Function at 0x34b37a060
Capabilities:
Encode data using base64 via winapi
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
mov eax, dword [rdx + 0x10]
mov r12, rcx
mov rbx, rdx
mov r15, r8
mov rsi, r9
cmp eax, 4
je 0x34b37a118
ja 0x34b37a0e0
cmp eax, 2
je 0x34b37a09b
cmp eax, 3
jne 0x34b37a150
mov rax, qword [rbx + 0x18]
lea r9, [rsp + 0x80]
mov rcx, r12
mov r8d, dword [rax + 0x10]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_WriteFile]
mov r14d, eax
mov eax, r14d
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp eax, 5
jne 0x34b37a150
mov rcx, qword [rdx + 0x18]
mov r9d, 1
mov qword [rsp + 0x20], r12
mov r8d, 2
mov dword [rsp + 0x28], 0
mov edx, 0x10001
call qword [sym.imp.crypt32.dll_CertSaveStore]
mov r14d, eax
jmp 0x34b37a0c4
mov rcx, qword [rdx + 0x18]
mov r9d, 1
mov qword [rsp + 0x20], r12
mov r8d, 1
mov dword [rsp + 0x28], 0
mov edx, 0x10001
call qword [sym.imp.crypt32.dll_CertSaveStore]
mov r14d, eax
jmp 0x34b37a0c4
mov eax, dword [r15 + 4]
cmp eax, 3
je 0x34b37a490
ja 0x34b37a3b0
cmp eax, 1
je 0x34b37a09b
cmp eax, 2
jne 0x34b37a470
mov r9d, 0x2000
xor r8d, r8d
mov edx, 1
mov qword [rsp + 0x20], 0
mov ecx, 2
call qword [sym.imp.crypt32.dll_CertOpenStore]
mov r13, rax
test rax, rax
je 0x34b37a480
mov edx, dword [r15 + 8]
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x58], 0
test edx, edx
je 0x34b37a65b
mov qword [rsp + 0x60], 0
mov eax, dword [rbx + 0x20]
test eax, eax
je 0x34b37a64c
lea rdi, [rsp + 0x80]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0xa0], 0
mov dword [rsp + 0xa0], eax
mov rax, qword [rbx + 0x28]
mov rcx, rdi
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov dword [rsp + 0x80], 0x50
mov qword [rsp + 0xa8], rax
call qword [sym.imp.crypt32.dll_CertCreateCertificateChainEngine]
mov edx, eax
test eax, eax
je 0x34b37a55e
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov dword [rsp + 0x80], 0x20
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rdi
call qword [sym.imp.crypt32.dll_CertGetCertificateChain]
mov edx, eax
test eax, eax
je 0x34b37a55e
mov rax, qword [sym.imp.crypt32.dll_CertAddCertificateContextToStore]
mov rcx, qword [rsp + 0x68]
xor ebx, ebx
mov qword [rsp + 0x48], rax
nop dword [rax]
cmp dword [rcx + 0xc], ebx
jbe 0x34b37a550
mov edi, ebx
xor r14d, r14d
lea rbp, [rsp + 0x58]
shl rdi, 3
jmp 0x34b37a368
mov rax, qword [rax + 0x10]
mov r9, rbp
mov r8d, 4
mov rcx, r13
mov rax, qword [rax]
mov rdx, qword [rax + 8]
mov rax, qword [rsp + 0x48]
call rax
mov edx, eax
mov rcx, qword [rsp + 0x68]
inc r14d
test edx, edx
je 0x34b37a550
mov rax, qword [rcx + 0x10]
mov rax, qword [rax + rdi]
cmp dword [rax + 0xc], r14d
jbe 0x34b37a548
mov ecx, ebx
or ecx, r14d
je 0x34b37a338
mov rcx, qword [rax + 0x10]
mov edx, r14d
xor r9d, r9d
mov r8d, 4
mov rax, qword [rcx + rdx*8]
mov rcx, r13
mov rdx, qword [rax + 8]
call qword [sym.imp.crypt32.dll_CertAddCertificateContextToStore]
mov edx, eax
jmp 0x34b37a358
cmp eax, 4
jne 0x34b37a470
mov rax, qword [rbx + 0x18]
mov rsi, qword [sym.imp.crypt32.dll_CryptBinaryToStringA]
xor r9d, r9d
lea rbx, [rsp + 0x80]
mov r8d, 1
mov r15d, dword [rax + 0x10]
mov r13, qword [rax + 8]
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x80], 0
mov edx, r15d
mov rcx, r13
call rsi
mov r14d, eax
test eax, eax
je 0x34b37a0c4
mov rbp, qword gs:[0x30]
mov rax, qword [rbp + 0x60]
mov r8d, dword [rsp + 0x80]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x34b37a8e0
mov qword [rsp + 0x20], rbx
mov r9, rax
mov edx, r15d
mov rcx, r13
mov r8d, 1
call rsi
mov r14d, eax
test eax, eax
jne 0x34b37a77a
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x34b37a0c4
mov rax, qword gs:[0x30]
mov dword [rax + 0x68], 0x80004005
xor r14d, r14d
jmp 0x34b37a0c4
mov edi, dword [r15 + 8]
mov rsi, qword [sym.imp.crypt32.dll_CertOpenStore]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
mov r9d, 0x2000
mov ecx, 2
call rsi
mov r13, rax
test rax, rax
je 0x34b37a480
test edi, edi
je 0x34b37a628
mov qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
xor edi, edi
mov r9d, 0x2000
mov ecx, 0xb
call rsi
mov rbp, qword [sym.imp.crypt32.dll_CertAddStoreToCollection]
mov r14, rax
test rax, rax
je 0x34b37a7a2
nop word cs:[rax + rax]
cmp dword [rbx + 0x20], edi
jbe 0x34b37a7ae
mov rdx, qword [rbx + 0x28]
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
call rbp
inc edi
mov esi, eax
test eax, eax
jne 0x34b37a500
mov rbx, qword [sym.imp.crypt32.dll_CertCloseStore]
xor edx, edx
mov rcx, r14
call rbx
test esi, esi
jne 0x34b37a67a
xor r14d, r14d
xor edx, edx
mov rcx, r13
call rbx
jmp 0x34b37a0c4
inc ebx
jmp 0x34b37a318
mov dword [rsp + 0x48], edx
call qword [sym.imp.crypt32.dll_CertFreeCertificateChain]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x34b37a576
mov dword [rsp + 0x48], edx
call qword [sym.imp.crypt32.dll_CertFreeCertificateChainEngine]
mov edx, dword [rsp + 0x48]
test edx, edx
je 0x34b37a620
mov ebx, dword [r15 + 0xc]
test ebx, ebx
je 0x34b37a6a9
mov rcx, qword [rsp + 0x58]
test rsi, rsi
je 0x34b37a879
xor r8d, r8d
mov r9, rsi
mov edx, 2
call qword [sym.imp.crypt32.dll_CertSetCertificateContextProperty]
test eax, eax
je 0x34b37a620
xor ebx, ebx
lea rbp, [rsp + 0x70]
mov r8, qword [r15 + 0x10]
mov rdi, qword [sym.imp.crypt32.dll_PFXExportCertStore]
mov rcx, r13
mov r9d, 6
mov rdx, rbp
call rdi
mov r14d, eax
test eax, eax
jne 0x34b37a6cf
nop dword [rax + rax]
test ebx, ebx
je 0x34b37a600
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.crypt32.dll_CertFreeCertificateContext]
xor edx, edx
mov rcx, r13
call qword [sym.imp.crypt32.dll_CertCloseStore]
jmp 0x34b37a0c4
xor r14d, r14d
jmp 0x34b37a600
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov r8d, 4
mov rcx, rax
call qword [sym.imp.crypt32.dll_CertAddCertificateContextToStore]
mov rbx, qword [sym.imp.crypt32.dll_CertCloseStore]
mov esi, eax
jmp 0x34b37a52e
xor ecx, ecx
lea rdi, [rsp + 0x80]
jmp 0x34b37a28c
mov rdx, qword [rbx + 0x18]
lea r9, [rsp + 0x58]
mov r8d, 4
mov rcx, rax
call qword [sym.imp.crypt32.dll_CertAddCertificateContextToStore]
mov edx, eax
jmp 0x34b37a576
mov dword [rsp + 0x28], 0
mov r9d, 1
mov r8d, 2
mov rcx, r13
mov qword [rsp + 0x20], r12
mov edx, 0x10001
call qword [sym.imp.crypt32.dll_CertSaveStore]
mov r14d, eax
jmp 0x34b37a539
lea rbp, [rsp + 0x70]
mov r8, qword [r15 + 0x10]
mov rdi, qword [sym.imp.crypt32.dll_PFXExportCertStore]
mov rcx, r13
mov r9d, 6
mov rdx, rbp
call rdi
test eax, eax
je 0x34b37a620
mov r14, qword gs:[0x30]
mov rax, qword [r14 + 0x60]
mov r8d, dword [rsp + 0x70]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x34b37a8ef
mov r8, qword [r15 + 0x10]
mov r9d, 6
mov rdx, rbp
mov rcx, r13
call rdi
mov r14d, eax
test eax, eax
je 0x34b37a5e0
lea r15, [rsp + 0x80]
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rcx, r12
mov qword [rsp + 0x20], 0
mov r9, r15
call qword [sym.imp.kernel32.dll_WriteFile]
mov r14d, eax
test eax, eax
je 0x34b37a5e0
mov eax, dword [rsp + 0x140]
test eax, eax
je 0x34b37a5e0
mov r9d, dword [rsi + 0x10]
mov r8, qword [rsi + 8]
mov rcx, r15
mov dword [rsp + 0x20], 0x10
mov rdx, qword [rsi]
call qword [sym.imp.advapi32.dll_CryptAcquireContextW]
jmp 0x34b37a5e0
mov qword [rsp + 0x20], 0
mov r9, rbx
mov rdx, rdi
mov rcx, r12
mov r8d, dword [rsp + 0x80]
call qword [sym.imp.kernel32.dll_WriteFile]
mov r14d, eax
jmp 0x34b37a44e
mov rbx, qword [sym.imp.crypt32.dll_CertCloseStore]
jmp 0x34b37a536
lea rax, [rsp + 0x80]
mov r9, r14
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [rbx + 0x18]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.crypt32.dll_CertGetCertificateChain]
mov esi, eax
test eax, eax
je 0x34b37a8b8
mov rcx, qword [rsp + 0x80]
mov rdi, qword [sym.imp.crypt32.dll_CertAddCertificateContextToStore]
xor ebp, ebp
nop word [rax + rax]
cmp dword [rcx + 0xc], ebp
jbe 0x34b37a8d5
mov ebx, ebp
xor r15d, r15d
shl rbx, 3
nop word [rax + rax]
mov rax, qword [rcx + 0x10]
mov rax, qword [rax + rbx]
cmp dword [rax + 0xc], r15d
jbe 0x34b37a875
mov rax, qword [rax + 0x10]
mov edx, r15d
mov rcx, r13
xor r9d, r9d
mov r8d, 4
inc r15d
mov rax, qword [rax + rdx*8]
mov rdx, qword [rax + 8]
call rdi
mov rcx, qword [rsp + 0x80]
mov esi, eax
test eax, eax
jne 0x34b37a820
call qword [sym.imp.crypt32.dll_CertFreeCertificateChain]
mov rbx, qword [sym.imp.crypt32.dll_CertCloseStore]
xor edx, edx
mov rcx, r14
call rbx
jmp 0x34b37a536
inc ebp
jmp 0x34b37a808
call sym.export_get_private_key_info
mov rsi, rax
test rax, rax
je 0x34b37a620
mov rcx, qword [rsp + 0x58]
mov r9, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.crypt32.dll_CertSetCertificateContextProperty]
mov r14d, eax
test eax, eax
je 0x34b37a5e4
mov ebx, 1
jmp 0x34b37a5af
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov r8d, 4
mov rcx, r13
call qword [sym.imp.crypt32.dll_CertAddCertificateContextToStore]
mov esi, eax
jmp 0x34b37a520
call qword [sym.imp.crypt32.dll_CertFreeCertificateChain]
jmp 0x34b37a520
mov dword [rbp + 0x68], 0xe
xor r14d, r14d
jmp 0x34b37a0c4
mov dword [r14 + 0x68], 0xe
xor r14d, r14d
jmp 0x34b37a5e0