Function at 0x18002a070
Capabilities:
Create thread
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov r14, rdx
mov r10, r8
lea edx, [r9 + 0xa]
mov r13d, r9d
mov dword [rsp + 0xe8], edx
mov r8, rcx
cmp r9d, edx
jae 0x18002a443
mov rbx, qword [rsp + 0x88]
lea r12d, [r9 - 0x87]
mov rdi, qword [rsp + 0x88]
lea r11, [0x180000000]
mov esi, dword [rsp + 0xe8]
xor r9d, r9d
mov ebp, dword [rsp + 0xe8]
mov r15d, dword [rsp + 0xe8]
nop dword [rax + rax]
cmp r12d, 0x28
ja case.0x18002a10e.10
movzx eax, byte [r11 + r12 + 0x2a4a8]
mov ecx, dword [r11 + rax*4 + 0x2a47c]
add rcx, r11
jmp rcx
mov eax, 0x112
cmp eax, 0x112
je 0x18002a42f
add eax, 0x35
cmp eax, 0x147
jb 0x18002a115
mov qword [r14 + 0x80], r10
jmp case.0x18002a10e.10
mov rax, qword [r8]
mov rdx, r14
mov qword [rsp + 0x78], rax
mov r8, r10
lea rax, [rsp + 0x70]
mov dword [rsp + 0x70], 1
mov qword [rsp + 0x60], rax
xor ecx, ecx
mov dword [rsp + 0x58], 0x6d
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r9
xor r9d, r9d
call fcn.1800aaf30
mov r10, qword [rsp + 0xe0]
mov edx, dword [rsp + 0xe8]
xor r9d, r9d
lea r11, [0x180000000]
inc r13d
inc r12d
cmp r13d, edx
jae 0x18002a443
mov r8, qword [rsp + 0xd0]
jmp 0x18002a0f0
mov r11, qword [rsp + 0x80]
xor r9d, r9d
test r11, r11
je 0x18002a2ab
lea rcx, [r11 - 1]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
inc rdx
lea r9, [rdx + rdx*2]
nop dword [rax]
nop word [rax + rax]
mov r8d, 0xa3
mov eax, r8d
sub eax, 0xa2
je 0x18002a24f
cmp eax, 1
jne 0x18002a28a
mov rax, qword [0x180131aa8]
movzx ecx, byte [rdi]
shr rcx, 2
movzx ecx, byte [rcx + rax]
mov byte [rbx], cl
movzx ecx, byte [rdi]
movzx eax, byte [rdi + 1]
and ecx, 3
shl ecx, 4
shr eax, 4
add ecx, eax
mov rax, qword [0x180131aa8]
movzx ecx, byte [rcx + rax]
mov byte [rbx + 1], cl
add rbx, 2
jmp 0x18002a28a
movzx ecx, byte [rdi + 1]
movzx eax, byte [rdi + 2]
and ecx, 0xf
shr eax, 6
lea ecx, [rax + rcx*4]
mov rax, qword [0x180131aa8]
movzx ecx, byte [rcx + rax]
mov byte [rbx], cl
movzx ecx, byte [rdi + 2]
mov rax, qword [0x180131aa8]
and ecx, 0x3f
movzx ecx, byte [rcx + rax]
mov byte [rbx + 1], cl
add rbx, 2
add rdi, 3
dec r8d
cmp r8d, 0xa1
ja 0x18002a206
sub rdx, 1
jne 0x18002a200
mov edx, dword [rsp + 0xe8]
cmp r9, qword [r14 + 0x10]
jae 0x18002a19c
mov r8d, 0xe2
nop dword [rax + rax]
mov eax, r8d
sub eax, 0xe2
je 0x18002a363
sub eax, 0x17
je 0x18002a317
cmp eax, 0x17
jne 0x18002a367
lea rax, [r9 + 1]
cmp rax, qword [r14 + 0x10]
jae 0x18002a30a
mov ecx, esi
mov eax, ebp
and ecx, 0xf
shr eax, 6
lea ecx, [rax + rcx*4]
mov rax, qword [0x180131aa8]
movzx edx, byte [rcx + rax]
mov byte [rbx], dl
mov byte [rbx + 1], 0x3d
add rbx, 2
jmp 0x18002a367
mov dl, 0x3d
mov byte [rbx], dl
mov byte [rbx + 1], dl
add rbx, 2
jmp 0x18002a367
lea rax, [r9 + 1]
cmp rax, qword [r14 + 0x10]
jae 0x18002a327
movzx esi, byte [rdi + 1]
jmp 0x18002a329
xor esi, esi
mov rax, qword [0x180131aa8]
xor ebp, ebp
mov ecx, r15d
shr rcx, 2
movzx ecx, byte [rcx + rax]
mov eax, esi
mov byte [rbx], cl
mov ecx, r15d
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, eax
mov rax, qword [0x180131aa8]
movzx ecx, byte [rcx + rax]
mov byte [rbx + 1], cl
add rbx, 2
jmp 0x18002a367
movzx r15d, byte [rdi]
add r8d, 0x17
cmp r8d, 0x127
jb 0x18002a2c0
jmp 0x18002a195
mov rcx, qword [r14 + 0x10]
movabs rax, 0xaaaaaaaaaaaaaaab
add rcx, 2
xor r8d, r8d
mul rcx
mov rcx, r10
shr rdx, 1
shl rdx, 2
call fcn.1800ecb90
jmp 0x18002a18d
cmp qword [r14 + 0x18], 0x10
mov rdi, r14
jb 0x18002a3b6
mov rdi, qword [r14]
cmp qword [r10 + 0x18], 0x10
mov rbx, r10
jb 0x18002a3c3
mov rbx, qword [r10]
movabs rax, 0xaaaaaaaaaaaaaaab
mul qword [r14 + 0x10]
shr rdx, 1
lea rax, [rdx + rdx*2]
mov edx, dword [rsp + 0xe8]
mov qword [rsp + 0x80], rax
jmp case.0x18002a10e.10
mov qword [0x180121718], r14
jmp case.0x18002a10e.10
mov qword [rsp + 0x28], r9
lea r8, [0x1800837e0]
mov dword [rsp + 0x20], r9d
xor edx, edx
mov r9, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x88], rax
jmp 0x18002a18d
mov rax, qword [r10]
sub qword [r14 + 0x20], rax
jmp case.0x18002a10e.10
mov rax, qword [rsp + 0x88]
test rax, rax
jne 0x18002a465
mov byte [rsp + 0xe8], al
mov eax, dword [rsp + 0xe8]
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xchg qword [0x180121720], rax
mov byte [rsp + 0xe8], 1
jmp 0x18002a443
mov eax, r9d
jmp 0x18002a44a