Function at 0x7fff25d59bd0
Capabilities:
Encode data using base64
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3a0
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp + 0x340], rax
mov r15d, r8d
mov dword [rbp + 0x24], r8d
xor r8d, r8d
mov qword [rbp + 0x18], rcx
mov dword [rbp + 8], r8d
mov ebx, r9d
mov dword [rbp], ebx
mov r14d, edx
mov rdi, rcx
test rcx, rcx
je 0x7fff25ddfe38
test ebx, ebx
je 0x7fff25d59fd4
test edx, edx
lea eax, [r8 + 0x37]
cmovne eax, edx
mov r14d, eax
test eax, 0xffffffc8
jne 0x7fff25de0132
mov r13d, eax
lea esi, [r8 + 1]
shr r13d, 2
mov edx, r8d
and r13d, esi
mov eax, r8d
test r14b, 0x21
mov dword [rbp + 0x20], r13d
setne al
test r14b, 0x11
setne dl
mov dword [rbp + 8], edx
mov dword [rbp + 4], eax
mov qword [rbp + 0x28], r8
test ebx, ebx
je 0x7fff25d5a018
test r14b, 0x32
je 0x7fff25d59ce0
call fcn.7fff25dc0740
mov rcx, qword [0x7fff25fd2838]
xor r8d, r8d
test rcx, rcx
je 0x7fff25d59ce0
lea rax, [rbp + 0xc]
mov r12d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x120]
mov edi, r14d
mov dword [rsp + 0x20], 0x213
mov r15d, r14d
mov r8d, esi
xor edx, edx
and edi, 0x12
and r15d, 0x22
call qword [sym.imp.ntdll.dll_NtEnumerateValueKey]
nop dword [rax + rax]
cmp eax, 0x8000001a
jne 0x7fff25ddfe42
xor r8d, r8d
mov qword [rbp + 0x28], r8
mov r12d, dword [rbp + 4]
test ebx, ebx
je 0x7fff25d59d61
mov r15d, dword [rbp + 8]
test r12d, r12d
je 0x7fff25d59fc6
call fcn.7fff25dc0598
mov rbx, qword [0x7fff25fd2840]
xor r8d, r8d
test rbx, rbx
je 0x7fff25d59d5e
mov edi, r8d
lea rcx, [rbp + 0x120]
mov r8d, 0x214
xor edx, edx
call sub.ntdll.dll_memset
xor edx, edx
mov rcx, rbx
lea rax, [rbp + 0xc]
mov r8d, esi
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x120]
mov dword [rsp + 0x20], 0x213
call qword [sym.imp.ntdll.dll_NtEnumerateValueKey]
nop dword [rax + rax]
xor r8d, r8d
cmp eax, 0x8000001a
jne 0x7fff25ddffac
mov ebx, dword [rbp]
mov eax, dword [rbp + 8]
or eax, r12d
or eax, r13d
je 0x7fff25d59e65
cmp r8w, word [0x7fff25fd21da]
mov r15d, 0x57
mov dword [rbp + 0x10], r8d
jae 0x7fff25d59e39
mov rdi, r8
mov qword [rbp + 0x30], r8
mov rax, qword [0x7fff25fd21f8]
mov edi, dword [rdi + rax + 4]
test ebx, ebx
je 0x7fff25d59f1f
test edi, edi
js 0x7fff25d59e16
mov r12, qword [0x7fff25fd2200]
mov rbx, qword [rbp + 0x30]
movzx r15d, word [rbx + rax]
lea r13, [r12 + r15*2]
lea rcx, [r13 + 2]
call fcn.7fff25d5b0c4
xor r8d, r8d
test rax, rax
je 0x7fff25d59eed
mov ebx, dword [rax + 0x44]
and ebx, 0x3f
mov eax, edi
shr eax, 0x10
test al, 0xf
mov eax, dword [rbp]
jne 0x7fff25d59f38
cmp edi, 0x40a
je 0x7fff25d59f30
test bl, 0x10
jne 0x7fff25d59e92
cmp edi, 0x7f
je 0x7fff25d59e92
cmp dword [rbp + 4], r8d
jne 0x7fff25d59e9c
mov r15d, 0x57
mov ebx, dword [rbp]
mov rdi, qword [rbp + 0x30]
add dword [rbp + 0x10], esi
add rdi, 8
movzx eax, word [0x7fff25fd21da]
mov qword [rbp + 0x30], rdi
cmp dword [rbp + 0x10], eax
jl 0x7fff25d59d8f
mov r12d, dword [rbp + 4]
mov r14d, dword [rbp]
mov ebx, 0x2000
xor r13d, r13d
mov edx, esi
mov ecx, ebx
call fcn.7fff25d59a7c
test rax, rax
jne 0x7fff25de005c
add ebx, 0x400
cmp ebx, 0x4c00
jbe 0x7fff25d59e45
mov eax, esi
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.7fff25dce640
mov rbx, qword [rsp + 0x3e8]
add rsp, 0x3a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp dword [rbp + 8], r8d
je 0x7fff25d59e0d
test eax, eax
je 0x7fff25d59f47
movzx r9d, word [r12 + r15*2]
lea r8, [r13 + 2]
mov edx, 0x55
lea rcx, [rbp + 0x40]
call fcn.7fff25d59b3c
test eax, eax
jne 0x7fff25de012b
mov r8, qword [rsp + 0x400]
lea rcx, [rbp + 0x40]
mov rax, qword [rbp + 0x18]
mov edx, ebx
call qword [case.0x7fff25dc97c1.0]
cmp eax, esi
jne 0x7fff25d59e65
mov r15d, 0x57
xor r8d, r8d
jmp 0x7fff25d59e13
mov rax, qword [0x7fff25fd21f8]
movzx ecx, word [rbx + rax + 2]
movzx eax, word [0x7fff25fd21e0]
imul ecx, eax
mov rax, qword [0x7fff25fd21e8]
movsxd rcx, ecx
movzx ebx, word [rcx + rax + 0x18]
and ebx, esi
shl ebx, 4
add ebx, 0x11
jmp 0x7fff25d59dd5
cmp edi, 0x1000
je 0x7fff25d59e16
jmp 0x7fff25d59da2
test eax, eax
je 0x7fff25d59df1
cmp dword [rbp + 0x20], r8d
je 0x7fff25d59e0d
jmp 0x7fff25de004e
cmp qword [rbp + 0x28], r8
je 0x7fff25d59f61
mov edx, esi
mov ecx, edi
call sym.KERNELBASE.dll_IsValidLocale
xor r8d, r8d
test eax, eax
je 0x7fff25d59e0d
mov word [rbp + 0x50], r8w
lea rdx, [rbp + 0x4e]
mov r15d, 0x57
mov ecx, edi
shr edi, 4
and ecx, 0xf
cmp ecx, 0xa
sbb ax, ax
and ax, 0xffd9
add ax, r15w
add ax, cx
mov word [rdx], ax
sub rdx, 2
lea rax, [rbp + 0x40]
cmp rdx, rax
jae 0x7fff25d59f70
mov ecx, dword [rbp + 0x24]
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0x40]
call fcn.7fff25dcb9b0
mov rcx, rax
mov rax, qword [rbp + 0x18]
call qword [case.0x7fff25dc97c1.0]
cmp eax, esi
je 0x7fff25d59ee5
jmp 0x7fff25d59e65
test r15d, r15d
jne 0x7fff25d59cf9
jmp 0x7fff25d59d61
lea eax, [rdx - 1]
and eax, edx
test al, 3
sete cl
test edx, 0xfffffff8
sete al
test al, cl
je 0x7fff25de0132
mov eax, r8d
mov r13d, edx
and r13d, 4
mov esi, 1
cmp edx, 4
mov dword [rbp + 0x20], r13d
setne al
mov dword [rbp + 4], eax
test sil, dl
je 0x7fff25d59c70
mov qword [rbp + 0x28], rsi
call sym.KERNELBASE.dll_GetUserDefaultLCID
cmp eax, 0xc00
je 0x7fff25ddff51
xor r8d, r8d
jmp 0x7fff25d59ce4
mov ecx, 0x57
jmp 0x7fff25de0137
xor r8d, r8d
test eax, eax
js 0x7fff25ddff49
mov eax, dword [rbp + 0x130]
lea rcx, [rbp + 0x134]
shr rax, 1
xor edx, edx
mov word [rbp + rax*2 + 0x134], r8w
call sym.KERNELBASE.dll_GetNamedLocaleHashNode
mov r8, rax
test rax, rax
je 0x7fff25ddfeee
mov eax, dword [rax + 0x44]
test al, 2
jne 0x7fff25ddfea0
cmp dword [r8], 0x501
je 0x7fff25ddfea0
cmp dword [r8], 0x5fe
je 0x7fff25ddfea0
cmp dword [r8], 0x901
je 0x7fff25ddfea0
cmp dword [r8], 0x9ff
jne 0x7fff25ddfeee
bt eax, 0x10
jb 0x7fff25ddfeee
mov ebx, eax
and ebx, 0x3f
test al, 0x10
je 0x7fff25ddfeb3
test edi, edi
jmp 0x7fff25ddfeb6
test r15d, r15d
je 0x7fff25ddfeee
mov r8, qword [r8 + 8]
lea rcx, [rbp + 0x40]
mov edx, 0x55
call fcn.7fff25d66630
test eax, eax
jne 0x7fff25ddfeee
mov r8, qword [rsp + 0x400]
lea rcx, [rbp + 0x40]
mov rax, qword [rbp + 0x18]
mov edx, ebx
call qword [case.0x7fff25dc97c1.0]
cmp eax, esi
jne 0x7fff25d59e65
xor edx, edx
lea rcx, [rbp + 0x120]
mov r8d, 0x214
add r12d, esi
call sub.ntdll.dll_memset
mov rcx, qword [0x7fff25fd2838]
lea rax, [rbp + 0xc]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x120]
mov r8d, esi
mov dword [rsp + 0x20], 0x213
mov edx, r12d
call qword [sym.imp.ntdll.dll_NtEnumerateValueKey]
nop dword [rax + rax]
cmp eax, 0x8000001a
jne 0x7fff25ddfe42
mov ebx, dword [rbp]
jmp 0x7fff25d59cdd
mov ebx, dword [rbp]
jmp 0x7fff25d59ce0
xor r9d, r9d
lea r8, str.00000c00
mov edx, 8
test r15d, r15d
je 0x7fff25ddff78
movups xmm0, xmmword [str.00000c00]
mov word [rbp + 0x50], r9w
movdqu xmmword [rbp + 0x40], xmm0
jmp 0x7fff25ddff92
lea rcx, [rbp + 0x40]
movzx eax, word [r8]
sub edx, esi
mov byte [rcx], al
lea r8, [r8 + 2]
add rcx, rsi
test edx, edx
jg 0x7fff25ddff7c
mov byte [rcx], r9b
lea rcx, [rbp + 0x40]
mov rax, rdi
call qword [case.0x7fff25dc97c1.0]
cmp eax, esi
jne 0x7fff25d59e65
jmp 0x7fff25d5a028
test eax, eax
js 0x7fff25d59d5e
mov eax, dword [rbp + 0x130]
lea rcx, [rbp + 0x134]
shr rax, 1
xor edx, edx
mov word [rbp + rax*2 + 0x134], r8w
call sym.KERNELBASE.dll_GetNamedLocaleHashNode
test rax, rax
je 0x7fff25de002a
mov ebx, dword [rax + 0x44]
bt ebx, 0xf
jae 0x7fff25de002a
and ebx, 0x3f
test bl, 0x10
je 0x7fff25ddffef
test r15d, r15d
jmp 0x7fff25ddfff2
test r12d, r12d
je 0x7fff25de002a
mov r8, qword [rax + 8]
lea rcx, [rbp + 0x40]
mov edx, 0x55
call fcn.7fff25d66630
test eax, eax
jne 0x7fff25de002a
mov r8, qword [rsp + 0x400]
lea rcx, [rbp + 0x40]
mov rax, qword [rbp + 0x18]
mov edx, ebx
call qword [case.0x7fff25dc97c1.0]
cmp eax, esi
jne 0x7fff25d59e65
add edi, esi
lea rcx, [rbp + 0x120]
xor edx, edx
mov r8d, 0x214
call sub.ntdll.dll_memset
mov rcx, qword [0x7fff25fd2840]
mov edx, edi
jmp 0x7fff25d59d29
mov ebx, r14d
and ebx, 8
or ebx, 4
jmp 0x7fff25d59e9c
mov edi, dword [rax + 0x44]
test dil, 0x10
jne 0x7fff25de0074
cmp ebx, 0x7f
je 0x7fff25de0074
test r12d, r12d
jne 0x7fff25de007e
jmp 0x7fff25d59e57
cmp dword [rbp + 8], r13d
je 0x7fff25d59e57
bt edi, 0x10
jae 0x7fff25d59e57
test r14d, r14d
je 0x7fff25de00c7
mov r8, qword [rax + 8]
lea rcx, [rbp + 0x40]
mov edx, 0x55
call fcn.7fff25d66630
test eax, eax
jne 0x7fff25de012b
mov r8, qword [rsp + 0x400]
lea rcx, [rbp + 0x40]
mov rax, qword [rbp + 0x18]
and edi, 0x3d
or edi, 2
mov edx, edi
call qword [case.0x7fff25dc97c1.0]
jmp 0x7fff25de011e
mov r8d, ebx
mov word [rbp + 0x50], r13w
lea rdx, [rbp + 0x4e]
mov ecx, r8d
shr r8d, 4
and ecx, 0xf
cmp ecx, 0xa
sbb ax, ax
and ax, 0xffd9
add ax, r15w
add ax, cx
mov word [rdx], ax
sub rdx, 2
lea rax, [rbp + 0x40]
cmp rdx, rax
jae 0x7fff25de00d3
mov ecx, dword [rbp + 0x24]
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0x40]
call fcn.7fff25dcb9b0
mov rcx, rax
mov rax, qword [rbp + 0x18]
call qword [case.0x7fff25dc97c1.0]
cmp eax, esi
jne 0x7fff25d59e65
jmp 0x7fff25d59e57
mov ecx, 0x3f1
jmp 0x7fff25de0137
mov ecx, 0x3ec
call sub.ntdll.dll_RtlSetLastWin32Error
xor eax, eax
jmp 0x7fff25d59e67