Function at 0x4ebf00
Capabilities:
Access peb ldr_data
Encode data using base64

Disassembly:
lea r12, [rsp - 0xd8]
cmp r12, qword [r14 + 0x10]
jbe 0x4eca26
sub rsp, 0x158
mov qword [rsp + 0x150], rbp
lea rbp, [rsp + 0x150]
mov qword [rsp + 0x160], rax
mov rdx, qword [0x0061bdd8]
mov r9, qword [str._n_____BEGIN]
mov r10, qword [0x0061bde0]
cmp rdx, 1
jb 0x4eca18
mov qword [rsp + 0xe0], rcx
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0x160], rax
dec r10
neg r10
sar r10, 0x3f
and r10, 1
add r9, r10
dec rdx
nop dword [rax]
cmp rbx, rdx
jge 0x4ebf89
xor edx, edx
jmp 0x4ebfae
mov rbx, r9
mov rcx, rdx
call fcn.004028a0
mov rcx, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xd8]
mov edx, eax
mov rax, qword [rsp + 0x160]
test dl, dl
je 0x4ebfea
mov rdx, qword [0x0061bdd8]
lea rsi, [rdx - 1]
nop dword [rax]
cmp rbx, rsi
jb 0x4eca0d
sub rcx, rdx
lea r8, [rcx + 1]
mov r9, r8
neg r8
sar r8, 0x3f
and r8, rsi
sub rbx, rdx
lea rdx, [rax + r8]
lea r8, [rbx + 1]
jmp 0x4ec053
mov rdi, qword [str._n_____BEGIN]
mov rsi, qword [0x0061bdd8]
mov r8, qword [0x0061bde0]
nop
call fcn.004b9dc0
test rax, rax
jl 0x4ec1f8
mov rdx, qword [0x0061bdd8]
add rax, rdx
mov rcx, qword [rsp + 0xd8]
cmp rcx, rax
jb 0x4eca08
mov r8, qword [rsp + 0xe0]
sub r8, rax
sub rcx, rax
mov r9, r8
neg r8
sar r8, 0x3f
and rax, r8
mov r10, qword [rsp + 0x160]
lea rdx, [r10 + rax]
mov r8, rcx
mov rax, rdx
mov rbx, r8
mov rcx, r9
nop dword [rax]
call fcn.004ebca0
mov rdx, qword [0x0061bdb8]
mov r9, qword [0x0061bdb0]
cmp rbx, rdx
jl 0x4ec1cb
mov r10, rbx
sub rbx, rdx
cmp r10, rbx
jb 0x4ec9fd
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xd0], r8
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0x148], rdi
mov r11, r10
sub r10, rbx
mov r12, rbx
sub rbx, rcx
sar rbx, 0x3f
and rbx, r12
lea r12, [rax + rbx]
cmp rdx, r10
je 0x4ec0cb
xor edx, edx
jmp 0x4ec115
mov qword [rsp + 0xc0], r11
mov qword [rsp + 0x50], rcx
mov rax, r12
mov rbx, r9
mov rcx, r10
call fcn.004028a0
mov rcx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0x148]
mov r8, qword [rsp + 0xd0]
mov r11, qword [rsp + 0xc0]
mov edx, eax
mov rax, qword [rsp + 0xe8]
test dl, dl
je 0x4ec1cb
mov rbx, qword [0x0061bdb8]
sub r11, rbx
cmp rcx, r11
jb 0x4ec9f2
mov qword [rsp + 0x48], r11
call fcn.0040db60
mov qword [rsp + 0x140], rax
lea rax, [0x0051cee0]
call fcn.0040d040
mov qword [rsp + 0x138], rax
cmp dword [0x00679fa0], 0
jne 0x4ec16d
mov rdx, qword [rsp + 0x140]
mov qword [rax + 0x10], rdx
jmp 0x4ec17e
lea rdi, [rax + 0x10]
mov rdx, qword [rsp + 0x140]
call fcn.004609c0
xor eax, eax
mov rbx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x48]
call fcn.0044bb60
mov rdi, qword [rsp + 0x138]
mov qword [rdi + 8], rbx
cmp dword [0x00679fa0], 0
jne 0x4ec1ac
mov qword [rdi], rax
jmp 0x4ec1b1
call fcn.004608a0
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0x148]
jmp 0x4ec240
mov rax, qword [rsp + 0x160]
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xe0]
call fcn.004eca60
mov rbp, qword [rsp + 0x150]
add rsp, 0x158
ret
xor eax, eax
mov rbx, qword [rsp + 0x160]
mov rcx, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0x150]
add rsp, 0x158
ret
mov rdi, qword [rsp + 0x138]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x100]
nop
test rax, rax
je 0x4ec981
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0xf0], rdx
mov rbx, rax
mov rax, rdx
call fcn.004ebca0
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], r8
nop
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov byte [rsp + 0x18], 0x3a
call fcn.00402d80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
cmp rcx, 0xffffffffffffffff
je 0x4ec41f
mov rdx, qword [rsp + 0x98]
nop word [rax + rax]
cmp rdx, rcx
jb 0x4ec9ed
lea rax, [rcx + 1]
mov rsi, qword [rsp + 0x90]
cmp rsi, rax
jb 0x4ec9e5
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x108]
mov rbx, rcx
mov rcx, rdx
call fcn.004b9c20
mov qword [rsp + 0x110], rax
mov qword [rsp + 0xa0], rbx
mov rdx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x40]
sub rdx, rsi
lea rcx, [rdx - 1]
mov rdx, rcx
neg rcx
sar rcx, 0x3f
mov rdi, qword [rsp + 0xd0]
and rdi, rcx
mov r8, qword [rsp + 0x90]
sub r8, rsi
mov rsi, qword [rsp + 0x108]
add rsi, rdi
lea rdi, [r8 - 1]
mov rcx, rdx
mov rax, rsi
mov rbx, rdi
call fcn.004b9c20
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044bb60
mov qword [rsp + 0x130], rax
mov qword [rsp + 0xd0], rbx
mov rdx, qword [rsp + 0x138]
mov rsi, qword [rdx + 0x10]
mov qword [rsp + 0x128], rsi
mov rcx, qword [rsp + 0xa0]
xor eax, eax
mov rbx, qword [rsp + 0x110]
call fcn.0044bb60
mov rcx, rax
mov rdi, rbx
lea rax, [0x00514860]
mov rbx, qword [rsp + 0x128]
nop dword [rax]
call fcn.004119a0
mov rdx, qword [rsp + 0xd0]
mov qword [rax + 8], rdx
cmp dword [0x00679fa0], 0
jne 0x4ec40a
mov rdx, qword [rsp + 0x130]
mov qword [rax], rdx
jmp 0x4ec222
mov rdi, rax
mov rdx, qword [rsp + 0x130]
call fcn.004609c0
jmp 0x4ec222
mov rdx, qword [rsp + 0x138]
mov r9, qword [rdx + 0x10]
test r9, r9
je 0x4ec435
mov r9, qword [r9]
jmp 0x4ec438
xor r9d, r9d
test r9, r9
jne 0x4ec4ab
mov rcx, qword [0x0061bd98]
mov r9, qword [str._n_____END]
mov r10, qword [0x0061bda0]
cmp rcx, 1
jb 0x4ec9db
dec r10
neg r10
sar r10, 0x3f
and r10, 1
lea rbx, [r10 + r9]
dec rcx
mov rsi, qword [rsp + 0x58]
cmp rsi, rcx
jge 0x4ec47f
xor eax, eax
jmp 0x4ec499
mov rax, qword [rsp + 0xf0]
call fcn.004028a0
mov rdx, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x58]
test al, al
je 0x4ec4b0
mov r9, qword [0x0061bd98]
dec r9
xor eax, eax
jmp 0x4ec4f5
mov rsi, qword [rsp + 0x58]
mov rdi, qword [str._n_____END]
mov rdx, qword [0x0061bd98]
mov r8, qword [0x0061bda0]
mov rax, qword [rsp + 0xf0]
mov rbx, rsi
mov rcx, qword [rsp + 0x60]
mov rsi, rdx
call fcn.004b9dc0
mov rdx, qword [0x0061bd98]
lea r9, [rdx + rax]
mov rdx, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x58]
test rax, rax
jl 0x4ec947
nop
cmp r9, rsi
ja 0x4ec9d0
mov rcx, rsi
sub rcx, r9
mov r8, qword [rsp + 0x60]
mov r10, r8
sub r8, r9
mov r11, r8
neg r8
sar r8, 0x3f
and r9, r8
mov rdi, qword [rsp + 0xf0]
add r9, rdi
mov r12, qword [0x0061bdb8]
mov r13, qword [rsp + 0x48]
add r12, r13
cmp rcx, r12
jl 0x4ec917
jb 0x4ec9c8
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xa8], r12
mov r15, r11
sub r11, r12
mov qword [rsp + 0x70], r11
sub rcx, r12
mov qword [rsp + 0x68], rcx
mov rbx, r11
neg r11
sar r11, 0x3f
and r11, r12
add r11, r9
mov qword [rsp + 0xf8], r11
cmp r13, r12
jle 0x4ec595
xor r8d, r8d
jmp 0x4ec607
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0x118], r9
mov rax, r9
mov rbx, qword [rsp + 0xe8]
mov rcx, r13
call fcn.004028a0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x138]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0xf0]
mov r9, qword [rsp + 0x118]
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0xf8]
mov r12, qword [rsp + 0xa8]
mov r15, qword [rsp + 0xd0]
mov r8d, eax
mov rax, qword [rsp + 0xb0]
test r8b, r8b
je 0x4ec8e7
mov r13, qword [0x0061bdb8]
mov r8, rdx
mov rdx, qword [0x0061bdb0]
cmp r13, r12
jg 0x4ec6af
sub r12, r13
mov r11, qword [rsp + 0xa8]
cmp r12, r11
ja 0x4ec9bd
mov qword [rsp + 0xd0], r12
sub r11, r12
sub r12, r15
sar r12, 0x3f
mov r15, qword [rsp + 0xd0]
and r15, r12
add r9, r15
nop
cmp r13, r11
je 0x4ec669
xor edx, edx
jmp 0x4ec6a5
mov rax, r9
mov rbx, rdx
mov rcx, r11
call fcn.004028a0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0xf0]
mov r8, qword [rsp + 0x138]
mov r10, qword [rsp + 0x60]
mov edx, eax
mov rax, qword [rsp + 0xb0]
mov r11, qword [rsp + 0xf8]
jmp 0x4ec6b1
xor edx, edx
test dl, dl
je 0x4ec8e7
mov rax, r11
mov rdx, rbx
mov rbx, rcx
mov rcx, rdx
call fcn.004ebca0
test rbx, rbx
jne 0x4ec8a8
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0x60]
cmp rcx, rdx
ja 0x4ec9b8
mov rax, qword [rsp + 0xf0]
mov rbx, rcx
mov rcx, rdx
call fcn.004ebe00
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0xb8], rcx
mov rdx, qword [0x00623258]
cmp dword [rdx + 0x140], 0xffffffff
jne 0x4ec742
lea rdx, [rbx + rbx*2]
mov rsi, rdx
shl rdx, 1
sar rdx, 0x3f
shr rdx, 0x3d
lea rdx, [rdx + rsi*2]
sar rdx, 3
nop
jmp 0x4ec74a
shr rbx, 2
lea rdx, [rbx + rbx*2]
mov qword [rsp + 0x38], rdx
lea rax, [0x00510140]
mov rbx, rdx
mov rcx, rbx
nop dword [rax]
call fcn.00447c80
mov rdi, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x138]
mov qword [rdx + 0x20], rdi
mov qword [rdx + 0x28], rdi
cmp dword [0x00679fa0], 0
jne 0x4ec789
mov qword [rdx + 0x18], rax
jmp 0x4ec79b
lea r10, [rdx + 0x18]
mov rcx, rdi
mov rdi, r10
call fcn.004608a0
mov rdi, rcx
mov rax, qword [0x00623258]
mov rbx, qword [rdx + 0x18]
mov rcx, rdi
mov rsi, qword [rsp + 0x120]
mov r8, qword [rsp + 0x88]
mov r9, qword [rsp + 0xb8]
call fcn.004eb3a0
test rbx, rbx
jne 0x4ec869
mov rsi, qword [rsp + 0x138]
mov rdx, qword [rsi + 0x28]
nop dword [rax + rax]
cmp rax, rdx
ja 0x4ec9b0
mov qword [rsi + 0x20], rax
mov rdx, qword [0x0061bd98]
mov rdi, qword [rsp + 0xb0]
lea r8, [rdx + rdi]
lea rax, [rdi + rdx]
lea rax, [rax - 1]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
jb 0x4ec9ab
mov rdx, qword [rsp + 0x60]
sub rdx, r8
sub rcx, r8
inc rdx
mov rsi, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
mov rdx, qword [rsp + 0xf0]
add rax, rdx
lea rbx, [rcx + 1]
mov rcx, rsi
call fcn.004ebca0
mov rax, qword [rsp + 0x138]
mov rbx, rdi
mov rcx, rsi
mov rdi, r8
mov rbp, qword [rsp + 0x150]
add rsp, 0x158
ret
mov rax, qword [rsp + 0x160]
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
call fcn.004eca60
mov rbp, qword [rsp + 0x150]
add rsp, 0x158
ret
mov rax, qword [rsp + 0x160]
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
call fcn.004eca60
mov rbp, qword [rsp + 0x150]
add rsp, 0x158
ret
mov rax, qword [rsp + 0x160]
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xe0]
mov r8, r10
call fcn.004eca60
mov rbp, qword [rsp + 0x150]
add rsp, 0x158
ret
mov rax, qword [rsp + 0x160]
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xe0]
mov r8, r10
call fcn.004eca60
mov rbp, qword [rsp + 0x150]
add rsp, 0x158
ret
mov rax, qword [rsp + 0x160]
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xf0]
mov r8, qword [rsp + 0x60]
call fcn.004eca60
mov rbp, qword [rsp + 0x150]
add rsp, 0x158
ret
xor eax, eax
mov rbx, qword [rsp + 0x160]
mov rcx, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0x150]
add rsp, 0x158
ret
call fcn.00460e00
mov rcx, rax
call fcn.00460dc0
call fcn.00460dc0
mov rax, r12
mov rcx, r11
call fcn.00460e00
mov rax, r12
call fcn.00460e00
mov rax, r9
mov rcx, rsi
call fcn.00460e00
mov eax, 1
call fcn.00460e00
mov rcx, rsi
call fcn.00460e00
call fcn.00460dc0
mov rdx, rcx
mov rcx, r11
call fcn.00460dc0
mov rax, rbx
mov rcx, r10
call fcn.00460e00
call fcn.00460e00
mov rax, rsi
mov rcx, rbx
call fcn.00460e00
mov eax, 1
mov rcx, rdx
call fcn.00460e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045e640
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004ebf00