Function at 0x402b6a
Capabilities:
Encode data using base64
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 0xc]
push esi
cmp ebx, 2
push edi
jne 0x402b8c
mov eax, dword [0x406c94]
cmp eax, dword [0x406c98]
je 0x402feb
mov esi, ebx
xor edi, edi
and esi, 1
mov ecx, ebx
push edi
push edi
lea eax, [esi + 3]
shr ecx, 1
push eax
and ecx, 1
mov eax, 0x80000000
push edi
shr eax, cl
push 3
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x402dfd
test bl, 2
je 0x402c2e
mov eax, dword [0x406c98]
mov dword [ebp - 0xc], 0xa0d4040
xor ecx, ecx
cmp ecx, 4
mov dl, al
jae 0x402bea
and dl, 0xf
push 0x10
or dl, 0x40
pop esi
mov byte [ebp + ecx - 0x10], dl
cdq
jmp 0x402bf7
and dl, 0x3f
mov esi, 0x100
or byte [ebp + ecx - 0x10], dl
cdq
idiv esi
inc ecx
cmp ecx, 6
jb 0x402bd3
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 0x10]
push 8
push eax
push dword [ebp - 4]
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x406c98]
mov dword [0x406c94], eax
jmp 0x402feb
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 8
mov dword [ebp + 0xc], eax
jb 0x402db5
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 0x10]
push 8
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x10]
and eax, 0xf0f0f0f0
cmp eax, 0x40404040
jne 0x402db5
mov ecx, dword [ebp - 0xc]
mov eax, 0xa0d4040
and ecx, eax
cmp ecx, eax
jne 0x402db5
xor esi, esi
xor edi, edi
xor eax, eax
mov dl, byte [ebp + eax - 0x10]
cmp eax, 4
jae 0x402c9a
and edx, 0xf
mov ecx, edi
shl edx, cl
or esi, edx
add edi, 4
jmp 0x402ca6
and edx, 0x3f
mov ecx, edi
shl edx, cl
or esi, edx
add edi, 8
inc eax
cmp eax, 6
jb 0x402c83
test esi, esi
mov dword [ebp - 8], eax
mov dword [0x406c94], esi
mov dword [0x406c98], esi
jne 0x402cc9
mov dword [0x406c98], 0x135
mov eax, 0x406a58
cmp dword [ebp + 8], eax
je 0x402ce1
push 0x40
push dword [ebp + 8]
push eax
call fcn.00403e07
add esp, 0xc
mov eax, dword [0x406cc4]
test eax, eax
je 0x402cf6
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [0x406cc4], eax
push dword [0x406ccc]
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov esi, eax
test esi, esi
mov dword [ebp + 8], esi
jle 0x402d28
lea eax, [esi - 1]
push 0x400
push eax
push dword [0x406ccc]
call dword [sym.imp.USER32.dll_RemoveMenu]
dec esi
test esi, esi
jg 0x402d0b
mov dword [ebp + 8], esi
cmp dword [ebp + 0xc], 0x10
jbe 0x402f94
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [0x406c90], ebx
mov dword [0x406410], 0x202e2f26
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebx
mov dword [0x406cc4], eax
je 0x402f94
lea ecx, [ebp + 0xc]
push ebx
push ecx
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff8
push ecx
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402f94
mov ecx, dword [0x406cc4]
mov eax, dword [ebp + 0xc]
mov dword [ecx + eax], 0x3d0a0a0d
mov eax, dword [ebp + 0xc]
mov dword [ecx + eax + 4], 0xa0a
mov al, byte [ecx]
test al, al
je 0x402f94
cmp al, 0x3b
mov edi, ecx
je 0x402f86
mov al, byte [edi]
cmp al, 0x20
je 0x402db2
cmp al, 9
jne 0x402e05
inc edi
jmp 0x402da8
cmp esi, edi
jne 0x402cbf
push 0x1e
push 0x406022
push 0x40
mov dword [0x406514], 0x9334d2f
push dword [ebp + 8]
push 0x406518
call fcn.00403e07
add esp, 0xc
push eax
call fcn.00403e07
push edi
push 0x406514
call fcn.00402ff2
add esp, 0x14
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x402fed
cmp byte [edi], 0x2a
jne 0x402e14
cmp byte [edi + 1], 0x30
jl 0x402e14
inc edi
inc edi
jmp 0x402da8
cmp byte [edi], 0xa
je 0x402e1c
inc edi
jmp 0x402e14
cmp byte [edi - 1], 0xd
jne 0x402e26
and byte [edi - 1], 0
mov al, byte [ecx]
test al, al
je 0x402ec9
cmp al, 0xa
je 0x402ec9
cmp al, 0x2d
jne 0x402e5f
cmp byte [ecx + 1], 0xd
ja 0x402e5f
push 0
push 0x803f
push 0x800
push dword [0x406ccc]
call dword [sym.imp.USER32.dll_AppendMenuA]
jmp 0x402f8c
cmp al, 0x3d
jne 0x402e8e
mov al, byte [ecx + 1]
cmp al, 0xd
ja 0x402e8e
cmp ebx, 3
je 0x402e78
cmp ebx, 4
jne 0x402f8c
and dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x18]
push 7
mov dword [ebp - 0x14], ecx
test al, al
pop ebx
je 0x402ed2
jmp 0x402f8c
test bl, 1
mov eax, ebx
jne 0x402eaa
push 4
or ebx, 1
cdq
pop esi
idiv esi
and byte [edi], 0
mov dword [ebp + eax*4 - 0x20], ecx
jmp 0x402f8c
and eax, 3
cmp al, 1
jne 0x402f8c
mov eax, ebx
push 4
cdq
pop esi
idiv esi
or ebx, 2
mov dword [ebp + eax*4 - 0x18], ecx
jmp 0x402f8c
cmp ebx, 7
jne 0x402f80
mov ebx, dword [ebp + 8]
cmp ebx, 9
mov al, bl
jg 0x402ee0
add al, 0x30
jmp 0x402ee2
add al, 0x37
xor ecx, ecx
mov byte [0x406411], al
mov eax, 0x406414
mov dword [ebp - 8], ecx
mov edx, dword [ebp + ecx*4 - 0x18]
lea esi, [ecx + ebx*2]
mov dword [esi*4 + 0x406b68], edx
mov esi, dword [ebp + ecx*4 - 0x20]
test esi, esi
je 0x402f4f
cmp dword [esi], 0x74537441
jne 0x402f1e
cmp dword [esi + 4], 0x747261
jne 0x402f1e
mov dword [0x406c8c], edx
cmp dword [esi], 0x516e6957
jne 0x402f35
cmp dword [esi + 4], 0x746975
jne 0x402f35
mov dword [0x406c90], edx
test ecx, ecx
je 0x402f40
mov word [eax], 0x2009
inc eax
inc eax
push 0xb
push esi
push eax
call fcn.00403e07
mov ecx, dword [ebp - 8]
add esp, 0xc
inc ecx
cmp ecx, 1
mov dword [ebp - 8], ecx
jbe 0x402ef1
lea eax, [ebx + 0x8040]
push 0x406410
push eax
push 0
push dword [0x406ccc]
call dword [sym.imp.USER32.dll_AppendMenuA]
add ebx, eax
cmp ebx, 0x24
mov dword [ebp + 8], ebx
jge 0x402f94
xor ebx, ebx
jmp 0x402f8c
inc ebx
and ebx, 0xc
jmp 0x402f8c
inc edi
cmp byte [edi], 0xa
jne 0x402f86
lea ecx, [edi + 1]
jmp 0x402d94
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movsx ecx, byte [0x406c9a]
mov eax, dword [ebp + 8]
cmp ecx, eax
jl 0x402fb2
and byte [0x406c9a], 0
movsx ecx, byte [0x406c9b]
cmp ecx, eax
jl 0x402fc4
and byte [0x406c9b], 0
test eax, eax
mov dword [0x406c9c], eax
jne 0x402fed
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x2e414e
push eax
push 0x803f
push 1
push dword [0x406ccc]
call dword [sym.imp.USER32.dll_AppendMenuA]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret