Function at 0x180025b20
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
mov r11, rcx
mov rdi, r9
lea ecx, [r8 + 0x82a]
mov rsi, rdx
mov dword [rsp + 0x44], ecx
cmp r8d, ecx
jae 0x180025c68
mov r13, qword [rsp + 0x50]
lea rdx, [0x180000000]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x50]
mov r14d, dword [rsp + 0xf0]
mov r12, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x100]
mov dword [rsp + 0x7c], 0x30
nop word [rax + rax]
cmp r8d, 0x233
ja 0x180025d34
je 0x180025d2a
mov eax, r8d
sub eax, 9
je 0x180025c4c
sub eax, 0xae
je 0x180025c2d
sub eax, 0x4a
je 0x180025c1b
sub eax, 0x74
je 0x180025be4
cmp eax, 0x4a
jne 0x180026908
mov r13, qword [rsi]
inc r13
jmp 0x180026908
mov rax, qword [rdi]
mov rcx, qword [rsp + 0x108]
mov rbx, qword [r11]
add rbx, rsi
mov rcx, qword [rcx]
sub rcx, rax
add rcx, rsi
mov qword [rsp + 0x88], rcx
lea rcx, [rax + rbp]
mov qword [rsp + 0x80], rcx
mov ecx, dword [rsp + 0x44]
jmp 0x180026908
mov eax, dword [rbp]
shr eax, 0xb
and eax, 1
mov dword [rsp + 0x48], eax
jmp 0x180026908
mov rax, qword [rsp + 0x108]
cmp qword [rax], 0
je 0x180026945
movzx eax, byte [rbp]
mov byte [rsp + 0x30], al
jmp 0x180026908
mov edi, 0xb7
mov eax, edi
sub eax, 0xb7
je 0x180025cd5
sub eax, 1
je 0x180025c81
cmp eax, 1
jne 0x180025ce8
mov rax, qword [rsp + 0x70]
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rsp + 0x108]
lea r8, [rsp + 0x70]
mov r9d, 0xd4
lea rdx, [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsi]
movzx ecx, byte [rax + 1]
mov rax, qword [r11]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x38]
mov byte [rsp + 0x38], cl
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.180079e00
mov r11, qword [rsp + 0xe0]
mov qword [rsp + 0x70], rax
jmp 0x180025ce8
test rsi, rsi
je 0x18002692d
cmp qword [rsi], 0
je 0x18002692d
inc edi
cmp edi, 0xba
jb 0x180025c51
mov r8d, dword [rsp + 0xf0]
lea rdx, [0x180000000]
mov rdi, qword [rsp + 0xf8]
test r14d, r14d
jne 0x180025d67
mov ecx, dword [rsp + 0x44]
mov dword [r11], 1
mov qword [rsi], r13
mov dword [rsp + 0x70], r14d
jmp 0x180026908
mov r15, qword [rsp + 0x50]
jmp 0x180026908
mov eax, r8d
sub eax, 0x27d
je 0x180026827
sub eax, 0x74
je 0x18002646b
sub eax, 0x4a
je 0x180025d0d
sub eax, 0x74
je 0x180025c68
cmp eax, 0x4a
je 0x180025c68
jmp 0x180026908
lea eax, [r14 - 0x30]
cmp eax, 0x4a
ja 0x180026451
movsxd rax, r14d
movsx r10d, word [rdx + rax*2 + 0x8c440]
test r10d, r10d
je 0x180025d99
mov ecx, dword [rsp + 0x44]
mov r14d, r10d
mov qword [rsi], r13
mov dword [rsp + 0x70], r10d
jmp 0x180026908
mov eax, SHSetFolderPathA
nop
cmp eax, 0xe5
je 0x180025dc5
cmp eax, 0x24ad
jne 0x180026439
mov r8d, 0x33b
mov dword [rsp + 0xf0], r8d
jmp 0x180026441
mov r9, qword [rsp + 0x50]
lea eax, [r14 - 0x30]
cmp eax, 0x48
ja case.0x180025deb.55
cdqe
movzx eax, byte [rdx + rax + 0x26974]
mov ecx, dword [rdx + rax*4 + 0x26954]
add rcx, rdx
jmp rcx
mov dword [r11], 0x25
jmp case.0x180025e27.0
mov edx, 5
mov r8d, pe_nt_image_headers64
cmp edx, 5
ja case.default.0x180025e27
mov eax, edx
lea rcx, [0x180000000]
mov ecx, dword [rcx + rax*4 + 0x269c0]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
test r14d, r14d
je 0x180026041
cmp dword [rsp + 0x78], 0
je 0x180025e53
mov rax, qword [rsp + 0x108]
mov eax, dword [rax]
cmp r14d, eax
jg 0x180026035
sub eax, r14d
lea r14d, [rax + 1]
mov eax, 0xffffffe3
sub eax, r14d
mov r14d, eax
jmp case.default.0x180025e27
test r14d, r14d
jns case.default.0x180025e27
mov dword [r11], 0x3d
jmp case.0x180025e27.0
movzx ecx, byte [r13 + 1]
lea rax, [r13 + 1]
cmp cl, 0x2d
lea rbp, [0x180000000]
cmove r13, rax
xor eax, eax
cmp cl, 0x2d
sete al
xor r14d, r14d
lea rcx, [r13 + 1]
mov dword [rsp + 0x78], eax
movzx eax, byte [rcx]
test byte [rax + rbp + 0x8cf90], 4
mov rbp, qword [rsp + 0x100]
je case.default.0x180025e27
lea rsi, [0x180000000]
nop dword [rax]
nop word [rax + rax]
mov r13, rcx
lea ecx, [r14 - 6]
lea ecx, [r14 + rcx*4]
movzx eax, byte [r13]
lea r14d, [rax + rcx*2]
movzx eax, byte [r13 + 1]
lea rcx, [r13 + 1]
test byte [rax + rsi + 0x8cf90], 4
jne 0x180025ed0
mov rsi, qword [rsp + 0xe8]
jmp case.default.0x180025e27
movzx eax, byte [r13 + 1]
cmp al, 0x3c
je 0x180026058
cmp al, 0x27
je 0x180026058
cmp al, 0x7b
jne 0x180025fb6
mov ecx, 0x7d
mov eax, ecx
sub eax, 0x7d
je 0x180025f3c
sub eax, 1
je 0x180025f88
cmp eax, 1
jne 0x180025fa6
inc r13
jmp 0x180025fa6
movzx eax, byte [r13 + 2]
lea r12, [r13 + 2]
mov qword [rsp + 0x68], r12
test al, al
je 0x180025fa6
nop
cmp al, 0x7d
je 0x180025fa6
cmp al, 0x2d
je 0x180025f74
lea rsi, [0x180000000]
movzx eax, al
test byte [rax + rsi + 0x8cf90], 4
mov rsi, qword [rsp + 0xe8]
je 0x180025f88
movzx eax, byte [r12 + 1]
inc r12
mov qword [rsp + 0x68], r12
test al, al
jne 0x180025f50
jmp 0x180025fa6
movzx eax, byte [r12]
mov ecx, 0x7e
test al, al
je 0x180025f9e
cmp al, 0x7d
jne 0x18002604d
mov dword [rsp + 0x58], 1
inc ecx
cmp ecx, 0x80
jb 0x180025f26
jmp case.default.0x180025e27
mov dword [rsp + 0x58], 0
jmp case.default.0x180025e27
cmp dword [rsp + 0x58], 0
je case.default.0x180025e27
inc r13
cmp byte [r13], 0x7d
jne 0x180026063
dec r8d
dec edx
cmp r8d, 0x102
ja 0x180025e04
cmp dword [rdi], 0
jne 0x1800260dc
mov edx, reloc.SHELL32.dll_PathMakeUniqueName
cmp edx, 0x2f
je 0x1800260c3
cmp edx, 0x128b
je 0x18002606f
cmp edx, 0x24e7
jne 0x1800260ca
cmp r14d, 0xa
jl 0x1800260f2
mov rax, qword [rsp + 0x108]
cmp r14d, dword [rax]
jle 0x1800260f2
mov r13, r9
jmp 0x1800260ca
mov dword [r11], ILClone
jmp case.0x180025e27.0
mov dword [r11], 0x3a
jmp case.0x180025e27.0
mov r14d, 0xffffffe4
jmp case.0x180025e27.0
mov r14d, 0xffffffe5
jmp case.0x180025e27.0
mov dword [r11], 0x39
jmp case.0x180025e27.0
movzx eax, byte [r13 + 1]
lea rcx, [r13 + 1]
lea r8, [0x180000000]
test byte [rax + r8 + 0x8cf90], 4
je 0x1800260b8
nop word [rax + rax]
mov r13, rcx
lea ecx, [r14 - 6]
lea ecx, [r14 + rcx*4]
movzx eax, byte [r13]
lea r14d, [rax + rcx*2]
movzx eax, byte [r13 + 1]
lea rcx, [r13 + 1]
test byte [rax + r8 + 0x8cf90], 4
jne 0x180026090
test r14d, r14d
js 0x180025e6c
jmp 0x1800260ca
mov r9, r13
sub r14d, 0x30
add edx, 0x125c
cmp edx, 0x3714
jbe 0x180025ff5
movzx r14d, byte [r13]
cmp r14d, 0x38
jb case.0x180025deb.48
dec r13
xor r14d, r14d
jmp case.0x180025e27.0
mov eax, 0xffffffe3
sub eax, r14d
mov r14d, eax
jmp case.0x180025e27.0
mov r8d, 0xbb
nop dword [rax + rax]
cmp r8d, 0xbb
je 0x180026128
cmp r8d, 0x5b4f
je case.0x180025e27.0
jmp 0x18002617a
sub r14d, 0x30
cmp r10d, 2
jge 0x180026160
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r13 + 1]
inc r10d
lea eax, [rdx - 0x30]
cmp al, 7
ja 0x180026163
add r14d, 0xfffffffa
inc r13
lea r14d, [rdx + r14*8]
cmp r10d, 2
jl 0x180026140
inc r10d
cmp dword [rsp + 0x48], 0
jne 0x18002617a
cmp r14d, 0xff
jle 0x18002617a
mov dword [r11], 0x33
add r8d, 0x5a94
cmp r8d, 0xb528
jbe 0x180026110
cmp byte [r13 + 1], 0x7b
lea r9, [0x180000000]
jne 0x18002625c
movzx ecx, byte [r13 + 2]
lea rdx, [r13 + 2]
xor r8d, r8d
xor r14d, r14d
test byte [rcx + r9 + 0x8cf90], 8
je 0x180026204
nop word [rax + rax]
inc rdx
movzx eax, cl
test r14d, r14d
jne 0x1800261d0
cmp eax, 0x30
je 0x1800261f3
inc r8d
lea ecx, [rax - 0x20]
cmp eax, 0x61
cmovb ecx, eax
mov eax, 0x37
cmp ecx, 0x41
cmovl eax, dword [rsp + 0x7c]
shl r14d, 4
sub r14d, eax
add r14d, ecx
movzx eax, byte [rdx]
movzx ecx, al
test byte [rax + r9 + 0x8cf90], 8
jne 0x1800261c0
cmp cl, 0x7d
jne 0x18002625c
mov ecx, 0xea
nop
cmp ecx, 0xea
je 0x180026226
cmp ecx, 0xa0e
je case.0x180025e27.0
jmp 0x18002624e
test r14d, r14d
js 0x180026244
cmp dword [rsp + 0x48], 0
mov eax, 2
mov r13d, 8
cmovne eax, r13d
cmp r8d, eax
jle 0x18002624b
mov dword [r11], 0x22
mov r13, rdx
add ecx, 0x924
cmp ecx, 0x1248
jbe 0x180026210
xor r14d, r14d
cmp r10d, 2
jge 0x1800262fb
nop dword [rax]
movzx eax, byte [r13 + 1]
inc r10d
test byte [rax + r9 + 0x8cf90], 8
je case.0x180025e27.0
mov r12d, dword [rsp + 0x5c]
mov ecx, 0x105
mov r9d, 0x30
mov eax, ecx
sub eax, 0x104
je 0x1800262af
cmp eax, 1
jne 0x1800262d6
movzx r12d, byte [r13 + 1]
inc r13
jmp 0x1800262d6
cmp r12d, 0x61
lea eax, [r12 - 0x20]
cmovl eax, r12d
mov r12d, eax
mov eax, 0x37
cmp r12d, 0x41
cmovl eax, r9d
shl r14d, 4
sub r14d, eax
add r14d, r12d
dec ecx
cmp ecx, 0x103
ja 0x180026297
mov dword [rsp + 0x5c], r12d
lea r9, [0x180000000]
mov r12, qword [rsp + 0x68]
cmp r10d, 2
jl 0x180026270
inc r10d
jmp case.0x180025e27.0
mov r8d, 0xd2
nop dword [rax]
mov eax, r8d
sub eax, 0xd2
je 0x1800263c2
sub eax, 0x26
je 0x180026331
cmp eax, 0x26
je case.0x180025e27.0
jmp 0x1800263c5
cmp r10d, 4
jge 0x1800263bd
nop dword [rax + rax]
movzx eax, byte [r13 + 1]
inc r10d
test byte [rax + rdx + 0x8cf90], 8
je 0x1800263c5
mov edx, 0x11f
mov r12d, 0x30
nop dword [rax]
cmp edx, 0x11f
je 0x180026376
cmp edx, 0x7c71
jne 0x18002639d
movzx r14d, r14b
jmp 0x18002639d
movzx eax, byte [r13 + 1]
inc r13
cmp eax, 0x61
lea ecx, [rax - 0x20]
cmovb ecx, eax
mov eax, 0x37
cmp ecx, 0x41
cmovl eax, r12d
shl r14d, 4
sub r14d, eax
add r14d, ecx
add edx, 0x7b52
cmp edx, 0xf6a4
jbe 0x180026360
mov r12, qword [rsp + 0x68]
lea rdx, [0x180000000]
cmp r10d, 4
jl 0x180026340
inc r10d
jmp 0x1800263c5
xor r14d, r14d
add r8d, 0x26
cmp r8d, 0x144
jb 0x180026310
mov ecx, 0x106
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x106
je 0x1800263fb
sub eax, 0x34
je 0x1800263f5
cmp eax, 0x34
je case.0x180025e27.0
jmp 0x180026415
xor r14d, 0x40
jmp 0x180026415
movzx r14d, byte [r13 + 1]
inc r13
test r14d, r14d
je 0x180026462
lea eax, [r14 - 0x61]
cmp eax, 0x19
ja 0x180026415
sub r14d, 0x20
add ecx, 0x34
cmp ecx, 0x1a2
jb 0x1800263e0
test byte [rbp], 0x40
je case.0x180025e27.0
mov dword [r11], 3
mov eax, SHSetFolderPathA
lea rdx, [0x180000000]
mov r8d, dword [rsp + 0xf0]
add eax, 0x23c8
cmp eax, 0x4790
jbe 0x180025da0
mov ecx, dword [rsp + 0x44]
mov qword [rsi], r13
mov dword [rsp + 0x70], r14d
jmp 0x180026908
mov dword [r11], 2
jmp case.0x180025e27.0
mov r9, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x50]
cmp rbx, r9
ja 0x180026819
mov ebp, 0x105
nop word [rax + rax]
lea eax, [rbp - 0x105]
cmp eax, 5
ja case.default.0x1800264a9
mov ecx, dword [rdx + rax*4 + 0x269d8]
add rcx, rdx
jmp rcx
mov r8, qword [rsp + 0x80]
lea rdx, [rdi + 8]
cmp rdx, r8
ja case.default.0x1800264a9
movzx ecx, byte [rdi]
inc rdi
movzx eax, byte [r15]
inc r15
cmp al, cl
jne 0x180026593
movzx ecx, byte [rdi]
inc rdi
movzx eax, byte [r15]
inc r15
cmp al, cl
jne 0x180026593
movzx ecx, byte [rdi]
inc rdi
movzx eax, byte [r15]
inc r15
cmp al, cl
jne 0x180026593
movzx ecx, byte [rdi]
inc rdi
movzx eax, byte [r15]
inc r15
cmp al, cl
jne 0x180026593
movzx ecx, byte [rdi]
inc rdi
movzx eax, byte [r15]
inc r15
cmp al, cl
jne 0x180026593
movzx ecx, byte [rdi]
inc rdi
movzx eax, byte [r15]
inc r15
cmp al, cl
jne 0x180026593
movzx ecx, byte [rdi]
inc rdi
movzx eax, byte [r15]
inc r15
cmp al, cl
jne 0x180026593
movzx ecx, byte [rdi]
add rdx, 8
movzx eax, byte [r15]
inc rdi
inc r15
cmp al, cl
jne 0x180026593
cmp rdx, r8
jbe 0x1800264c0
jmp case.default.0x1800264a9
mov r8, qword [rsp + 0x80]
cmp rdi, r8
jae 0x18002658d
movzx eax, byte [rdi]
cmp byte [r15], al
jne 0x18002658a
inc r15
inc rdi
cmp rdi, r8
jb 0x180026577
cmp rdi, r8
je 0x180026934
mov ebp, 0x109
jmp case.default.0x1800264a9
mov r8d, 0x2f1
mov dword [rsp + 0xf0], r8d
jmp 0x1800267d8
mov rdi, qword [rsp + 0x100]
mov r15, rbx
inc rdi
jmp case.default.0x1800264a9
mov r8, qword [rsp + 0x80]
lea rdx, [rdi + 3]
cmp rdx, r8
ja case.default.0x1800264a9
nop dword [rax + rax]
movzx ecx, byte [rdi]
inc rdi
movzx eax, byte [r15]
inc r15
cmp al, cl
jne 0x180026593
movzx ecx, byte [rdi]
inc rdi
movzx eax, byte [r15]
inc r15
cmp al, cl
jne 0x180026593
movzx ecx, byte [rdi]
add rdx, 3
movzx eax, byte [r15]
inc rdi
inc r15
cmp al, cl
jne 0x180026593
cmp rdx, r8
jbe 0x1800265e0
jmp case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
movzx ecx, byte [rsp + 0x30]
cmp al, cl
je case.default.0x1800264a9
lea rax, [rbx + 0x18]
cmp r9, rax
jb 0x180026781
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
movzx eax, byte [rbx]
inc rbx
cmp al, cl
je case.default.0x1800264a9
mov esi, 0x111
mov eax, esi
sub eax, 0x111
je 0x180026799
cmp eax, 1
jne 0x1800267c6
inc rbx
jmp 0x1800267c6
mov r8, r9
movsx edx, cl
sub r8, rbx
mov rcx, rbx
inc r8
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x180026945
movzx ecx, byte [rsp + 0x30]
mov r9, qword [rsp + 0x88]
inc esi
cmp esi, 0x113
jb 0x180026786
mov r8d, dword [rsp + 0xf0]
inc ebp
lea rdx, [0x180000000]
cmp ebp, 0x10b
jb 0x180026490
lea rdx, [0x180000000]
cmp rbx, r9
jbe 0x180026481
mov r11, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xe8]
mov rbp, qword [rsp + 0x100]
mov ecx, dword [rsp + 0x44]
mov qword [rsp + 0x70], 0xffffffffffffffff
jmp 0x180026908
movzx r14d, byte [r13]
inc r13
cmp dword [rsp + 0x48], 0
je 0x180026905
cmp r14d, 0xc0
jb 0x180026905
mov r12d, dword [rsp + 0x40]
mov r8d, SHSetInstanceExplorer
mov eax, r8d
sub eax, 0xae
je 0x1800268cf
sub eax, 0x71
je 0x1800268c3
cmp eax, 0x71
jne 0x1800268e3
movsxd r9, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x60]
mov edx, dword [rdx + r9*4 + 0x859d8]
and r14d, edx
shl r14d, cl
test r9d, r9d
jle 0x1800268af
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r13]
sub ecx, 6
and eax, 0x3f
dec r9d
shl eax, cl
inc r13
or r14d, eax
test r9d, r9d
jg 0x180026890
mov dword [rsp + 0x60], ecx
dec r9d
lea rdx, [0x180000000]
mov dword [rsp + 0x40], r9d
mov r12d, r9d
jmp 0x1800268e3
lea eax, [r12 + r12*2]
add eax, eax
mov dword [rsp + 0x60], eax
jmp 0x1800268e3
mov eax, r14d
and eax, 0x3f
movzx r12d, byte [rax + rdx + 0x859f0]
mov dword [rsp + 0x40], r12d
add r8d, 0x71
cmp r8d, 0x201
jb 0x180026852
mov r12, qword [rsp + 0x68]
mov r8d, dword [rsp + 0xf0]
mov ecx, dword [rsp + 0x44]
dec r13
add r8d, 0xbe
mov dword [rsp + 0xf0], r8d
cmp r8d, ecx
jae 0x180025c68
mov rdi, qword [rsp + 0xf8]
jmp 0x180025ba0
xor eax, eax
jmp 0x180025c6d
sub rbx, qword [rsp + 0xe8]
lea rax, [rbx - 1]
jmp 0x180025c6d
mov rax, 0xffffffffffffffff
jmp 0x180025c6d