Function at 0x102231e
Capabilities:
Encode data using base64 via winapi
Get file size
Get hostname
Get session user name
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x104a328]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor esi, esi
xor eax, eax
lea edi, [ebp - 0x22c]
push 0x208
mov dword [ebp - 0x230], esi
stosd dword es:[edi], eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x21c], esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x224], esi
cmp ebx, esi
jne 0x10223c3
mov eax, 0x80004003
push eax
push 0x1004ce4
mov dword [ebp - 0x214], eax
push 0xdb
push 0x10047a8
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
jmp 0x102276b
mov eax, dword [ebp + 8]
dec eax
mov dword [ebx], esi
je 0x102265a
dec eax
je 0x10225c3
dec eax
jne 0x10226e5
push 0x105
lea eax, [ebp - 0x210]
push eax
push esi
push esi
call sub.SHELL32.dll_Ordinal_261
cmp eax, esi
mov dword [ebp - 0x214], eax
jge 0x1022407
push eax
push 0x1004ce4
push 0x112
jmp 0x10223aa
push esi
push esi
push 3
push esi
push esi
push 0x80000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x228], ebx
cmp ebx, esi
je 0x1022430
cmp ebx, 0xffffffff
jne 0x102247b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
je 0x1022454
call edi
cmp eax, esi
jle 0x102244c
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x214], eax
jmp 0x102245e
mov dword [ebp - 0x214], 0x80004005
cmp dword [ebp - 0x214], esi
jge 0x102247b
push dword [ebp - 0x214]
push 0x1004ce4
push 0x11d
jmp 0x102270d
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x102249d
push esi
push 0x1004ce4
push 0x11e
jmp 0x1022593
cmp dword [ebp - 0x22c], esi
je 0x10224ba
mov eax, 0x80070057
push eax
push 0x1004ce4
push 0x123
jmp 0x1022707
push dword [ebp - 0x230]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
push esi
lea ecx, [ebp - 0x218]
push ecx
push dword [ebp - 0x230]
mov dword [ebp - 0x220], eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1022500
push esi
push 0x1004ce4
push 0x132
jmp 0x1022593
mov ebx, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
lea eax, [ebp - 0x224]
push eax
push esi
push 1
push dword [ebp - 0x218]
push dword [ebp - 0x220]
call ebx
test eax, eax
je 0x10225b6
mov eax, dword [ebp - 0x224]
cmp eax, esi
je 0x10225b6
add eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov dword [ebp - 0x21c], eax
cmp eax, esi
jne 0x1022560
mov eax, 0x8007000e
push eax
push 0x1004ce4
push 0x14a
jmp 0x1022707
lea ecx, [ebp - 0x224]
push ecx
push eax
push 1
push dword [ebp - 0x218]
push dword [ebp - 0x220]
call ebx
test eax, eax
je 0x1022588
cmp dword [ebp - 0x224], esi
jne 0x10226df
push esi
push 0x1004ce4
push 0x156
push 0x10047a8
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
mov dword [ebp - 0x214], 0x80004005
jmp 0x1022721
push esi
push 0x1004ce4
push 0x143
jmp 0x1022593
push 0x20
push esi
mov dword [ebp - 0x218], 0x10
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x21c], eax
cmp eax, esi
jne 0x1022616
mov eax, 0x8007000e
push eax
push 0x1004ce4
push 0xff
push 0x10047a8
push 0x10018c8
mov ecx, 0x104abe8
mov dword [ebp - 0x214], eax
call fcn.0102f8f0
jmp 0x1022735
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x10226e5
push esi
push 0x1004ce4
push 0x103
push 0x10047a8
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
mov dword [ebp - 0x214], 0x80004005
jmp 0x1022735
push 0x202
mov edi, 0x101
push esi
mov dword [ebp - 0x218], edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x21c], eax
cmp eax, esi
jne 0x1022697
mov eax, 0x8007000e
push eax
push 0x1004ce4
push 0xe6
jmp 0x10225f7
lea ecx, [ebp - 0x218]
push ecx
push eax
push 3
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x10226b2
cmp dword [ebp - 0x218], esi
jne 0x10226e5
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
mov dword [ebp - 0x218], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x10226e5
push esi
push 0x1004ce4
push 0xf0
jmp 0x1022637
mov ebx, dword [ebp - 0x234]
push dword [ebp - 0x21c]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebx], eax
cmp eax, esi
jne 0x1022721
mov eax, 0x8007000e
push eax
push 0x1004ce4
push 0x163
mov dword [ebp - 0x214], eax
push 0x10047a8
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
cmp dword [ebp - 0x228], esi
je 0x1022735
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x21c], esi
je 0x1022753
push dword [ebp - 0x21c]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
cmp dword [ebp - 0x220], esi
je 0x102276b
push dword [ebp - 0x220]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0102da5f
leave
ret 8