joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cab0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x43cac7
add esp, 0xfffffff0
call fcn.0040305c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00411b50
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40bc60]
call fcn.00402d44
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x40bc60]
call fcn.00402d44
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x41374c]
call fcn.00419174
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x43cc3c
mov eax, dword [0x440a40]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00419544
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x43e638
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x440a40]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.004097c0
test eax, eax
je 0x43cbba
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00407e48
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.004097e8
test eax, eax
je 0x43cbce
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403c14
mov eax, dword [0x44096c]
cmp byte [eax], 0
jne 0x43cbff
mov eax, ebx
call fcn.0043cd28
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x43cc31
call fcn.004030b4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43cf98
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4417c8]
cmp dword [eax + 0x24], 0
je 0x43d03b
cmp dword [ebx + 0x84], 0
jne 0x43d035
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x43cf28
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x43d035
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x43cffe
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x43d035
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.0040d324
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x43d00d
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x43da48
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x43da7d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403acc
jmp 0x43da87
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403a38
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x43e9ac
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x43e9e4
mov eax, esi
call fcn.004266a8
test al, al
je 0x43e9e4
mov eax, dword [ebx + 0x74]
call fcn.004263ac
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43e9e4
push 0
mov eax, dword [ebx + 0x74]
call fcn.004263ac
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x2a846d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x2a846e6a
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x2a846dfd
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.2a846540
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x2a846dc3
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x2a846f33
call fcn.2a846e0f
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x2a846eca
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.2a846960
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x2a846e7b
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x2a846f33
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.2a846960
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x2a846f2e
jmp 0x2a846f33
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x2a853aca
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
call dword [sym.imp.kernel32.dll_GetTickCount]
mov esi, eax
shr esi, 4
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
sub eax, esi
cmp eax, 0xc
jbe 0x2a853ad6
pop esi
ret
Function at 0x2a854792
Capabilities:
Check if file exists

Disassembly:
push 0x64
mov eax, 0x2a9817de
call fcn.2a84a756
mov ebx, ecx
cmp dword [ebx + 4], 0xffffffff
jne 0x2a8548d3
push 0xffffffffffffffff
lea edi, [ebx + 0xc]
push 0x2a98a1b4
mov ecx, edi
call fcn.2a88034f
mov eax, dword [ebx]
push 0
push 0xffffffffffffffff
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2a9874b0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x54]
call fcn.2a84a704
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
mov ecx, edi
call fcn.2a8c803d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.2a84cb0c
lea ecx, [ebp - 0x4c]
call fcn.2a84cb2e
push edi
lea ecx, [ebp - 0x3c]
call fcn.2a850168
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.2a8c886a
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
call fcn.2a8c9159
mov esi, eax
mov dword [ebp - 0x18], vtable.RSSecurityUtilsWin::CLocalFreeGuard.0
pop ecx
mov dword [ebp - 0x14], esi
mov ecx, dword [ebx + 8]
xor edi, edi
mov byte [ebp - 4], 3
cmp dword [ecx], edi
jne 0x2a854898
lea ecx, [ebp - 0x3c]
call fcn.2a8c886a
push edi
push 0x40110000
push 3
lea ecx, [ebp - 0x24]
push ecx
push edi
push 0xc0000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
jne 0x2a854898
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x2a8548ef
cmp eax, 0xe7
jne 0x2a8548d9
lea ecx, [ebp - 0x3c]
call fcn.2a8c886a
push 0x4e20
push eax
call dword [sym.imp.kernel32.dll_WaitNamedPipeA]
test eax, eax
je 0x2a8548fe
mov eax, dword [ebx + 8]
cmp dword [eax], edi
je 0x2a85483e
cmp dword [ebx + 4], 0xffffffff
je 0x2a8548b4
push edi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 2
push eax
push dword [ebx + 4]
call dword [sym.imp.kernel32.dll_SetNamedPipeHandleState]
mov byte [ebp - 4], 6
test esi, esi
je 0x2a8548c3
push esi
call dword [sym.imp.kernel32.dll_LocalFree]
lea ecx, [ebp - 0x2c]
call fcn.2a84cb0c
lea ecx, [ebp - 0x34]
call fcn.2a84cb2e
call fcn.2a84a9ee
ret
push edi
push 0xffffffffffffffff
push str.Problem_Opening_channel
lea ecx, [ebp - 0x54]
call fcn.2a84a704
mov byte [ebp - 4], 4
jmp 0x2a854912
lea ecx, [ebp - 0x70]
call fcn.2a8544ff
push 0x2a9ef2e0
jmp 0x2a854923
push edi
push 0xffffffffffffffff
push str.Problem_Opening_channel__all_pipe_instances_are_busy
lea ecx, [ebp - 0x54]
call fcn.2a84a704
mov byte [ebp - 4], 5
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x70]
call fcn.2a88034f
push 0x2a9ef338
lea eax, [ebp - 0x70]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a854c0d
Capabilities:
Read file on windows

Disassembly:
push 0x74
mov eax, 0x2a98184c
call fcn.2a84a756
mov edi, ecx
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
je 0x2a854d8d
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x2a854d77
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
je 0x2a854cf9
cmp eax, 0x6d
je 0x2a854d27
push ebx
push 0xffffffffffffffff
push str.Read_Error
lea ecx, [ebp - 0x48]
call fcn.2a84a704
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x80]
call fcn.2a88034f
push 0x2a9ef338
lea eax, [ebp - 0x80]
jmp 0x2a854db5
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
cmp eax, 1
je 0x2a854d0b
push ebx
push ebx
push ebx
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x2a854cf9
cmp eax, 0xffffffff
je 0x2a854d36
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x2a854cbc
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, ebx
je 0x2a854d3f
sub eax, 1
jne 0x2a854c5a
lea ecx, [ebp - 0x64]
call fcn.2a85441f
push 0x2a9ef354
jmp 0x2a854db2
mov dword [ebp - 4], 2
jmp 0x2a854d7e
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
jne 0x2a854d77
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x6d
je 0x2a854d27
push ebx
push 0xffffffffffffffff
push str.unexpected_error
lea ecx, [ebp - 0x48]
call fcn.2a84a704
mov byte [ebp - 4], 3
jmp 0x2a854da1
mov dword [ebp - 4], 5
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a84a9ee
ret 8
push ebx
push 0xffffffffffffffff
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a84a704
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.2a88034f
push 0x2a9ef338
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a854dbc
Capabilities:
Read file on windows

Disassembly:
push 0x58
mov eax, 0x2a98188a
call fcn.2a84a756
mov edi, ecx
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
je 0x2a854ec8
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x2a854eb2
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x2a854e97
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, ebx
je 0x2a854e5f
sub eax, 1
jne 0x2a854e09
lea ecx, [ebp - 0x64]
call fcn.2a85441f
push 0x2a9ef354
jmp 0x2a854eed
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
jne 0x2a854eb2
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x6d
je 0x2a854e4d
push ebx
push 0xffffffffffffffff
push str.unexpected_error
lea ecx, [ebp - 0x48]
call fcn.2a84a704
mov byte [ebp - 4], 2
jmp 0x2a854edc
cmp eax, 0x6d
je 0x2a854e4d
push ebx
push 0xffffffffffffffff
push str.Read_Error
lea ecx, [ebp - 0x48]
call fcn.2a84a704
mov byte [ebp - 4], 3
jmp 0x2a854edc
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a84a9ee
ret 8
push ebx
push 0xffffffffffffffff
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a84a704
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.2a88034f
push 0x2a9ef338
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a854ef7
Capabilities:
Write file on windows

Disassembly:
push 0x74
mov eax, 0x2a9818bd
call fcn.2a84a756
mov edi, ecx
cmp dword [edi + 4], 0xffffffff
je 0x2a855031
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
jne 0x2a854f73
push ebx
push esi
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a84a704
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x64]
call fcn.2a88034f
push 0x2a9ef338
jmp 0x2a85503e
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x2a854fc8
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x2a854fde
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, ebx
je 0x2a854fb5
sub eax, 1
jne 0x2a854f73
jmp 0x2a855031
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
push esi
mov dword [ebp - 4], 3
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a84a9ee
ret 8
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xe8
je 0x2a855022
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xe9
je 0x2a855022
push ebx
push 0xffffffffffffffff
push str.Connection_Closed
lea ecx, [ebp - 0x48]
call fcn.2a84a704
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x80]
call fcn.2a88034f
push 0x2a9ef338
lea eax, [ebp - 0x80]
jmp 0x2a855041
lea ecx, [ebp - 0x80]
call fcn.2a85441f
push 0x2a9ef354
jmp 0x2a85501d
lea ecx, [ebp - 0x64]
call fcn.2a85441f
push 0x2a9ef354
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a8699c0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [0x2a9fede8]
lea eax, [ebp - 4]
push eax
mov eax, dword [0x2a9fee0c]
xor ebx, ebx
and dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
push str.Cstring
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x2a9874b0]
call esi
pop ecx
movzx eax, ax
push eax
mov eax, dword [0x2a9fede8]
push dword [ebp + 8]
mov esi, dword [eax + 0x54]
mov ecx, esi
call dword [0x2a9874b0]
call esi
mov esi, dword [edi + 0x168]
mov ecx, esi
push eax
call dword [0x2a9874b0]
call esi
mov eax, dword [0x2a9fede8]
add esp, 0x10
mov esi, dword [eax + 0x170]
mov ecx, esi
push dword [ebp - 4]
call dword [0x2a9874b0]
call esi
pop ecx
test eax, eax
je 0x2a869acd
test byte [ebp + 0xc], 1
je 0x2a869aa2
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push SysReAllocString
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
cmove ebx, eax
test ebx, ebx
je 0x2a869aa2
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetFileSize]
mov ecx, dword [ebp - 8]
xor edx, edx
or edx, eax
or ecx, esi
mov dword [ebp - 0x10], ecx
ja 0x2a869a8b
cmp edx, 0x7fffffff
jbe 0x2a869aa2
mov edi, dword [ebp - 0xc]
push ebx
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x2a9874b0]
mov ecx, edi
call esi
xor ebx, ebx
mov edi, dword [0x2a9fede8]
push dword [ebp - 4]
mov esi, dword [edi + 0x54]
mov ecx, esi
call dword [0x2a9874b0]
call esi
mov esi, dword [edi + 0x16c]
mov ecx, esi
push eax
call dword [0x2a9874b0]
call esi
pop ecx
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x2a86a5e0
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x2a982c35
call fcn.2a84a756
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], 0xf
mov byte [eax], bl
mov eax, dword fs:[0x2c]
xor edi, edi
mov ecx, dword [0x2aa0032c]
inc edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x2a9fee84]
cmp eax, dword [ecx + 4]
jg 0x2a86a794
mov eax, dword [ebp + 0x10]
mov edi, ebx
test eax, eax
je 0x2a86a786
push 3
pop esi
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [ecx]
mov byte [ebp + edi - 0x14], al
inc edi
mov dl, byte [ebp - 0x13]
inc ecx
mov dword [ebp + 0xc], ecx
mov ch, byte [ebp - 0x12]
mov cl, byte [ebp - 0x14]
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp edi, esi
jne 0x2a86a6cf
mov esi, dword [ebp + 8]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
cmp dword [0x2a9fee80], 0x10
mov ecx, 0x2a9fee6c
movzx eax, byte [ebp + edi - 0x18]
cmovae ecx, dword [0x2a9fee6c]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.2a88034f
inc edi
cmp edi, 4
jl 0x2a86a697
mov dl, byte [ebp - 0xd]
mov edi, ebx
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
push 3
pop esi
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x2a86a639
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x2a86a786
mov eax, edi
cmp edi, esi
jge 0x2a86a705
cmp eax, esi
jae 0x2a86a78f
mov byte [ebp + eax - 0x14], bl
inc eax
cmp eax, esi
jl 0x2a86a6ed
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [edi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x2a86a771
mov esi, dword [ebp + 8]
mov edi, eax
cmp dword [0x2a9fee80], 0x10
mov ecx, 0x2a9fee6c
movzx eax, byte [ebp + ebx - 0x18]
cmovae ecx, dword [0x2a9fee6c]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.2a88034f
inc ebx
cmp ebx, edi
jl 0x2a86a742
mov edi, dword [ebp - 0x1c]
push 3
pop esi
cmp edi, esi
jge 0x2a86a786
sub esi, edi
mov ecx, dword [ebp + 8]
push 0x3d
call fcn.2a88034f
sub esi, 1
jne 0x2a86a777
mov eax, dword [ebp + 8]
call fcn.2a84a9ee
ret
call fcn.2a88034f
mov esi, 0x2a9fee84
push esi
call fcn.2a88034f
cmp dword [0x2a9fee84], 0xffffffff
pop ecx
jne 0x2a86a629
lea eax, [ebp - 0xf]
mov dword [ebp - 4], edi
push eax
push 0x2a98a0b0
mov ecx, 0x2a9fee6c
call fcn.2a84e515
push 0x2a986860
call fcn.2a88034f
push esi
mov byte [ebp - 4], bl
call fcn.2a88034f
pop ecx
pop ecx
jmp 0x2a86a629
Function at 0x2a872c57
Capabilities:
Encode data using base64

Disassembly:
push 0x18
mov eax, 0x2a983df4
call fcn.2a84a756
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], esi
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x14], edi
jb 0x2a872c7f
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 0xf
mov dword [ebp - 0x10], eax
mov byte [esi], cl
push ecx
shl eax, 2
push 3
mov dword [ebp - 4], ecx
pop ecx
cdq
idiv ecx
mov dword [ebp - 0x18], 1
add eax, ecx
mov ecx, esi
push eax
call fcn.2a88034f
mov ebx, dword [esi + 0x14]
mov ecx, esi
cmp ebx, 0x10
jb 0x2a872cbb
mov ecx, dword [esi]
xor edx, edx
cmp dword [ebp - 0x10], edx
jle 0x2a872d71
mov esi, dword [ebp - 0x14]
movzx eax, byte [esi + edx]
shr eax, 2
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], ecx
mov al, byte [eax + 0x2a98b938]
mov byte [ecx], al
inc ecx
mov bl, byte [esi + edx]
and bl, 3
shl bl, 4
inc edx
cmp edx, dword [ebp - 0x10]
jge 0x2a872cf9
mov al, byte [esi + edx]
shr al, 4
or bl, al
movzx eax, bl
mov ebx, dword [ebp - 0x10]
mov al, byte [eax + 0x2a98b938]
mov byte [ecx], al
cmp edx, ebx
jge 0x2a872d36
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x2a872d15
mov eax, dword [edi]
mov cl, byte [eax + edx]
and cl, 0xf
shl cl, 2
inc edx
cmp edx, ebx
jge 0x2a872d2b
mov al, byte [esi + edx]
shr al, 6
or cl, al
movzx eax, cl
mov al, byte [eax + 0x2a98b938]
jmp 0x2a872d38
mov al, 0x3d
mov ecx, dword [ebp - 0x14]
mov byte [ecx + 2], al
mov ecx, dword [ebp - 0x1c]
add ecx, 4
cmp edx, ebx
jge 0x2a872d57
movzx eax, byte [esi + edx]
and eax, 0x3f
mov al, byte [eax + 0x2a98b938]
jmp 0x2a872d59
mov al, 0x3d
mov ebx, dword [ebp - 0x20]
inc edx
mov byte [ebx + 3], al
mov ebx, dword [ebp - 0x10]
cmp edx, ebx
jl 0x2a872cc9
mov esi, dword [ebp - 0x24]
mov ebx, dword [esi + 0x14]
mov eax, esi
cmp ebx, 0x10
jb 0x2a872d7a
mov eax, dword [esi]
sub ecx, eax
push 0
push ecx
mov ecx, esi
call fcn.2a88034f
mov eax, esi
call fcn.2a84a9ee
ret

Function at 0x2a875045
Capabilities:
Get hostname

Disassembly:
push 0x44c
mov eax, 0x2a984252
call fcn.2a8c96b3
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x410]
mov edi, 0x400
push edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x410]
push edi
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x2a87509d
lea eax, [ebp - 0x44d]
mov ecx, esi
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.2a84e515
mov eax, esi
call fcn.2a8c9691
ret
push 0x93
lea ecx, [ebp - 0x458]
call fcn.2a88034f
and dword [ebp - 4], 0
lea ecx, [ebp - 0x44c]
push ecx
mov ecx, eax
call fcn.2a86a7dd
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 1
call fcn.2a869d94
push 0x2a9f21f8
lea eax, [ebp - 0x434]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3