx, ecx
jg 0x46ca3b
jl 0x46ca79
test eax, eax
jae 0x46ca3b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0045f296
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x46ca99
cmp byte [edi + 0x1c], 0
je 0x46ca3b
jmp 0x46caca
push ebx
call fcn.0046536f
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x46ca3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x46cad2
cmp byte [edi + 0x1c], 0
je 0x46cacf
mov ebx, dword [edi + 0x18]
jmp 0x46cad2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0045f296
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46ddd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46ddfd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46ddfd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x2a80ac41
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x2a80ac50
pop dword [ebp - 0x30]
mov eax, 0xb04415ed
sub eax, 0x85c3699d
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x9856a53b
add dword [ebp - 0x40], 0xb5fba010
mov dword [ebp - 0x3c], 0x63649df8
add dword [ebp - 0x3c], 0xceceae4d
mov dword [ebp - 0x38], 0x567c580a
sub dword [ebp - 0x38], 0xa3013dc
mov dword [ebp - 0x34], 0x17a87f57
sub dword [ebp - 0x34], 0x17a87f57
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xf5ef1258
add dword [ebp - 0x40], 0x7e8356fe
mov dword [ebp - 0x3c], 0x738935f5
add dword [ebp - 0x3c], 0xcde32b80
mov dword [ebp - 0x38], 0x83db1857
add dword [ebp - 0x38], 0xdf945415
mov dword [ebp - 0x34], 0xb808e31a
add dword [ebp - 0x34], 0x47f71ce6
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xd1e76623
sub eax, 0xa76244e7
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x47aec
push 0
call eax
mov ecx, 0x74b05a6f
add ecx, 0x8b4fe378
xor edi, edi
add edi, eax
mov esi, 0x2a87ea00
add esi, dword [ebp - 0x30]
mov ebx, 0xb9cb394e
sub ebx, 0x1b457125
xor dword [ebp - 0x24], 0x75f5cefe
mov edx, dword [esi]
add dword [ebp - 0x18], 0x9741b262
add edx, ebx
mov dword [edi], edx
xor dword [ebp - 0x1c], ecx
add edi, 4
add esi, 4
loop 0x2a80ad69
add eax, 0x302cc967
add eax, 0xcfd42108
mov ebx, eax
add eax, 5
mov ecx, 0x2a800000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x2a80c4de
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
call dword [sym.imp.kernel32.dll_GetTickCount]
mov esi, eax
shr esi, 4
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
sub eax, esi
cmp eax, 0xc
jbe 0x2a80c4ea
pop esi
ret
Function at 0x2a80d252
Capabilities:
Check if file exists

Disassembly:
push 0x64
mov eax, 0x2a84c785
call fcn.2a8015aa
mov ebx, ecx
cmp dword [ebx + 4], 0xffffffff
jne 0x2a80d393
push 0xffffffffffffffff
lea edi, [ebx + 0xc]
push 0x2a853564
mov ecx, edi
call fcn.2a80ac41
mov eax, dword [ebx]
push 0
push 0xffffffffffffffff
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2a8523cc]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x54]
call fcn.2a801558
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
mov ecx, edi
call fcn.2a8492f7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.2a803838
lea ecx, [ebp - 0x4c]
call fcn.2a80385d
push edi
lea ecx, [ebp - 0x3c]
call fcn.2a808c68
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.2a849b38
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
call fcn.2a84a405
mov esi, eax
mov dword [ebp - 0x18], vtable.RSSecurityUtilsWin::CLocalFreeGuard.0
pop ecx
mov dword [ebp - 0x14], esi
mov ecx, dword [ebx + 8]
xor edi, edi
mov byte [ebp - 4], 3
cmp dword [ecx], edi
jne 0x2a80d358
lea ecx, [ebp - 0x3c]
call fcn.2a849b38
push edi
push 0x40110000
push 3
lea ecx, [ebp - 0x24]
push ecx
push edi
push 0xc0000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
jne 0x2a80d358
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x2a80d3af
cmp eax, 0xe7
jne 0x2a80d399
lea ecx, [ebp - 0x3c]
call fcn.2a849b38
push 0x4e20
push eax
call dword [sym.imp.kernel32.dll_WaitNamedPipeA]
test eax, eax
je 0x2a80d3be
mov eax, dword [ebx + 8]
cmp dword [eax], edi
je 0x2a80d2fe
cmp dword [ebx + 4], 0xffffffff
je 0x2a80d374
push edi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 2
push eax
push dword [ebx + 4]
call dword [sym.imp.kernel32.dll_SetNamedPipeHandleState]
mov byte [ebp - 4], 6
test esi, esi
je 0x2a80d383
push esi
call dword [sym.imp.kernel32.dll_LocalFree]
lea ecx, [ebp - 0x2c]
call fcn.2a803838
lea ecx, [ebp - 0x34]
call fcn.2a80385d
call fcn.2a80187a
ret
push edi
push 0xffffffffffffffff
push str.Problem_Opening_channel
lea ecx, [ebp - 0x54]
call fcn.2a801558
mov byte [ebp - 4], 4
jmp 0x2a80d3d2
lea ecx, [ebp - 0x70]
call fcn.2a80cfd1
push 0x2a85afe8
jmp 0x2a80d3e3
push edi
push 0xffffffffffffffff
push str.Problem_Opening_channel__all_pipe_instances_are_busy
lea ecx, [ebp - 0x54]
call fcn.2a801558
mov byte [ebp - 4], 5
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x70]
call fcn.2a80ac41
push 0x2a85b040
lea eax, [ebp - 0x70]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a80d67d
Capabilities:
Read file on windows

Disassembly:
push 0x5c
mov eax, 0x2a84c801
call fcn.2a8015aa
mov edi, ecx
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
je 0x2a80d7e9
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x2a80d7d3
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
je 0x2a80d755
cmp eax, 0x6d
je 0x2a80d783
push ebx
push 0xffffffffffffffff
push str.Read_Error
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 4
jmp 0x2a80d7fd
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
cmp eax, 1
je 0x2a80d767
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x2a80d755
cmp eax, 0xffffffff
je 0x2a80d792
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x2a80d718
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, ebx
je 0x2a80d79b
sub eax, 1
jne 0x2a80d6ca
lea ecx, [ebp - 0x68]
call fcn.2a80ceef
push 0x2a85b05c
jmp 0x2a80d80e
mov dword [ebp - 4], 2
jmp 0x2a80d7da
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
jne 0x2a80d7d3
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x6d
je 0x2a80d783
push ebx
push 0xffffffffffffffff
push str.unexpected_error
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 3
jmp 0x2a80d7fd
mov dword [ebp - 4], 5
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a80187a
ret 8
push ebx
push 0xffffffffffffffff
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x68]
call fcn.2a80ac41
push 0x2a85b040
lea eax, [ebp - 0x68]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a80d818
Capabilities:
Read file on windows

Disassembly:
push 0x58
mov eax, 0x2a84c843
call fcn.2a8015aa
mov edi, ecx
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
je 0x2a80d924
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x2a80d90e
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x2a80d8f3
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, ebx
je 0x2a80d8bb
sub eax, 1
jne 0x2a80d865
lea ecx, [ebp - 0x64]
call fcn.2a80ceef
push 0x2a85b05c
jmp 0x2a80d949
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
jne 0x2a80d90e
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x6d
je 0x2a80d8a9
push ebx
push 0xffffffffffffffff
push str.unexpected_error
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 2
jmp 0x2a80d938
cmp eax, 0x6d
je 0x2a80d8a9
push ebx
push 0xffffffffffffffff
push str.Read_Error
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 3
jmp 0x2a80d938
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a80187a
ret 8
push ebx
push 0xffffffffffffffff
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.2a80ac41
push 0x2a85b040
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a80d983
Capabilities:
Write file on windows

Disassembly:
push 0x74
mov eax, 0x2a84c87d
call fcn.2a8015aa
mov edi, ecx
cmp dword [edi + 4], 0xffffffff
je 0x2a80dabd
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
jne 0x2a80d9ff
push ebx
push esi
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a801558
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x64]
call fcn.2a80ac41
push 0x2a85b040
jmp 0x2a80daca
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x2a80da54
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x2a80da6a
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, ebx
je 0x2a80da41
sub eax, 1
jne 0x2a80d9ff
jmp 0x2a80dabd
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
push esi
mov dword [ebp - 4], 3
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a80187a
ret 8
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xe8
je 0x2a80daae
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xe9
je 0x2a80daae
push ebx
push 0xffffffffffffffff
push str.Connection_Closed
lea ecx, [ebp - 0x48]
call fcn.2a801558
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x80]
call fcn.2a80ac41
push 0x2a85b040
lea eax, [ebp - 0x80]
jmp 0x2a80dacd
lea ecx, [ebp - 0x80]
call fcn.2a80ceef
push 0x2a85b05c
jmp 0x2a80daa9
lea ecx, [ebp - 0x64]
call fcn.2a80ceef
push 0x2a85b05c
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a82cc8b
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x2a84f345
call fcn.2a8015aa
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], edi
cmp dword [edi + 0x14], 0x10
jb 0x2a82ccad
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp + 8]
mov ebx, dword [edi + 0x10]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], esi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 0xf
mov byte [esi], cl
push ecx
mov eax, ebx
mov dword [ebp - 4], ecx
shl eax, 2
push 3
pop ecx
cdq
idiv ecx
mov dword [ebp - 0x1c], 1
add eax, ecx
mov ecx, esi
push eax
call fcn.2a80ac41
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x2a82ccef
mov edx, dword [esi]
xor ecx, ecx
test ebx, ebx
jle 0x2a82cda0
mov esi, dword [ebp - 0x14]
movzx eax, byte [esi + ecx]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
mov bl, byte [esi + ecx]
and bl, 3
shl bl, 4
inc ecx
cmp ecx, dword [ebp - 0x10]
jge 0x2a82cd22
mov al, byte [esi + ecx]
shr al, 4
or bl, al
movzx eax, bl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], al
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jge 0x2a82cd63
cmp dword [edi + 0x14], 0x10
mov ebx, edi
jb 0x2a82cd3f
mov ebx, dword [edi]
mov bl, byte [ebx + ecx]
and bl, 0xf
shl bl, 2
inc ecx
cmp ecx, eax
jge 0x2a82cd55
mov al, byte [esi + ecx]
shr al, 6
or bl, al
movzx eax, bl
mov bl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [ebp - 0x10]
jmp 0x2a82cd65
mov bl, 0x3d
lea esi, [edx + 3]
mov byte [edx + 2], bl
mov dword [ebp - 0x18], esi
mov edx, esi
mov esi, dword [ebp - 0x14]
inc edx
cmp ecx, eax
jge 0x2a82cd8a
movzx eax, byte [esi + ecx]
and eax, 0x3f
mov bl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [ebp - 0x10]
jmp 0x2a82cd8c
mov bl, 0x3d
mov esi, dword [ebp - 0x18]
inc ecx
mov byte [esi], bl
mov esi, dword [ebp - 0x14]
cmp ecx, eax
jl 0x2a82ccfc
mov esi, dword [ebp - 0x20]
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x2a82cdaa
mov eax, dword [esi]
push 0
sub edx, eax
mov ecx, esi
push edx
call fcn.2a80ac41
mov eax, esi
call fcn.2a80187a
ret

Function at 0x2a82f2c5
Capabilities:
Get hostname

Disassembly:
push 0x448
mov eax, 0x2a84f81b
call fcn.2a84a907
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x410]
mov edi, 0x400
mov dword [ebp - 0x450], esi
push edi
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x410]
push edi
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x2a82f329
lea eax, [ebp - 0x410]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov ecx, esi
push eax
mov byte [esi], bl
call fcn.2a805678
mov eax, esi
call fcn.2a84a8e5
ret
push 0x93
lea ecx, [ebp - 0x454]
call fcn.2a80ac41
lea ecx, [ebp - 0x44c]
mov dword [ebp - 4], ebx
push ecx
mov ecx, eax
call fcn.2a827d86
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 1
call fcn.2a821de4
push 0x2a85dc48
lea eax, [ebp - 0x434]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a84a76f
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x2a851e75
call fcn.2a8015aa
mov edi, ecx
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x10
mov dword [ebp - 0x54], esi
call fcn.2a80ac41
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x2a84a7b4
push 0x10
push ebx
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x2a84a7b6
mov esi, ebx
or dword [ebp - 4], 0xffffffff
mov ecx, edi
mov dword [edi + 0x24], esi
call fcn.2a849b77
push dword [edi + 0x24]
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
call fcn.2a80187a
ret