Function at 0x14001bb20
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Read file on windows
Run powershell expression

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2fb0]
mov eax, 0x30b0
call fcn.140051c10
sub rsp, rax
mov rax, qword [0x14007b040]
xor rax, rsp
mov qword [rbp + 0x2fa0], rax
mov r14d, ecx
mov dword [rsp + 0x60], ecx
xor ebx, ebx
mov r12d, ebx
mov dword [rsp + 0x50], ebx
lea r8, str.____Found_ImportCode_string:_Invoke_RestMethod.
lea rdx, str.Invoke_RestMethod
lea rcx, [rbp + 0x170]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Invoke_Expression.
lea rdx, str.Invoke_Expression
lea rcx, [rbp + 0x1b0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_import_base64.
lea rdx, str.import_base64
lea rcx, [rbp + 0x1f0]
call fcn.14001e5a0
nop
lea r8, [0x14005b090]
lea rdx, [0x14005b070]
lea rcx, [rbp + 0x230]
call fcn.14001e5a0
nop
lea r8, [0x14005b110]
lea rdx, [0x14005b0f0]
lea rcx, [rbp + 0x270]
call fcn.14001e5a0
nop
lea r8, [0x14005b190]
lea rdx, [0x14005b170]
lea rcx, [rbp + 0x2b0]
call fcn.14001e5a0
nop
lea r8, [0x14005b210]
lea rdx, [0x14005b1f0]
lea rcx, [rbp + 0x2f0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Convert.FromBase32String.
lea rdx, str.Convert.FromBase32String
lea rcx, [rbp + 0x330]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Convert.FromBase64String.
lea rdx, str.Convert.FromBase64String
lea rcx, [rbp + 0x370]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Base64.getDecoder__.
lea rdx, str.Base64.getDecoder__
lea rcx, [rbp + 0x3b0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Base32.getDecoder__.
lea rdx, str.Base32.getDecoder__
lea rcx, [rbp + 0x3f0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_js_base64.
lea rdx, str.js_base64
lea rcx, [rbp + 0x430]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_js_base32.
lea rdx, str.js_base32
lea rcx, [rbp + 0x470]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_base64_js.
lea rdx, str.base64_js
lea rcx, [rbp + 0x4b0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_base32_js.
lea rdx, str.base32_js
lea rcx, [rbp + 0x4f0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_base64.b64decode.
lea rdx, str.base64.b64decode
lea rcx, [rbp + 0x530]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_base32.b32decode.
lea rdx, str.base32.b32decode
lea rcx, [rbp + 0x570]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_base64.b64encode.
lea rdx, str.base64.b64encode
lea rcx, [rbp + 0x5b0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_base32.b32encode.
lea rdx, str.base32.b32encode
lea rcx, [rbp + 0x5f0]
call fcn.14001e5a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x630], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x640], xmm1
lea r8d, [rbx + 0xf]
lea rdx, str.Base64.decode64
lea rcx, [rbp + 0x630]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x650], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x660], xmm1
lea r8d, [rbx + 0x2f]
lea rdx, str.____Found_ImportCode_string:_Base64.decode64.
lea rcx, [rbp + 0x650]
call fcn.1400066a0
nop
lea r8, str.____Found_ImportCode_string:_Base32.decode32.
lea rdx, str.Base32.decode32
lea rcx, [rbp + 0x670]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Base64.encode64.
lea rdx, str.Base64.encode64
lea rcx, [rbp + 0x6b0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Base32.encode32.
lea rdx, str.Base32.encode32
lea rcx, [rbp + 0x6f0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_encoding_base64.
lea rdx, str.encoding_base64
lea rcx, [rbp + 0x730]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_encoding_base32.
lea rdx, str.encoding_base32
lea rcx, [rbp + 0x770]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_decoding_base32.
lea rdx, str.decoding_base32
lea rcx, [rbp + 0x7b0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_decoding_base64.
lea rdx, str.decoding_base64
lea rcx, [rbp + 0x7f0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_decode_base64.
lea rdx, str.decode_base64
lea rcx, [rbp + 0x830]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_decode_base32.
lea rdx, str.decode_base32
lea rcx, [rbp + 0x870]
call fcn.14001e5a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x8b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x8c0], xmm1
lea r8d, [rbx + 0xd]
lea rdx, str.encode_base64
lea rcx, [rbp + 0x8b0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x8d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x8e0], xmm1
lea r8d, [rbx + 0x2d]
lea rdx, str.____Found_ImportCode_string:_encode_base64.
lea rcx, [rbp + 0x8d0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x8f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x900], xmm1
lea r8d, [rbx + 0xd]
lea rdx, str.encode_base32
lea rcx, [rbp + 0x8f0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x910], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x920], xmm1
lea r8d, [rbx + 0x2d]
lea rdx, str.____Found_ImportCode_string:_encode_base32.
lea rcx, [rbp + 0x910]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x930], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x940], xmm1
lea r8d, [rbx + 0xe]
lea rdx, str.base64::decode
lea rcx, [rbp + 0x930]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x950], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x960], xmm1
lea r8d, [rbx + 0x2e]
lea rdx, str.____Found_ImportCode_string:_base64::decode.
lea rcx, [rbp + 0x950]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x970], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x980], xmm1
lea r8d, [rbx + 0xe]
lea rdx, str.base32::decode
lea rcx, [rbp + 0x970]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x990], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x9a0], xmm1
lea r8d, [rbx + 0x2e]
lea rdx, str.____Found_ImportCode_string:_base32::decode.
lea rcx, [rbp + 0x990]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x9b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x9c0], xmm1
lea r8d, [rbx + 0xe]
lea rdx, str.base64::encode
lea rcx, [rbp + 0x9b0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x9d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x9e0], xmm1
lea r8d, [rbx + 0x2e]
lea rdx, str.____Found_ImportCode_string:_base64::encode.
lea rcx, [rbp + 0x9d0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x9f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa00], xmm1
lea r8d, [rbx + 0xe]
lea rdx, str.base64::encode
lea rcx, [rbp + 0x9f0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xa10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa20], xmm1
lea r8d, [rbx + 0x2e]
lea rdx, str.____Found_ImportCode_string:_base64::encode.
lea rcx, [rbp + 0xa10]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xa30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa40], xmm1
lea r8d, [rbx + 0xd]
lea rdx, str.Base64.decode
lea rcx, [rbp + 0xa30]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xa50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa60], xmm1
lea r8d, [rbx + 0x2d]
lea rdx, str.____Found_ImportCode_string:_Base64.decode.
lea rcx, [rbp + 0xa50]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xa70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa80], xmm1
lea r8d, [rbx + 0xd]
lea rdx, str.Base64.encode
lea rcx, [rbp + 0xa70]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xa90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xaa0], xmm1
lea r8d, [rbx + 0x2d]
lea rdx, str.____Found_ImportCode_string:_Base64.encode.
lea rcx, [rbp + 0xa90]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xab0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xac0], xmm1
lea r8d, [rbx + 0xd]
lea rdx, str.Base32.decode
lea rcx, [rbp + 0xab0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xad0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xae0], xmm1
lea r8d, [rbx + 0x2d]
lea rdx, str.____Found_ImportCode_string:_Base32.decode.
lea rcx, [rbp + 0xad0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xaf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xb00], xmm1
lea r8d, [rbx + 0xd]
lea rdx, str.Base32.encode
lea rcx, [rbp + 0xaf0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xb20], xmm1
lea r8d, [rbx + 0x2d]
lea rdx, str.____Found_ImportCode_string:_Base32.encode.
lea rcx, [rbp + 0xb10]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xb40], xmm1
lea r8d, [rbx + 0x15]
lea rdx, str.NSString_base64Decode
lea rcx, [rbp + 0xb30]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xb60], xmm1
lea r8d, [rbx + 0x35]
lea rdx, str.____Found_ImportCode_string:_NSString_base64Decode.
lea rcx, [rbp + 0xb50]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xb80], xmm1
lea r8d, [rbx + 0x15]
lea rdx, str.NSString_base32Decode
lea rcx, [rbp + 0xb70]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xba0], xmm1
lea r8d, [rbx + 0x35]
lea rdx, str.____Found_ImportCode_string:_NSString_base32Decode.
lea rcx, [rbp + 0xb90]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xbb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xbc0], xmm1
lea r8d, [rbx + 0x15]
lea rdx, str.NSString_base32Encode
lea rcx, [rbp + 0xbb0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xbd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xbe0], xmm1
lea r8d, [rbx + 0x35]
lea rdx, str.____Found_ImportCode_string:_NSString_base32Encode.
lea rcx, [rbp + 0xbd0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xbf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc00], xmm1
lea r8d, [rbx + 0x15]
lea rdx, str.NSString_base64Encode
lea rcx, [rbp + 0xbf0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xc10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc20], xmm1
lea r8d, [rbx + 0x35]
lea rdx, str.____Found_ImportCode_string:_NSString_base64Encode.
lea rcx, [rbp + 0xc10]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xc30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc40], xmm1
lea r8d, [rbx + 0x2f]
lea rdx, str.com.google.common.io.BaseEncoding.base64.decode
lea rcx, [rbp + 0xc30]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xc50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc60], xmm1
lea r8d, [rbx + 0x4f]
lea rdx, str.____Found_ImportCode_string:_com.google.common.io.BaseEncoding.base64.decode.
lea rcx, [rbp + 0xc50]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xc70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc80], xmm1
lea r8d, [rbx + 0x2f]
lea rdx, str.com.google.common.io.BaseEncoding.base32.decode
lea rcx, [rbp + 0xc70]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xc90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xca0], xmm1
lea r8d, [rbx + 0x4f]
lea rdx, str.____Found_ImportCode_string:_com.google.common.io.BaseEncoding.base32.decode.
lea rcx, [rbp + 0xc90]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xcb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xcc0], xmm1
lea r8d, [rbx + 0x2f]
lea rdx, str.com.google.common.io.BaseEncoding.base32.encode
lea rcx, [rbp + 0xcb0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xcd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xce0], xmm1
lea r8d, [rbx + 0x4f]
lea rdx, str.____Found_ImportCode_string:_com.google.common.io.BaseEncoding.base32.encode.
lea rcx, [rbp + 0xcd0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xcf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xd00], xmm1
lea r8d, [rbx + 0x2f]
lea rdx, str.com.google.common.io.BaseEncoding.base64.encode
lea rcx, [rbp + 0xcf0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xd20], xmm1
lea r8d, [rbx + 0x4f]
lea rdx, str.____Found_ImportCode_string:_com.google.common.io.BaseEncoding.base64.encode.
lea rcx, [rbp + 0xd10]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xd40], xmm1
lea r8d, [rbx + 0x21]
lea rdx, str.Codec.Binary.Base64.String.decode
lea rcx, [rbp + 0xd30]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xd60], xmm1
lea r8d, [rbx + 0x41]
lea rdx, str.____Found_ImportCode_string:_Codec.Binary.Base64.String.decode.
lea rcx, [rbp + 0xd50]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xd80], xmm1
lea r8d, [rbx + 0x21]
lea rdx, str.Codec.Binary.Base32.String.decode
lea rcx, [rbp + 0xd70]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xda0], xmm1
lea r8d, [rbx + 0x41]
lea rdx, str.____Found_ImportCode_string:_Codec.Binary.Base32.String.decode.
lea rcx, [rbp + 0xd90]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xdb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xdc0], xmm1
lea r8d, [rbx + 0x21]
lea rdx, str.Codec.Binary.Base64.String.encode
lea rcx, [rbp + 0xdb0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xdd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xde0], xmm1
lea r8d, [rbx + 0x41]
lea rdx, str.____Found_ImportCode_string:_Codec.Binary.Base64.String.encode.
lea rcx, [rbp + 0xdd0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xdf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe00], xmm1
lea r8d, [rbx + 0x21]
lea rdx, str.Codec.Binary.Base32.String.encode
lea rcx, [rbp + 0xdf0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe20], xmm1
lea r8d, [rbx + 0x41]
lea rdx, str.____Found_ImportCode_string:_Codec.Binary.Base32.String.encode.
lea rcx, [rbp + 0xe10]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe40], xmm1
lea r8d, [rbx + 0x18]
lea rdx, str.:base64.decode_to_string
lea rcx, [rbp + 0xe30]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe60], xmm1
lea r8d, [rbx + 0x38]
lea rdx, str.____Found_ImportCode_string:_:base64.decode_to_string.
lea rcx, [rbp + 0xe50]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe80], xmm1
lea r8d, [rbx + 0x18]
lea rdx, str.:base32.decode_to_string
lea rcx, [rbp + 0xe70]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xea0], xmm1
lea r8d, [rbx + 0x38]
lea rdx, str.____Found_ImportCode_string:_:base32.decode_to_string.
lea rcx, [rbp + 0xe90]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xeb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xec0], xmm1
lea r8d, [rbx + 0x18]
lea rdx, str.:base32.encode_to_string
lea rcx, [rbp + 0xeb0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xed0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xee0], xmm1
lea r8d, [rbx + 0x38]
lea rdx, str.____Found_ImportCode_string:_:base32.encode_to_string.
lea rcx, [rbp + 0xed0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xef0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xf00], xmm1
lea r8d, [rbx + 0x18]
lea rdx, str.:base64.encode_to_string
lea rcx, [rbp + 0xef0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xf20], xmm1
lea r8d, [rbx + 0x38]
lea rdx, str.____Found_ImportCode_string:_:base64.encode_to_string.
lea rcx, [rbp + 0xf10]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xf40], xmm1
lea r8d, [rbx + 0x13]
lea rdx, str.Base64.base64decode
lea rcx, [rbp + 0xf30]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xf60], xmm1
lea r8d, [rbx + 0x33]
lea rdx, str.____Found_ImportCode_string:_Base64.base64decode.
lea rcx, [rbp + 0xf50]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xf80], xmm1
lea r8d, [rbx + 0x13]
lea rdx, str.Base64.base64encode
lea rcx, [rbp + 0xf70]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xfa0], xmm1
lea r8d, [rbx + 0x33]
lea rdx, str.____Found_ImportCode_string:_Base64.base64encode.
lea rcx, [rbp + 0xf90]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xfb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xfc0], xmm1
lea r8d, [rbx + 0x13]
lea rdx, str.Base32.base32encode
lea rcx, [rbp + 0xfb0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xfd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xfe0], xmm1
lea r8d, [rbx + 0x33]
lea rdx, str.____Found_ImportCode_string:_Base32.base32encode.
lea rcx, [rbp + 0xfd0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xff0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1000], xmm1
lea r8d, [rbx + 0x13]
lea rdx, str.Base32.base32decode
lea rcx, [rbp + 0xff0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1010], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1020], xmm1
lea r8d, [rbx + 0x33]
lea rdx, str.____Found_ImportCode_string:_Base32.base32decode.
lea rcx, [rbp + 0x1010]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1030], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1040], xmm1
lea r8d, [rbx + 6]
lea rdx, str.btoa__
lea rcx, [rbp + 0x1030]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1050], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1060], xmm1
lea r8d, [rbx + 0x26]
lea rdx, str.____Found_ImportCode_string:_btoa__.
lea rcx, [rbp + 0x1050]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1070], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1080], xmm1
lea r8d, [rbx + 6]
lea rdx, str.atob__
lea rcx, [rbp + 0x1070]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1090], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x10a0], xmm1
lea r8d, [rbx + 0x26]
lea rdx, str.____Found_ImportCode_string:_atob__.
lea rcx, [rbp + 0x1090]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x10b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x10c0], xmm1
lea r8d, [rbx + 0x18]
lea rdx, str.Convert.ToBase64String__
lea rcx, [rbp + 0x10b0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x10d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x10e0], xmm1
lea r8d, [rbx + 0x38]
lea rdx, str.____Found_ImportCode_string:_Convert.ToBase64String__.
lea rcx, [rbp + 0x10d0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x10f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1100], xmm1
lea r8d, [rbx + 0x18]
lea rdx, str.Convert.ToBase32String__
lea rcx, [rbp + 0x10f0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1120], xmm1
lea r8d, [rbx + 0x38]
lea rdx, str.____Found_ImportCode_string:_Convert.ToBase32String__.
lea rcx, [rbp + 0x1110]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1130], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1140], xmm1
lea r8d, [rbx + 0x1a]
lea rdx, str.Convert.FromBase64String__
lea rcx, [rbp + 0x1130]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1150], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1160], xmm1
lea r8d, [rbx + 0x3a]
lea rdx, str.____Found_ImportCode_string:_Convert.FromBase64String__.
lea rcx, [rbp + 0x1150]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1170], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1180], xmm1
lea r8d, [rbx + 0x1a]
lea rdx, str.Convert.FromBase32String__
lea rcx, [rbp + 0x1170]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1190], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x11a0], xmm1
lea r8d, [rbx + 0x3a]
lea rdx, str.____Found_ImportCode_string:_Convert.FromBase32String__.
lea rcx, [rbp + 0x1190]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x11b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x11c0], xmm1
lea r8d, [rbx + 0x16]
lea rdx, str.ConvertTo_Base64String
lea rcx, [rbp + 0x11b0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x11d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x11e0], xmm1
lea r8d, [rbx + 0x36]
lea rdx, str.____Found_ImportCode_string:_ConvertTo_Base64String.
lea rcx, [rbp + 0x11d0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x11f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1200], xmm1
lea r8d, [rbx + 0x16]
lea rdx, str.ConvertTo_Base32String
lea rcx, [rbp + 0x11f0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1210], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1220], xmm1
lea r8d, [rbx + 0x36]
lea rdx, str.____Found_ImportCode_string:_ConvertTo_Base32String.
lea rcx, [rbp + 0x1210]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1230], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1240], xmm1
lea r8d, [rbx + 0x18]
lea rdx, str.ConvertFrom_Base32String
lea rcx, [rbp + 0x1230]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1250], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1260], xmm1
lea r8d, [rbx + 0x38]
lea rdx, str.____Found_ImportCode_string:_ConvertFrom_Base32String.
lea rcx, [rbp + 0x1250]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1270], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1280], xmm1
lea r8d, [rbx + 0x18]
lea rdx, str.ConvertFrom_Base64String
lea rcx, [rbp + 0x1270]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1290], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x12a0], xmm1
lea r8d, [rbx + 0x38]
lea rdx, str.____Found_ImportCode_string:_ConvertFrom_Base64String.
lea rcx, [rbp + 0x1290]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x12b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x12c0], xmm1
lea r8d, [rbx + 0xc]
lea rdx, str.base64decode
lea rcx, [rbp + 0x12b0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x12d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x12e0], xmm1
lea r8d, [rbx + 0x2c]
lea rdx, str.____Found_ImportCode_string:_base64decode.
lea rcx, [rbp + 0x12d0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x12f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1300], xmm1
lea r8d, [rbx + 0xc]
lea rdx, str.base64encode
lea rcx, [rbp + 0x12f0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1310], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1320], xmm1
lea r8d, [rbx + 0x2c]
lea rdx, str.____Found_ImportCode_string:_base64encode.
lea rcx, [rbp + 0x1310]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1330], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1340], xmm1
lea r8d, [rbx + 0xc]
lea rdx, str.base32decode
lea rcx, [rbp + 0x1330]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1350], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1360], xmm1
lea r8d, [rbx + 0x2c]
lea rdx, str.____Found_ImportCode_string:_base32decode.
lea rcx, [rbp + 0x1350]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1370], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1380], xmm1
lea r8d, [rbx + 0xc]
lea rdx, str.base32encode
lea rcx, [rbp + 0x1370]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1390], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x13a0], xmm1
lea r8d, [rbx + 0x2c]
lea rdx, str.____Found_ImportCode_string:_base32encode.
lea rcx, [rbp + 0x1390]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x13b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x13c0], xmm1
lea r8d, [rbx + 0x33]
lea rdx, str.org.apache.commons.codec.binary.Base64.decodeBase64
lea rcx, [rbp + 0x13b0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x13d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x13e0], xmm1
lea r8d, [rbx + 0x53]
lea rdx, str.____Found_ImportCode_string:_org.apache.commons.codec.binary.Base64.decodeBase64.
lea rcx, [rbp + 0x13d0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x13f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1400], xmm1
lea r8d, [rbx + 0x33]
lea rdx, str.org.apache.commons.codec.binary.Base32.decodeBase32
lea rcx, [rbp + 0x13f0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1410], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1420], xmm1
lea r8d, [rbx + 0x53]
lea rdx, str.____Found_ImportCode_string:_org.apache.commons.codec.binary.Base32.decodeBase32.
lea rcx, [rbp + 0x1410]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1430], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1440], xmm1
lea r8d, [rbx + 0x33]
lea rdx, str.org.apache.commons.codec.binary.Base32.encodeBase32
lea rcx, [rbp + 0x1430]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1450], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1460], xmm1
lea r8d, [rbx + 0x53]
lea rdx, str.____Found_ImportCode_string:_org.apache.commons.codec.binary.Base32.encodeBase32.
lea rcx, [rbp + 0x1450]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1470], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1480], xmm1
lea r8d, [rbx + 0x33]
lea rdx, str.org.apache.commons.codec.binary.Base64.encodeBase64
lea rcx, [rbp + 0x1470]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1490], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x14a0], xmm1
lea r8d, [rbx + 0x53]
lea rdx, str.____Found_ImportCode_string:_org.apache.commons.codec.binary.Base64.encodeBase64.
lea rcx, [rbp + 0x1490]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x14b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x14c0], xmm1
lea r8d, [rbx + 0x10]
lea rdx, str.base64Url.decode
lea rcx, [rbp + 0x14b0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x14d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x14e0], xmm1
lea r8d, [rbx + 0x30]
lea rdx, str.____Found_ImportCode_string:_base64Url.decode.
lea rcx, [rbp + 0x14d0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x14f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1500], xmm1
lea r8d, [rbx + 0x10]
lea rdx, str.base64Url.encode
lea rcx, [rbp + 0x14f0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1510], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1520], xmm1
lea r8d, [rbx + 0x30]
lea rdx, str.____Found_ImportCode_string:_base64Url.encode.
lea rcx, [rbp + 0x1510]
call fcn.1400066a0
nop
lea r8, str.____Found_ImportCode_string:_base32Url.decode.
lea rdx, str.base32Url.decode
lea rcx, [rbp + 0x1530]
call fcn.14001e5a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1570], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1580], xmm1
lea r8d, [rbx + 0x10]
lea rdx, str.base32Url.encode
lea rcx, [rbp + 0x1570]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1590], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x15a0], xmm1
lea r8d, [rbx + 0x30]
lea rdx, str.____Found_ImportCode_string:_base32Url.encode.
lea rcx, [rbp + 0x1590]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x15b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x15c0], xmm1
lea r8d, [rbx + 0x46]
lea rdx, str.System.Text.Encoding.Default.GetString_System.Convert.FromBase64String
lea rcx, [rbp + 0x15b0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x15d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x15e0], xmm1
lea r8d, [rbx + 0x66]
lea rdx, str.____Found_ImportCode_string:_System.Text.Encoding.Default.GetString_System.Convert.FromBase64String.
lea rcx, [rbp + 0x15d0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x15f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1600], xmm1
lea r8d, [rbx + 0x44]
lea rdx, str.System.Text.Encoding.Default.GetString_System.Convert.ToBase64String
lea rcx, [rbp + 0x15f0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1610], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1620], xmm1
lea r8d, [rbx + 0x64]
lea rdx, str.____Found_ImportCode_string:_System.Text.Encoding.Default.GetString_System.Convert.ToBase64String.
lea rcx, [rbp + 0x1610]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1630], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1640], xmm1
lea r8d, [rbx + 0x46]
lea rdx, str.System.Text.Encoding.Default.GetString_System.Convert.FromBase32String
lea rcx, [rbp + 0x1630]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1650], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1660], xmm1
lea r8d, [rbx + 0x66]
lea rdx, str.____Found_ImportCode_string:_System.Text.Encoding.Default.GetString_System.Convert.FromBase32String.
lea rcx, [rbp + 0x1650]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1670], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1680], xmm1
lea r8d, [rbx + 0x44]
lea rdx, str.System.Text.Encoding.Default.GetString_System.Convert.ToBase32String
lea rcx, [rbp + 0x1670]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1690], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x16a0], xmm1
lea r8d, [rbx + 0x64]
lea rdx, str.____Found_ImportCode_string:_System.Text.Encoding.Default.GetString_System.Convert.ToBase32String.
lea rcx, [rbp + 0x1690]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x16b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x16c0], xmm1
lea r8d, [rbx + 0x12]
lea rdx, str.base64url:decode_1
lea rcx, [rbp + 0x16b0]
call fcn.1400066a0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x16d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x16e0], xmm1
lea r8d, [rbx + 0x32]
lea rdx, str.____Found_ImportCode_string:_base64url:decode_1.
lea rcx, [rbp + 0x16d0]
call fcn.1400066a0
nop
lea r8, str.____Found_ImportCode_string:_base32url:decode_1.
lea rdx, str.base32url:decode_1
lea rcx, [rbp + 0x16f0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_base32url:encode_1.
lea rdx, str.base32url:encode_1
lea rcx, [rbp + 0x1730]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_base64url:encode_1.
lea rdx, str.base64url:encode_1
lea rcx, [rbp + 0x1770]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_base64dec_2.
lea rdx, str.base64dec_2
lea rcx, [rbp + 0x17b0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_base32dec_2.
lea rdx, str.base32dec_2
lea rcx, [rbp + 0x17f0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_jsonlite::base64_decode.
lea rdx, str.jsonlite::base64_decode
lea rcx, [rbp + 0x1830]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_jsonlite::base32_decode.
lea rdx, str.jsonlite::base32_decode
lea rcx, [rbp + 0x1870]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_jsonlite::base64_encode.
lea rdx, str.jsonlite::base64_encode
lea rcx, [rbp + 0x18b0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_jsonlite::base32_encode.
lea rdx, str.jsonlite::base32_encode
lea rcx, [rbp + 0x18f0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Base64.decode_bytes.
lea rdx, str.Base64.decode_bytes
lea rcx, [rbp + 0x1930]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Base32.decode_bytes.
lea rdx, str.Base32.decode_bytes
lea rcx, [rbp + 0x1970]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Base32.encode_bytes.
lea rdx, str.Base32.encode_bytes
lea rcx, [rbp + 0x19b0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Base32.decode_bytes.
lea rdx, str.Base32.decode_bytes
lea rcx, [rbp + 0x19f0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Ada.Strings.Base64.Decoder.Decode.
lea rdx, str.Ada.Strings.Base64.Decoder.Decode
lea rcx, [rbp + 0x1a30]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Ada.Strings.Base64.Encoder.Encode.
lea rdx, str.Ada.Strings.Base64.Encoder.Encode
lea rcx, [rbp + 0x1a70]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Ada.Strings.Base32.Decoder.Decode.
lea rdx, str.Ada.Strings.Base32.Decoder.Decode
lea rcx, [rbp + 0x1ab0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Ada.Strings.Base32.Encoder.Encode.
lea rdx, str.Ada.Strings.Base32.Encoder.Encode
lea rcx, [rbp + 0x1af0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_decode64_char.
lea rdx, str.decode64_char
lea rcx, [rbp + 0x1b30]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_encode64_char.
lea rdx, str.encode64_char
lea rcx, [rbp + 0x1b70]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_decode32_char.
lea rdx, str.decode32_char
lea rcx, [rbp + 0x1bb0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_encode32_char.
lea rdx, str.encode32_char
lea rcx, [rbp + 0x1bf0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Base64.decode_string.
lea rdx, str.Base64.decode_string
lea rcx, [rbp + 0x1c30]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Base32.decode_string.
lea rdx, str.Base32.decode_string
lea rcx, [rbp + 0x1c70]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Base32.encode_string.
lea rdx, str.Base32.encode_string
lea rcx, [rbp + 0x1cb0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_Base64.encode_string.
lea rdx, str.Base64.encode_string
lea rcx, [rbp + 0x1cf0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_base64_decode.
lea rdx, str.base64_decode
lea rcx, [rbp + 0x1d30]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_base64_encode.
lea rdx, str.base64_encode
lea rcx, [rbp + 0x1d70]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_base32_decode.
lea rdx, str.base32_decode
lea rcx, [rbp + 0x1db0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_base32_encode.
lea rdx, str.base32_encode
lea rcx, [rbp + 0x1df0]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_import_base64.
lea rdx, str.import_base64
lea rcx, [rbp + 0x1e30]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_base64.b32encode.
lea rdx, str.base64.b32encode
lea rcx, [rbp + 0x1e70]
call fcn.14001e5a0
nop
lea r8, str.____Found_ImportCode_string:_base64.b32decode.
lea rdx, str.base64.b32decode
lea rcx, [rbp + 0x1eb0]
call fcn.14001e5a0
nop
lea rcx, [rbp + 0x1ef0]
call fcn.14001e640
nop
lea rcx, [rbp + 0x1f30]
call fcn.14001e6c0
nop
lea rax, [rbp + 0x170]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x1f70]
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x28]
call fcn.14001e400
nop
lea r9, [0x14001dec0]
lea edx, [rbx + 0x40]
lea r8d, [rbx + 0x78]
lea rcx, [rbp + 0x170]
call fcn.14005134c
mov edx, r14d
lea rcx, [rbp + 0x130]
call fcn.14001ba60
nop
mov r8, rax
lea rdx, str.memory_scanner.exe__p
lea rcx, [rbp + 0x110]
call fcn.14001e730
nop
lea rcx, [rbp + 0x130]
call fcn.1400058e0
mov qword ds:[rbp - 0x68], 0x18
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x60], rbx
xor r9d, r9d
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r8d, r8d
lea edx, [rbx + 1]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword ds:[rbp - 0x10], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x48], rax
psrldq xmm0, 4
movd eax, xmm0
or eax, 0x101
mov dword [rbp + 0x2c], eax
mov word [rbp + 0x30], bx
lea rcx, [rbp + 0x110]
call fcn.140005550
mov rdx, rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14001de30
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x1fa0]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x1fa0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001de08
nop word [rax + rax]
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x14001de08
mov r9d, eax
shr r9, 1
lea rax, [rbp + 0x1fa0]
add rax, r9
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xor r10d, r10d
mov qword [rbp + 0xc0], r10
mov qword [rbp + 0xc8], r10
lea rcx, [rbp + 0x1fa0]
cmp rcx, rax
jne 0x14001d94a
mov r13d, r10d
mov qword [rsp + 0x78], r10
mov qword [rbp + 0xc0], r10
mov eax, 7
mov qword [rbp + 0xc8], rax
mov word [rbp + 0xb0], r10w
jmp 0x14001d973
lea rdx, [rbp + 0x1fa0]
lea rcx, [rbp + 0xb0]
call fcn.14001b2c0
mov rax, qword [rbp + 0xc8]
mov r13, qword [rbp + 0xc0]
mov qword [rsp + 0x78], r13
xor r10d, r10d
mov qword [rsp + 0x70], rax
mov rbx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x80], rax
cmp rbx, rax
je 0x14001ddcd
mov rax, qword [rbp + 0xb0]
mov qword [rbp - 0x70], rax
nop dword [rax + rax]
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x14001d9b7
mov rcx, qword [rbx]
mov rdx, rcx
lea r8, [rcx + rax*2]
jmp 0x14001d9be
lea r8, [rbx + rax*2]
mov rdx, rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r10
mov qword [rbp + 0xe8], r10
cmp rdx, r8
jne 0x14001d9fc
mov rdi, r10
mov qword [rbp + 0xe0], r10
mov r15d, 7
mov qword [rbp + 0xe8], r15
mov word [rbp + 0xd0], r10w
jmp 0x14001da1f
sub r8, rdx
sar r8, 1
lea rcx, [rbp + 0xd0]
call fcn.1400066a0
mov r15, qword [rbp + 0xe8]
mov rdi, qword [rbp + 0xe0]
xor r10d, r10d
lea r9, [rbp + 0x1f9a]
mov r8d, r14d
nop dword [rax]
add r9, 0xfffffffffffffffe
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x14001da30
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r10
mov qword [rbp + 0xa8], r10
lea rax, [rbp + 0x1f9a]
cmp r9, rax
jne 0x14001daa4
mov qword [rbp + 0xa0], r10
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], r10w
jmp 0x14001dac5
lea r8, ds:[rbp + 0x1f9a]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp + 0x90]
call fcn.1400066a0
or r12d, 3
lea r8, str._on_process_with_pid:
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x150]
call fcn.140007f80
nop
lea r9, [rbp + 0x90]
mov r8, rax
lea rcx, [rbp + 0xf0]
call fcn.140015400
nop
mov r8d, 0x13
lea rdx, str.._This_is_bannable_
lea rcx, [rbp + 0xf0]
call fcn.140007e40
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xor ecx, ecx
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rcx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 7
mov word [rax], cx
or r12d, 0xc
lea rcx, [rbp + 0xf0]
call fcn.1400058e0
nop
lea rcx, [rbp + 0x150]
call fcn.1400058e0
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x14001dbb2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001dbad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de8f
call fcn.140050f60
lea rax, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rax, qword [rbp + 0x70]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp - 0x48], rax
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x90], xmm0
lea rcx, [rbp + 0x90]
call fcn.140004d80
mov r14, qword [rbp + 0xd0]
test al, al
jne 0x14001dd08
lea r11, ds:[rbp + 0xd0]
cmp r15, 7
cmova r11, r14
lea rsi, [rbp + 0xb0]
cmp qword [rsp + 0x70], 7
cmova rsi, qword [rbp - 0x70]
cmp rdi, r13
ja 0x14001dd08
mov rax, r13
sub rax, rdi
test rdi, rdi
je 0x14001dcc6
inc rax
lea r13, [rsi + rax*2]
mov rax, rsi
movzx r10d, word [r11]
nop word [rax + rax]
mov rcx, r13
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x14001dc7e
cmp word [rax], r10w
je 0x14001dc7b
cmp rcx, 1
je 0x14001dc7e
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x14001dc68
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14001dd08
mov r8, rdi
mov rdx, r11
test rdi, rdi
je 0x14001dcb8
mov r9, rax
sub r9, r11
nop dword [rax + rax]
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x14001de86
add rdx, 2
sub r8, 1
jne 0x14001dca0
sub rax, rsi
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x14001dd08
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x80]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x60]
call fcn.140006140
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x14001dd4f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001dd4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de96
call fcn.140050f60
xor r10d, r10d
mov qword [rbp + 0x80], r10
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], r10w
cmp r15, 7
jbe 0x14001ddb5
lea rdx, ds:[r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14001ddaa
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001de9d
mov rcx, r14
call fcn.140050f60
xor r10d, r10d
add rbx, 0x40
cmp rbx, qword [rbp - 0x80]
mov r13, qword [rsp + 0x78]
mov r14d, dword [rsp + 0x60]
jne 0x14001d9a0
lea rcx, [rbp + 0xb0]
call fcn.1400058e0
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x1fa0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax]
test eax, eax
jne 0x14001d8e0
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword ds:[rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x110]
call fcn.1400058e0
nop
lea rcx, [rbp - 0x28]
call fcn.14001e500
mov rcx, qword ds:[rbp + 0x2fa0]
xor rcx, rsp
call fcn.140050f40
lea r11, [rsp + 0x30b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
add rax, 2
jmp 0x14001dc50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3