Function at 0x1800347f0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xc0
mov rax, qword [0x180071748]
xor rax, rsp
mov qword [rbp + 7], rax
mov edi, r9d
mov qword [rbp - 0x29], rcx
mov r10, rcx
mov dword [rbp - 0x79], r9d
mov r9, qword [rbp + 0x7f]
mov r11, rdx
mov qword [rbp - 0x21], rdx
xor ecx, ecx
mov rdx, qword [rbp + 0x77]
lea eax, [rdi + 0xc]
mov qword [rbp - 0x31], rdx
mov r15, r8
mov qword [rbp - 0x71], r9
mov r12d, edi
mov dword [rbp - 0x69], edi
mov ebx, 0x2d
cmp edi, eax
jae 0x180034de6
mov r13, qword [rbp - 0x41]
mov rsi, qword [rbp - 0x51]
mov r14, qword [rbp - 0x51]
lea eax, [r12 - 0x51]
lea r8, [0x18005c520]
cmp eax, 0x3e
ja case.default.0x18003489b
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x351a0]
mov ecx, dword [rcx + rax*4 + 0x3516c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
movzx eax, word [0x18006a788]
mov word [rbp - 0x11], ax
movzx eax, word [0x18006a78c]
mov word [rbp - 0xf], ax
mov eax, 0x6f
mov word [rbp - 0xd], ax
jmp case.0x18003489b.83
mov eax, 0x9d
nop word [rax + rax]
cmp eax, 0x9d
je 0x180034d7f
add eax, 0x64
cmp eax, 0x101
jb 0x1800348d0
nop word [rax + rax]
mov edi, ILRemoveLastID
mov eax, edi
sub eax, 0xf
je 0x180034922
cmp eax, 1
jne 0x18003492e
mov rax, qword [r9]
mov rcx, qword [r13 + 0x20]
mov r15, qword [r13 + 8]
call qword [rax + 0x28]
mov rcx, qword [rbp - 0x71]
mov rax, qword [rcx]
mov rcx, r13
call qword [rax + 0x28]
mov r9, qword [rbp - 0x71]
jmp 0x18003492e
mov qword [rbp - 0x41], r15
mov r13, r15
test r15, r15
je 0x180034937
inc edi
cmp edi, 0x11
jb 0x1800348f5
jmp case.0x18003489b.81
mov edi, dword [rbp - 0x79]
mov r12d, 0x52
jmp case.0x18003489b.83
mov word [rbp - 0xc], bx
mov dword [rbp - 0xb], 0x6c6f76
jmp case.0x18003489b.83
mov r10, qword [rbp - 0x51]
xor ecx, ecx
mov r9d, ecx
test r10, r10
je 0x180034a53
lea rcx, [r10 - 1]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
inc rdx
lea r9, [rdx + rdx*2]
nop dword [rax]
nop word [rax + rax]
mov r8d, ebx
mov eax, r8d
sub eax, 0x29
je 0x180034a36
sub eax, 1
je 0x180034a1c
sub eax, 1
je 0x1800349f7
sub eax, 1
je 0x1800349d1
cmp eax, 1
jne 0x180034a3a
movzx ecx, byte [r14]
mov rax, qword [0x1800721b8]
shr rcx, 2
movzx ecx, byte [rcx + rax]
mov byte [rsi], cl
inc rsi
jmp 0x180034a3a
movzx ecx, byte [r14]
movzx eax, byte [r14 + 1]
and ecx, 3
shl ecx, 4
shr eax, 4
add ecx, eax
mov rax, qword [0x1800721b8]
movzx ecx, byte [rcx + rax]
mov byte [rsi], cl
inc rsi
jmp 0x180034a3a
movzx ecx, byte [r14 + 1]
movzx eax, byte [r14 + 2]
and ecx, 0xf
shr eax, 6
lea ecx, [rax + rcx*4]
mov rax, qword [0x1800721b8]
movzx ecx, byte [rcx + rax]
mov byte [rsi], cl
inc rsi
jmp 0x180034a3a
movzx ecx, byte [r14 + 2]
mov rax, qword [0x1800721b8]
and ecx, 0x3f
movzx ecx, byte [rcx + rax]
mov byte [rsi], cl
inc rsi
jmp 0x180034a3a
add r14, 3
dec r8d
cmp r8d, 0x28
ja 0x180034993
sub rdx, 1
jne 0x180034990
xor ecx, ecx
cmp r9, qword [r15 + 0x10]
jae 0x180034b4d
mov ebx, dword [rbp - 0x49]
mov r8d, 0x11e
mov r12d, dword [rbp - 0x5d]
mov r13d, dword [rbp - 0x39]
nop
mov eax, r8d
sub eax, 0x11e
je 0x180034b0a
sub eax, 0x1f
je 0x180034acf
sub eax, 0x1f
je 0x180034a9c
cmp eax, 0x1f
jne 0x180034b21
mov byte [rsi], 0x3d
inc rsi
jmp 0x180034b21
lea rax, [r9 + 1]
cmp rax, qword [r15 + 0x10]
jae 0x180034ac6
mov ecx, ebx
mov eax, r13d
and ecx, 0xf
shr eax, 6
lea ecx, [rax + rcx*4]
mov rax, qword [0x1800721b8]
movzx edx, byte [rcx + rax]
mov byte [rsi], dl
inc rsi
jmp 0x180034b21
mov dl, 0x3d
mov byte [rsi], dl
inc rsi
jmp 0x180034b21
mov rax, qword [0x1800721b8]
mov r13d, ecx
mov ecx, r12d
shr rcx, 2
movzx ecx, byte [rcx + rax]
mov eax, ebx
mov byte [rsi], cl
mov ecx, r12d
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, eax
mov rax, qword [0x1800721b8]
movzx ecx, byte [rcx + rax]
mov byte [rsi + 1], cl
add rsi, 2
jmp 0x180034b21
movzx r12d, byte [r14]
lea rax, [r9 + 1]
cmp rax, qword [r15 + 0x10]
jae 0x180034b1f
movzx ebx, byte [r14 + 1]
jmp 0x180034b21
mov ebx, ecx
add r8d, 0x1f
mov ecx, 0
cmp r8d, 0x19a
jb 0x180034a70
mov dword [rbp - 0x39], r13d
mov r13, qword [rbp - 0x41]
mov dword [rbp - 0x5d], r12d
mov r12d, dword [rbp - 0x69]
mov dword [rbp - 0x49], ebx
lea ebx, [rcx + 0x2d]
mov r9, qword [rbp - 0x71]
jmp case.default.0x18003489b
mov ecx, dword [r9]
sub ecx, 0xf
je 0x180034ddc
sub ecx, 2
je 0x180034b95
sub ecx, 1
je 0x180034bc3
cmp ecx, 7
jne case.0x18003489b.83
mov eax, 0x29
nop word [rax + rax]
cmp eax, 0x29
je 0x180034dbe
add eax, 0x1004
cmp eax, 0x1004
jbe 0x180034b80
mov ecx, 0x68
nop word [rax + rax]
mov eax, ecx
sub eax, 0x68
je 0x180034bb2
cmp eax, 1
je case.0x18003489b.107
jmp 0x180034bbc
mov qword [r15], r8
mov dword [rbp - 0x75], 8
inc ecx
cmp ecx, 0x6a
jb 0x180034ba0
mov edi, 0xe0
nop dword [rax + rax]
mov eax, edi
sub eax, 0xdf
je 0x180034c50
cmp eax, 1
jne 0x180034c3e
mov r8, rdx
lea r9, str.SYSTEM
mov rdx, r10
mov rcx, r11
call qword [r11 + 0x38]
test eax, eax
je 0x180034c32
mov ecx, 0x53
nop dword [rax + rax]
cmp ecx, 0x53
je 0x180034c13
cmp ecx, 0x2f56
je case.0x18003489b.107
jmp 0x180034c24
mov rax, qword [0x180072018]
mov qword [r15], rax
mov dword [rbp - 0x75], 3
add ecx, 0x2f03
cmp ecx, 0x5e06
jbe 0x180034c00
mov r11, qword [rbp - 0x21]
mov r10, qword [rbp - 0x29]
mov rdx, qword [rbp - 0x31]
dec edi
cmp edi, 0xde
ja 0x180034bd0
mov edi, dword [rbp - 0x79]
jmp 0x180034d59
mov r8, rdx
lea r9, str.PUBLIC
mov rdx, r10
mov rcx, r11
call qword [r11 + 0x38]
test eax, eax
je 0x180034c87
mov eax, 0x107
nop dword [rax]
cmp eax, 0x107
je 0x180034dd2
add eax, 0x543e
cmp eax, 0x543e
jbe 0x180034c70
mov edi, dword [rbp - 0x79]
mov r9, qword [rbp - 0x71]
mov eax, dword [r9]
lea r8, [rbp - 0x69]
mov r9, r15
mov dword [rbp - 0x69], eax
xor edx, edx
mov dword [rsp + 0x20], 0x1d
xor ecx, ecx
mov r12d, 0x6a
call fcn.180005960
mov dword [rbp - 0x75], eax
jmp 0x180034d59
cmp qword [r9 + 0x18], 0x10
mov rsi, r9
jb 0x180034cc7
mov rsi, qword [r9]
movabs rax, 0xaaaaaaaaaaaaaaab
mul qword [r15 + 0x10]
shr rdx, 1
lea rax, [rdx + rdx*2]
mov qword [rbp - 0x51], rax
jmp case.0x18003489b.83
movzx eax, word [0x18006a790]
lea rdx, [0x180069788]
mov word [rbp - 8], ax
lea rcx, [rbp - 6]
movzx eax, byte [0x18006a792]
mov r8d, 2
mov byte [rbp - 6], al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
movzx eax, word [0x18006a794]
mov word [rbp - 5], ax
movzx eax, byte [0x18006a796]
mov byte [rbp - 3], al
jmp 0x180034d59
mov rcx, qword [r15 + 0x10]
movabs rax, 0xaaaaaaaaaaaaaaab
add rcx, 2
xor r8d, r8d
mul rcx
mov rcx, r9
shr rdx, 1
shl rdx, 2
call fcn.18005cf00
cmp qword [r15 + 0x18], 0x10
mov r14, r15
jb 0x180034d59
mov r14, qword [r15]
mov r9, qword [rbp - 0x71]
xor ecx, ecx
inc r12d
lea eax, [rdi + 0xc]
mov dword [rbp - 0x69], r12d
cmp r12d, eax
jae 0x180034de6
mov rdx, qword [rbp - 0x31]
mov r10, qword [rbp - 0x29]
mov r11, qword [rbp - 0x21]
jmp 0x180034866
movzx eax, byte [rdx]
test al, al
je 0x180034da7
sub rdx, r9
nop dword [rax]
cmp r9, r10
je 0x180034db7
cmp byte [r9], al
jne 0x180034db7
movzx eax, byte [rdx + r9 + 1]
inc r9
test al, al
jne 0x180034d90
cmp r9, r10
mov eax, 0
sete al
jmp 0x180035064
xor eax, eax
jmp 0x180035064
mov rax, qword [0x180072030]
mov qword [r15], rax
mov eax, 7
jmp 0x180035064
mov rax, qword [0x180072010]
mov qword [r15], rax
mov eax, 3
jmp 0x180035064
mov r14d, edi
imul edi, edi, 0x924
mov dword [rbp - 0x5d], edi
cmp dword [rbp - 0x79], edi
ja case.0x18003489b.107
mov r12d, dword [rbp - 0x59]
mov edx, 0x65
movzx r13d, byte [rbp - 0x61]
mov esi, dword [rbp - 0x59]
lea r8d, [rdx - 1]
cmp r14d, 0x1ebd0
ja 0x18003501f
je 0x180035002
mov eax, r14d
sub eax, 0x75
je 0x180034edb
sub eax, 0xc
je 0x180034ec1
sub eax, 0x6243
je 0x180034eb8
sub eax, 0x6243
je 0x180034e8e
cmp eax, 0x6243
jne 0x18003513b
mov r8d, 1
lea rdx, [0x180069e4c]
lea rcx, [rbp - 0x11]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x18006a7a0]
xor ecx, ecx
mov word [rbp + 3], ax
mov r13b, 1
movzx eax, byte [0x18006a7a2]
mov byte [rbp + 5], al
lea edx, [rcx + 0x65]
lea r8d, [rcx + 0x64]
jmp 0x18003513b
mov word [rbp], r8w
lea rdx, [0x18006a798]
mov r8d, 1
lea rcx, [rbp - 0x11]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xor ecx, ecx
lea edx, [rcx + 0x65]
lea r8d, [rcx + 0x64]
jmp 0x18003513b
mov word [rbp - 1], dx
jmp 0x18003513b
movzx eax, word [0x18006a79c]
mov word [rbp - 3], ax
movzx eax, byte [0x18006a79e]
mov byte [rbp - 1], al
jmp 0x18003513b
mov edx, 0x117
mov eax, edx
sub eax, 0x117
je 0x180034f15
cmp eax, 1
jne 0x180034fd1
mov eax, dword [r9]
lea r8, [rbp - 0x51]
mov r9, r15
mov dword [rbp - 0x51], eax
xor edx, edx
mov dword [rsp + 0x20], 0x1d
xor ecx, ecx
call fcn.180005960
jmp 0x180035064
mov eax, dword [r9]
cmp eax, 0xf
je 0x180035161
cmp eax, 0x15
je 0x180034fb3
cmp eax, 0x18
je 0x180034f39
cmp eax, 0x24
je 0x180034f77
jmp 0x180034fd1
mov ecx, 0x89
nop
cmp ecx, 0x89
je 0x180034f57
cmp ecx, 0x5405
jne 0x180034f69
mov eax, ebx
jmp 0x180035064
mov rax, qword [0x180072170]
mov qword [r15], rax
mov dword [r15 + 0xc], 0x27
add ecx, 0x537c
cmp ecx, 0xa6f8
jbe 0x180034f40
mov ecx, 0x3f
nop dword [rax]
mov eax, ecx
sub eax, 0x3f
je 0x180034f96
cmp eax, 0x68
jne 0x180034fa8
mov eax, 0x2e
jmp 0x180035064
mov rax, qword [0x180072170]
mov qword [r15], rax
mov dword [r15 + 0xc], 0x27
add ecx, 0x68
cmp ecx, 0x10f
jb 0x180034f80
mov eax, 0x40
nop dword [rax + rax]
cmp eax, 0x40
je 0x180035157
add eax, 0x31
cmp eax, 0x71
jb 0x180034fc0
inc edx
cmp edx, 0x119
jb 0x180034ee0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
xor ecx, ecx
mov qword [r15 + 0x40], rax
mov qword [rbp - 0x19], rcx
lea edx, [rcx + 0x65]
lea r8d, [rcx + 0x64]
jmp 0x18003513b
mov qword [rbp - 0x51], rcx
lea rax, [rbp - 0x11]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x180035011
jmp 0x18003513b
cmp r14d, 0x24e13
je 0x180035138
cmp r14d, 0x2b056
je 0x180034fdf
cmp r14d, 0x31299
je 0x180035117
cmp r14d, 0x374dc
je 0x18003508b
cmp r14d, 0x3d71f
jne 0x18003513b
cmp qword [r15 + 0x40], 0
setne byte [rbp - 0x75]
mov eax, dword [rbp - 0x75]
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.180064e10
mov rbx, qword [rsp + 0x118]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.GDI32.dll_GetObjectType]
xor ecx, ecx
movzx eax, r13b
test r12d, r12d
cmove ecx, eax
movzx r13d, cl
test cl, cl
je 0x18003510c
mov edi, 0x4d
nop
mov eax, edi
sub eax, 0x4d
je 0x1800350fa
sub eax, 1
je 0x1800350e6
sub eax, 1
je 0x1800350d6
cmp eax, 1
jne 0x180035102
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x180035102
call sub.RPCRT4.dll_MesHandleFree
jmp 0x180035102
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x180035102
call sub.RPCRT4.dll_MesHandleFree
jmp 0x180035102
lea r8, [rbp - 0x41]
mov edx, esi
lea rcx, [rbp - 0x11]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov r12d, eax
jmp 0x180035102
mov qword [rbp - 0x41], 0
inc edi
cmp edi, 0x51
jb 0x1800350b0
mov edi, dword [rbp - 0x5d]
xor ecx, ecx
lea edx, [rcx + 0x65]
lea r8d, [rcx + 0x64]
jmp 0x18003513b
lea r9, [rbp - 0x19]
mov edx, esi
lea r8, [rbp - 0x59]
lea rcx, [rbp - 0x11]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
xor ecx, ecx
mov r12d, eax
lea edx, [rcx + 0x65]
lea r8d, [rcx + 0x64]
jmp 0x18003513b
mov dword [rbp - 0x59], ecx
imul eax, dword [rbp - 0x79], 0xc3
add r14d, eax
cmp r14d, edi
ja case.0x18003489b.107
mov r9, qword [rbp - 0x71]
jmp 0x180034e10
mov rax, qword [0x180072128]
mov qword [r15], rax
mov eax, 0x27
jmp 0x180035064