Function at 0x18057b270
Capabilities:
Encode data using base64
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
movsx eax, byte [0x180010037]
xor ebx, ebx
mov word [rbp + 0x6f], ax
mov ecx, ebx
movsx rax, word [0x18001007c]
mov esi, 0x9a
mov qword [rbp - 0x41], rax
movabs rax, 0xde5f6b625ddb0
mov byte [rbp + 0x6f], 0x8a
mov qword [rbp - 0x39], rax
movzx eax, word [0x1800100d8]
lea r13d, [rsi + 0x1d]
mov dword [rbp - 0x31], eax
movsx rax, byte [0x18001005b]
mov byte [rbp + 0x77], 0x98
mov qword [rbp + 0x6f], rax
movabs rax, 0xd35d267dbd50f
mov qword [rbp - 9], 0x380d5838
mov qword [rbp - 0x11], rax
movzx r12d, byte [0x18001007f]
mov byte [rbp + 0x6f], 0x3f
mov eax, dword [0x1800100a4]
mov dword [rbp - 0x49], eax
mov eax, 0x220d
mov word [rbp - 0x45], ax
mov r14d, dword [0x180010084]
movzx eax, byte [0x18001007f]
mov qword [rbp + 7], rax
movzx eax, byte [0x18001007a]
mov word [rbp + 0x7f], ax
mov eax, 0x8fda
movsx edi, byte [0x18001006b]
mov word [rbp + 0x6f], ax
mov eax, 0xebae38a2
mov qword [rbp + 0x6f], rax
mov eax, 0x7ba3
mov byte [rbp + 0x6f], 0x1d
mov word [rbp + 0x6f], ax
lea eax, [rsi + 0x2b]
mov byte [rbp + 0x6f], 0xe6
mov byte [rbp + 0x6f], 0x60
mov word [rbp + 0x6f], ax
mov eax, dword [0x1800cc2ec]
mov dword [rbp + 0x6f], 0x34
mov dword [0x180010088], eax
mov rax, qword [rbp - 0x39]
shl rax, 6
mov qword [0x1800100e8], rax
mov eax, dword [rbp - 0x31]
test eax, eax
mov eax, ebx
mov qword [rbp - 1], r13
sete cl
mov dword [rbp - 0x29], edi
cmp byte [0x18001005b], bl
sete al
sub cx, ax
mov rax, qword [0x180058568]
add ax, cx
mov ecx, dword [rbp - 0x49]
add cx, ax
mov word [rbp - 0x21], 0xba49
add cx, word [0x1800100ac]
mov word [0x1800100b4], cx
mov word [rbp - 0x17], GetTopWindow
mov byte [rbp - 0x15], 0xe2
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov edx, ebx
mov ecx, ebx
cmp ax, 0x3d
mov word [0x180010078], ax
sete dl
test ax, ax
sete cl
cmp ecx, edx
jne 0x18057b44b
test r14d, r14d
lea eax, [rsi - 0x72]
cmovne eax, dword [0x180058550]
cdqe
mov qword [0x1800100c0], rax
movzx ecx, word [0x180058554]
movsx eax, byte [0x180010036]
movzx edx, word [0x180058554]
sub ecx, eax
movzx ecx, cx
imul edx, ecx
mov ecx, 0xffff8a65
movsx ecx, cx
mov word [0x180058554], dx
mov eax, dword [0x180010084]
movsx edx, ax
imul edx, ecx
mov word [rbp - 0x45], dx
jmp 0x18057b452
movzx eax, word [0x1800100d8]
lea rax, [0x180579004]
mov qword [rbp + 0xf], 0xd
mov qword [rbp - 0x1f], rax
mov al, byte [0x18001007e]
call fcn.1800099ec
movzx r10d, ax
mov qword [0x1800100c0], r10
mov rax, qword [0x1800100c0]
test rax, rax
jne 0x18057b4a0
mov al, byte [0x1800100e8]
and al, 0x35
mov byte [0x18001007e], al
movsxd rax, dword [0x180010084]
mov qword [rbp + 0x6f], rax
mov dword [rbp - 0x2d], ebx
mov r15b, bl
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
movzx ecx, word [0x1800100b0]
mov dword [rbp - 0x49], eax
movsx eax, word [0x1800100b4]
cmp eax, ecx
je 0x18057b4dd
movzx eax, word [rbp + 0x7f]
lea eax, [r12 + 0x282ced15]
mov dword [0x1800100f0], eax
mov qword [rbp + 0x6f], 0x25ddd240
jmp 0x18057b514
mov rax, qword [0x180010090]
not rax
test rax, rax
je 0x18057b4f2
mov al, byte [0x180010033]
movsx eax, byte [0x180010037]
movsx ecx, word [0x1800100a0]
sub ecx, eax
mov rax, qword [rbp - 9]
movsxd rdx, ecx
add rdx, r14
sub edx, eax
mov dword [0x180010088], edx
mov eax, dword [0x180058550]
mov rax, qword [0x180010090]
call fcn.18000901c
mov byte [0x180010036], al
test al, al
jg 0x18057b543
mov rax, qword [rbp - 0x41]
xor rax, 0x3a18
add rax, r13
mov qword [rbp - 1], rax
jmp 0x18057b56a
cmp dword [0x1800100e4], ebx
mov eax, 0xfe0f
mov word [rbp + 0x7f], ax
je 0x18057b55d
movsx ecx, byte [0x18001006b]
jmp 0x18057b564
movzx ecx, word [0x1800100f8]
mov dword [0x1800100a4], ecx
mov r13, qword [rbp + 0x67]
mov byte [rbp + 0x6f], 3
mov rax, qword [0x1800100c0]
sub byte [0x180010037], al
movsx ecx, byte [rbp + 0x6f]
sub ecx, 1
je 0x18057b605
sub ecx, 1
je 0x18057b5b3
cmp ecx, 1
jne 0x18057b63d
mov eax, 0x2942
mov word [0x1800100cc], ax
lea eax, [rdi + 0x80]
mov byte [0x18001007f], al
jmp 0x18057b63d
cmp qword [0x1800100d0], rbx
mov rcx, r12
movsx rax, word [0x1800100cc]
mov dl, byte [rbp + 7]
cmovne rcx, rax
add dl, 0x4b
mov qword [0x180010098], rcx
movsx ecx, byte [0x18001007b]
movsx eax, dl
imul eax, ecx
cmp word [0x1800100ac], bx
mov byte [0x18001007b], al
movsx eax, word [0x1800100cc]
jne 0x18057b5fd
movsx eax, byte [rbp + 0x6f]
mov byte [0x18001007b], al
jmp 0x18057b63d
mov ecx, dword [0x18001008c]
mov eax, dword [rbp - 0x49]
imul ecx, eax
mov eax, dword [rbp - 0x49]
mov dword [0x1800100c8], 0xc774263b
sub eax, ecx
mov dword [rbp - 0x49], eax
mov rcx, qword [0x180058568]
movsx rax, byte [0x18001005b]
imul rcx, rax
mov qword [0x180058568], rcx
lea rax, [rbp - 0x2d]
mov r9d, 0x40
lea r8, [rbp + 0xf]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x67]
or rcx, 0xffffffffffffffff
call fcn.18000e240
movzx ecx, byte [0x18001007a]
mov r8d, ebx
cmp ecx, edi
mov edx, ebx
mov cl, byte [0x18001007a]
mov r9d, eax
sete r8b
mov edi, 1
cmp cl, 6
sete dl
cmp r8d, edx
jb 0x18057b753
test r14d, r14d
je 0x18057b6d3
movsx rcx, byte [rbp + 0x6f]
mov rax, qword [str.bW_m]
add rcx, rdi
imul rax, rcx
mov ecx, 0xfe6ec4fd
mov qword [str.bW_m], rax
mov eax, dword [rbp - 0x31]
sub ecx, eax
add r14d, ecx
movzx ecx, byte [0x18001006a]
mov rax, qword [rbp - 0x39]
add rcx, 0x66
add rax, rcx
mov qword [rbp - 0x39], rax
jmp 0x18057b7a2
cmp byte [0x18001005f], bl
je 0x18057b6f5
mov esi, dword [rbp - 0x49]
mov al, byte [0x18001005e]
shr esi, 3
shr al, 2
mov byte [0x180010037], al
jmp 0x18057b7a2
mov rax, qword [0x180058568]
mov ecx, ebx
test rax, rax
sete cl
cmp ecx, dword [0x1800100dc]
jae 0x18057b72d
movsx eax, word [rbp - 0x45]
imul eax, eax, 0xc70c
movsxd rcx, eax
movzx eax, word [0x18001007c]
sub word [0x1800100a0], ax
mov qword [rbp + 0x6f], rcx
jmp 0x18057b7a2
mov eax, dword [0x180058550]
test eax, eax
je 0x18057b7a2
mov eax, dword [0x1800100d0]
add eax, 0xa40d
mov dword [rbp - 0x31], eax
mov al, byte [0x1804016be]
and byte [0x180010036], al
jmp 0x18057b7a2
mov eax, dword [0x180010088]
mov edx, ebx
test eax, eax
mov ecx, ebx
mov eax, dword [rbp - 0x49]
sete dl
test eax, eax
sete cl
cmp ecx, edx
ja 0x18057b781
movzx ecx, byte [0x18001006a]
mov rax, qword [0x1800100c0]
cmp rax, rcx
jl 0x18057b7a2
mov al, byte [0x180010037]
movzx esi, word [0x1800100f0]
mov byte [0x1803d8c9b], al
mov dword [0x1800100a4], 0x7d28
shl si, 5
test r9d, r9d
js 0x18057bb48
movzx ecx, byte [0x18001007a]
movzx edx, word [0x1800100b0]
movzx eax, dx
sub ax, cx
movzx ecx, ax
mov eax, edx
imul eax, ecx
mov word [0x1800100b0], ax
mov al, byte [0x18001007f]
test al, al
je 0x18057b7de
movzx eax, word [rbp + 0x7f]
jmp 0x18057b7e5
movsx eax, byte [0x18001007e]
mov dword [0x180058550], eax
mov ecx, ebx
mov rax, qword [rbp - 0x41]
mov r10d, 0x4aad
sub r12, rax
mov r9d, 0x28
mov rax, qword [rbp - 0x41]
mov r11d, 0xed4df7ce
add rax, r12
mov word [0x1800100b0], r10w
mov qword [rbp - 0x41], rax
mov al, byte [0x180010033]
add al, byte [0x1800100dc]
cmp dword [0x1800100a8], ebx
mov byte [0x180010033], al
movzx eax, word [0x1800100b4]
sete cl
movzx edx, cx
imul edx, eax
movzx eax, word [0x1800100d8]
mov rcx, qword [rbp - 0x39]
add rcx, r11
and ax, dx
xor ax, r9w
mov word [0x1800100f8], ax
movsx rax, word [0x1800100b4]
cmp rax, rcx
jne 0x18057b8ef
movzx r8d, si
movzx ecx, byte [0x180010033]
add ecx, r8d
cmp ecx, edi
jne 0x18057b8ef
mov al, byte [0x1800cc2ec]
mov ecx, ebx
mov byte [rbp + 0x77], al
mov rax, qword [rbp - 0x39]
add word [0x1800100f8], ax
mov al, byte [0x180010033]
add al, byte [0x1800100dc]
cmp dword [0x1800100a8], ebx
mov word [0x1800100b0], r10w
sete cl
mov byte [0x180010033], al
movzx eax, word [0x1800100b4]
movzx edx, cx
imul edx, eax
movzx eax, word [0x1800100d8]
mov rcx, qword [rbp - 0x39]
add rcx, r11
and ax, dx
xor ax, r9w
mov word [0x1800100f8], ax
movsx rax, word [0x1800100b4]
cmp rax, rcx
je 0x18057b872
movzx ecx, word [0x180058554]
mov edx, ebx
mov rax, qword [rbp - 0x41]
cmp rax, rcx
mov rax, qword [rbp - 0x41]
mov ecx, ebx
seta dl
cmp rax, 0x32
seta cl
cmp edx, ecx
jbe 0x18057b950
movsx eax, byte [rbp + 0x77]
mov ecx, 0x98
mov r10d, dword [rbp - 0x29]
imul r9d, eax, 0x1b
mov rax, qword [rbp - 9]
sub ax, cx
mov ecx, r10d
mov word [0x1800100a0], ax
movabs rax, 0xa44fac71265b3
imul rcx, rax
mov rax, qword [rbp - 0x11]
add rcx, rax
mov qword [rbp - 0x11], rcx
jmp 0x18057b954
mov r10d, dword [rbp - 0x29]
mov eax, dword [rbp - 0x19]
mov r12d, 0xfc
vmovsd xmm0, qword [rbp - 0x21]
vmovsd qword [r13], xmm0
mov dword [r13 + 8], eax
mov al, byte [rbp - 0x15]
movzx edx, si
mov byte [r13 + 0xc], al
add edx, r12d
movzx eax, byte [0x18001005e]
mov word [0x1800100ac], r12w
cmp eax, edx
jne 0x18057bac9
mov r11, qword [rbp - 1]
mov r15, qword [rbp + 7]
test r10d, r10d
jne 0x18057ba71
cmp dword [0x1800100dc], ebx
je 0x18057b9d1
movsx eax, r9b
sub eax, 0xc80e
mov qword [rbp - 0x41], 0xbe
cdqe
mov qword [rbp + 0x6f], rax
mov al, byte [0x18001005e]
xor byte [0x18001005b], al
jmp 0x18057ba71
cmp word [0x1800100b4], bx
je 0x18057ba3b
movzx ecx, word [0x1800100f4]
add ecx, 0x2c3e6981
mov dword [0x1800100a4], ecx
mov al, byte [0x18001006b]
mov r8b, byte [rbp + 0x77]
test al, al
movsx ecx, r15b
sete al
add r8b, al
mov eax, dword [rbp - 0x49]
movsx edx, al
xor r8b, r11b
mov rax, qword [rbp - 0x11]
imul edx, ecx
sub r8b, dl
test rax, rax
sete al
sub r8b, al
mov rax, qword [rbp - 0x39]
add r8b, 0xc
shl rax, 4
mov word [0x180010080], ax
mov byte [0x180010036], r8b
jmp 0x18057ba71
mov eax, dword [0x1800100a4]
mov ecx, dword [0x1800100dc]
lea eax, [rcx + 0x1a7bac65]
mov dword [0x1800100e4], eax
mov eax, ecx
mov rcx, qword [0x1800100c0]
add rcx, rax
mov rax, qword [0x1800100c0]
imul rax, rcx
mov qword [0x1800100c0], rax
mov rax, qword [0x180058568]
mov ecx, 0xc1
add ax, cx
mov word [0x1800100b4], ax
mov al, byte [0x18001006b]
movzx ecx, word [0x1800100b0]
mov eax, 0xa777
imul ecx, eax
movsx eax, word [0x180010080]
movzx esi, cx
mov edx, esi
lea ecx, [rsi + 0x31]
cmp eax, ecx
jne 0x18057bac9
movzx eax, byte [0x18001005e]
add edx, r12d
mov word [0x1800100ac], r12w
cmp eax, edx
je 0x18057b998
movzx eax, byte [0x18001007f]
mov edx, ebx
cmp rax, qword [0x1800100b8]
mov ecx, ebx
mov al, byte [0x18001007f]
setl dl
cmp al, 0x2d
setb cl
cmp edx, ecx
je 0x18057bb3f
call fcn.180008cfc
movzx eax, al
test rax, rax
je 0x18057bb16
mov rax, qword [rbp - 0x41]
and al, r14b
not al
mov byte [rbp + 0x6f], al
mov rax, qword [rbp - 0x39]
movsx eax, byte [rbp + 0x6f]
imul eax, eax, 0xffffffad
mov byte [rbp + 0x6f], al
jmp 0x18057bb45
mov al, byte [0x180010033]
movsx ecx, word [0x1800100cc]
add ecx, 0x4d
or al, cl
mov byte [0x180010033], al
mov rax, qword [rbp - 0x11]
sub eax, 0x8287
mov dword [0x180010088], eax
jmp 0x18057bb45
mov al, byte [0x18001006a]
mov r15b, dil
mov rdx, qword [rbp + 0x67]
or r12, 0xffffffffffffffff
mov rcx, r12
mov r8d, 0xd
call fcn.18000e340
mov r9d, dword [rbp - 0x2d]
lea rax, [rbp - 0x2d]
lea r8, [rbp + 0xf]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x67]
mov rcx, r12
call fcn.18000e240
call fcn.180009618
mov byte [0x18001007e], al
mov eax, dword [0x180010088]
not eax
test eax, eax
jne 0x18057bb99
test r14d, r14d
jne 0x18057bb99
mov edi, ebx
movsx ecx, word [0x1800100cc]
not ecx
cmp edi, ecx
movzx ecx, si
setne bl
cmp ecx, ebx
ja 0x18057bbbd
mov ecx, dword [0x1800100f0]
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov byte [rbp + 0x6f], al
mov al, r15b
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret