Function at 0x478990
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da846
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x51a3c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 0
push eax
push 0
push 1
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
mov dword [ebp - 0x14], 0
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call fcn.004762a0
mov ecx, eax
test ecx, ecx
je 0x478c4d
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ebx, dword [ebp + 8]
add eax, 0x10
mov dword [ebx], eax
mov esi, dword [ebp - 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 1
test esi, esi
je 0x478c28
mov dword [ebp - 4], 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
cmp esi, 0x7fffffff
ja 0x478c57
cmp esi, 0x1000
jb 0x478a70
lea eax, [esi + 0x23]
cmp eax, esi
jbe 0x478c5c
push eax
call fcn.004a4277
add esp, 4
test eax, eax
je 0x478c75
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x478a7b
push esi
call fcn.004a4277
add esp, 4
mov edi, eax
push esi
lea eax, [edi + esi]
mov dword [ebp - 0x2c], edi
push 0
push edi
mov dword [ebp - 0x24], eax
call fcn.004a8e20
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
push edi
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test edi, edi
je 0x478b97
mov esi, edi
lea ecx, [esi + 1]
lea ebx, [ebx]
mov al, byte [esi]
inc esi
test al, al
jne 0x478ac0
sub esi, ecx
je 0x478b97
mov eax, dword [ebx]
mov edx, edi
sub edx, eax
mov dword [ebp - 0x1c], edx
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x20], ecx
test esi, esi
js 0x478c61
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or eax, ecx
jge 0x478b02
push esi
mov ecx, ebx
call fcn.00479c10
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx]
cmp edx, dword [ebp - 0x20]
ja 0x478b40
lea ecx, [eax + edx]
test eax, eax
jne 0x478b1d
call fcn.004b0efe
mov dword [eax], 0x16
jmp 0x478b7c
test ecx, ecx
jne 0x478b2e
call fcn.004b0efe
mov dword [eax], 0x16
jmp 0x478b7c
cmp dword [eax - 8], esi
jb 0x478b71
push esi
push ecx
push eax
call fcn.004a88a0
add esp, 0xc
jmp 0x478b81
mov ecx, dword [eax - 8]
test eax, eax
jne 0x478b54
call fcn.004b0efe
mov dword [eax], 0x16
jmp 0x478b7c
cmp ecx, esi
jb 0x478b65
push esi
push edi
push eax
call fcn.004a88a0
add esp, 0xc
jmp 0x478b81
push ecx
push 0
push eax
call fcn.004a8e20
add esp, 0xc
call fcn.004b0efe
mov dword [eax], 0x22
call fcn.004aba6f
mov eax, dword [ebx]
cmp esi, dword [eax - 8]
jg 0x478c61
mov dword [eax - 0xc], esi
mov eax, dword [ebx]
mov byte [esi + eax], 0
jmp 0x478be5
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
lea edx, [eax - 0x10]
mov esi, dword [edx]
je 0x478be5
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
jge 0x478bc5
cmp dword [eax - 8], 0
jl 0x478c6b
mov dword [eax - 0xc], 0
mov eax, dword [ebx]
mov byte [eax], 0
jmp 0x478be5
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x478bd9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
test edi, edi
je 0x478c21
mov ecx, dword [ebp - 0x24]
sub ecx, edi
cmp ecx, 0x1000
jb 0x478c0c
mov edx, dword [edi - 4]
add ecx, 0x23
sub edi, edx
lea eax, [edi - 4]
cmp eax, 0x1f
ja 0x478c75
mov edi, edx
push ecx
push edi
call fcn.004a42a7
add esp, 8
jmp 0x478c21
mov dword [ebp - 4], 0
push 0x4f32b7
push 0x4e0ae4
mov ecx, ebx
call fcn.00479cb0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00475e90
call fcn.0040b770
call fcn.00408c90
push 0x80070057
call fcn.00475e90
push 0x80070057
call fcn.00475e90
call fcn.004aba7f
int3