Function at 0x180021fd0
Capabilities:
Create thread
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
mov rax, qword [0x180090f80]
xor rax, rsp
mov qword [rbp - 0x40], rax
movzx edi, word [rsp + 0x40]
mov ebx, ecx
mov qword [rsp + 0x48], rdx
mov r14d, ecx
movss xmm13, dword [rsp + 0x48]
mov r13, r8
mov r8, qword [rbp + 0xb0]
mov r10, r9
movss xmm12, dword [rsp + 0x48]
xorps xmm8, xmm8
movss xmm14, dword [rsp + 0x48]
movss xmm10, dword [rsp + 0x48]
movss xmm11, dword [rsp + 0x48]
imul r12d, ecx, 0x5cd
xor ecx, ecx
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], r8
cmp ebx, r12d
ja 0x180022338
mov eax, dword [rsp + 0x48]
movss xmm9, dword [0x180082660]
mov esi, dword [rsp + 0x48]
mov r15d, dword [rsp + 0x48]
movss xmm7, dword [rsp + 0x48]
movss xmm6, dword [rsp + 0x48]
mov dword [rsp + 0x44], eax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x40], ax
nop dword [rax + rax]
cmp ebx, 0x27a6
ja 0x1800221aa
je 0x18002219e
mov eax, ebx
sub eax, 0x19
je 0x180022192
sub eax, 0x88
je 0x180022172
sub eax, 0x3d
je 0x180022150
sub eax, 0xc6a
je 0x180022147
movzx r9d, word [rsp + 0x40]
mov r11d, dword [rsp + 0x44]
cmp eax, 0xd2f
jne 0x180022324
mov eax, dword [0x18007d57c]
mov dword [rbp - 0x5c], eax
movzx eax, word [0x18007d580]
mov word [rbp - 0x58], ax
mov eax, dword [str.5_libavcodec_bytestream.h]
mov dword [rbp - 0x56], eax
movzx eax, word [0x18007d5ac]
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], cx
jmp 0x180022324
mov word [rbp - 0x5c], cx
jmp 0x180022319
movaps xmm6, xmm9
movaps xmm7, xmm9
divss xmm6, dword [r10]
divss xmm7, dword [r10 + 4]
movaps xmm11, xmm9
divss xmm11, dword [r10 + 8]
jmp 0x180022319
movzx r9d, word [r10]
movzx edi, r9w
shr di, 6
and di, 0x3f
and r9w, 0x3f
mov word [rsp + 0x40], r9w
jmp 0x18002231f
mov dword [rbp - 0x60], 0x630069
jmp 0x180022319
mov dword [rbp - 0x50], 0x6d002f
jmp 0x180022319
cmp ebx, 0x34d5
je 0x1800222e4
cmp ebx, 0x4204
je 0x1800222c7
cmp ebx, 0x75f0
je 0x18002228f
cmp ebx, 0xeb02
je 0x18002225a
cmp ebx, 0x16014
jne 0x180022319
movsxd rax, r15d
lea rcx, [rax + rax*2]
mov eax, 1
movss xmm13, dword [rbp + rcx*4 - 0x74]
sub eax, esi
subss xmm13, dword [r8 + 4]
cdqe
lea rcx, [rax + rax*2]
mulss xmm13, xmm7
mov eax, 1
movss xmm12, dword [rbp + rcx*4 - 0x78]
sub eax, r15d
subss xmm12, dword [r8]
cdqe
lea rcx, [rax + rax*2]
mulss xmm12, xmm6
movss xmm14, dword [rbp + rcx*4 - 0x74]
subss xmm14, dword [r8 + 4]
mulss xmm14, xmm7
comiss xmm10, xmm14
ja 0x18002224d
comiss xmm13, xmm12
jbe 0x180022317
mov dword [rsp + 0x48], 0
jmp case.0x1800223b4.29
movzx r9d, word [rsp + 0x40]
mov r11d, ecx
comiss xmm8, xmm11
movsxd rax, esi
lea rcx, [rax + rax*2]
movss xmm10, dword [rbp + rcx*4 - 0x78]
subss xmm10, dword [r8]
seta r11b
xor ecx, ecx
mov dword [rsp + 0x44], r11d
mulss xmm10, xmm6
jmp 0x180022324
movsd xmm0, qword [r13]
mov esi, ecx
mov eax, dword [r13 + 8]
mov r15d, ecx
comiss xmm8, xmm6
mov dword [rbp - 0x70], eax
mov eax, dword [rdx + 8]
mov dword [rbp - 0x64], eax
movsd qword [rbp - 0x78], xmm0
movsd xmm0, qword [rdx]
seta sil
movsd qword [rbp - 0x6c], xmm0
comiss xmm8, xmm7
seta r15b
jmp 0x180022319
mov word [rbp - 0x44], cx
lea rdx, [0x18007d618]
lea rcx, [rbp - 0x44]
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x180022308
mov word [rbp - 0x4c], cx
lea rdx, [0x18007d566]
lea rcx, [rbp - 0x4c]
mov r8d, 3
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, 0x65
mov word [rbp - 0x46], ax
mov r10, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
movzx r9d, word [rsp + 0x40]
mov r11d, dword [rsp + 0x44]
imul eax, r14d, 0x87
add ebx, eax
cmp ebx, r12d
jbe 0x1800220d0
jmp 0x18002234e
movzx r9d, word [rsp + 0x40]
mov r11d, dword [rsp + 0x48]
mov word [rsp + 0x40], r9w
mov dword [rsp + 0x44], r11d
lea r15d, [r14 + 0xc0]
cmp r14d, r15d
jae case.0x1800223b4.29
mov r12, qword [rsp + 0x60]
lea rdx, [0x180000000]
mov ebx, dword [rsp + 0x48]
mov esi, dword [rsp + 0x48]
movss xmm6, dword [rsp + 0x48]
movzx r13d, di
mov edi, dword [rsp + 0x48]
cmp r14d, 0x11e
ja case.0x1800223b4.36
je case.0x1800223b4.29
lea eax, [r14 - 0x19]
cmp eax, 0xf5
ja case.0x1800223b4.36
movzx eax, byte [rdx + rax + 0x22640]
mov ecx, dword [rdx + rax*4 + 0x22610]
add rcx, rdx
jmp rcx
xor eax, eax
mov r9, r8
mov qword [rsp + 0x28], rax
lea r8, [0x180023500]
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r12, rax
test rax, rax
jne 0x180022460
mov ecx, 0x40
cmp ecx, 0x40
je 0x18002243c
cmp ecx, 0x22c0
je 0x18002242e
cmp ecx, 0x4540
jne 0x180022452
lea rax, [rsp + 0x78]
mov r9d, esi
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x60]
xor eax, eax
mov r8d, edi
mov qword [rsp + 0x28], rax
mov edx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedObjectAce]
mov byte [rsp + 0x48], 0
jmp case.0x1800223b4.29
xor esi, esi
xor eax, eax
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x80], eax
jmp 0x180022452
xor eax, eax
mov edx, 8
mov qword [rsp + 0x60], rax
mov ebx, eax
mov word [rsp + 0x62], dx
lea edi, [rax + 4]
add ecx, 0x2280
cmp ecx, 0x6780
jbe 0x1800223e6
movzx r9d, word [rsp + 0x40]
mov r11d, dword [rsp + 0x44]
lea rdx, [0x180000000]
add r14d, 0x10
cmp r14d, r15d
jae case.0x1800223b4.29
mov r8, qword [rsp + 0x50]
mov r10, qword [rsp + 0x58]
jmp 0x180022380
movaps xmm0, xmm13
movaps xmm1, xmm14
maxss xmm0, xmm10
minss xmm1, xmm12
movaps xmm10, xmm0
movaps xmm12, xmm1
jmp case.0x1800223b4.36
cmp byte [r8 + 0x42], 0
je 0x1800224b6
mov rdx, qword [r8]
jmp 0x1800224ba
mov rdx, qword [r8 + 8]
movzx eax, byte [r8 + 0x41]
test al, al
je 0x180022424
cmp r9w, ax
jne 0x180022424
mov ecx, r13d
mov eax, 1
shl rax, cl
and rax, qword [r8 + 0x38]
test rdx, rax
je 0x180022424
jmp 0x18002246b
mov eax, 1
sub eax, r11d
cdqe
lea rcx, [rax + rax*2]
movss xmm1, dword [rbp + rcx*4 - 0x70]
subss xmm1, dword [r8 + 8]
mulss xmm1, xmm11
comiss xmm10, xmm1
ja 0x18002224d
comiss xmm6, xmm12
ja 0x18002224d
movaps xmm0, xmm6
minss xmm1, xmm12
maxss xmm0, xmm10
movaps xmm12, xmm1
movaps xmm10, xmm0
jmp case.0x1800223b4.36
xor eax, eax
mov qword [0x180091048], r8
mov word [rbp - 0x42], ax
jmp case.0x1800223b4.36
mov qword [r8 + 0x80], r10
jmp case.0x1800223b4.36
movsxd rax, r11d
lea rcx, [rax + rax*2]
movss xmm6, dword [rbp + rcx*4 - 0x70]
subss xmm6, dword [r8 + 8]
mulss xmm6, xmm11
jmp case.0x1800223b4.36
xorps xmm0, xmm0
lea rdx, [rsp + 0x68]
movups xmmword [rsp + 0x68], xmm0
mov rax, r12
lea rcx, [rbp - 0x60]
xchg qword [0x180091050], rax
call qword [sym.imp.ADVAPI32.dll_RemoveUsersFromEncryptedFile]
mov byte [rsp + 0x48], 1
jmp 0x180022460
movss dword [rsp + 0x48], xmm10
jmp case.0x1800223b4.36
mov byte [rsp + 0x48], 1
mov eax, dword [rsp + 0x48]
mov rcx, qword [rbp - 0x40]
xor rcx, rsp
call fcn.180076c30
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret