Function at 0x1404d5825
Capabilities:
Encode data using base64
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
shr al, 0x68
push rbp
shl bpl, cl
push rsi
movzx rsi, dx
push rdi
push r12
ror rsi, cl
seto sil
bts r12d, r11d
push r13
push r14
rol bp, 0x3f
push r15
lea rbp, [rsp - 0x230]
not bh
sub rsp, 0x330
rcr r12b, cl
rcr r12b, 0x72
mov rax, qword [0x1400b7288]
ror bl, cl
shr bl, cl
xor rax, rsp
dec r12b
shr sil, cl
mov qword [rbp + 0x220], rax
mov r12, r8
xor bh, 0x52
mov rsi, rcx
xor bx, 0x141a
movabs rbx, 0x200000000801
stc
cmp bl, r13b
cmp rdx, rcx
je 0x1404d58ee
mov al, byte [rdx]
sub al, 0x2f
jmp 0x1404d58af
cmp al, 0x2d
jmp 0x1404d58b6
ja 0x1404d58cf
movsx rax, al
bt rbx, rax
jmp 0x1404d58c9
jb 0x1404d58ee
mov rcx, rsi
jmp 0x1404d58d7
call fcn.140294364
mov rdx, rax
cmc
cmp rax, rsi
jmp 0x1404d58e8
jne 0x1404d58a6
mov r8b, byte [rdx]
stc
test bl, 0xd1
cmp sp, 0x7b12
cmp r8b, 0x3a
jmp 0x1404d5903
jne 0x1404d5952
lea rax, [rsi + 1]
jmp 0x1404d5912
cmp rdx, rax
jmp 0x1404d591a
je 0x1404d5952
mov r9, r12
not cx
cmc
sub cl, bh
sub r8d, r8d
bsr ecx, ebp
shld cx, r15w, 0xbe
bt ecx, 0xa7
sub edx, edx
setne ch
bswap ecx
mov rcx, rsi
jmp 0x1404d5948
call fcn.1404d54b4
jmp 0x1404d5e3f
sub r8b, 0x2f
test di, 0x21be
xor edi, edi
cmp r8b, 0x2d
jmp 0x1404d5966
ja 0x1404d5982
movsx rax, r8b
cmc
bt rbx, rax
mov al, 1
jmp 0x1404d597c
jb 0x1404d5991
mov al, dil
bts ecx, r12d
jmp 0x1404d5991
sub rdx, rsi
movsxd rcx, r10d
movsx rcx, si
mov qword [rbp - 0x60], rdi
jmp 0x1404d59a9
inc rdx
shl ch, cl
mov qword [rbp - 0x58], rdi
sal ch, 0xfc
neg al
mov qword [rbp - 0x50], rdi
movzx cx, cl
movzx ecx, r10w
movzx rcx, r9w
lea rcx, [rsp + 0x30]
jmp 0x1404d59d1
mov qword [rbp - 0x48], rdi
jmp 0x1404d59da
sbb r13, r13
cmp bpl, r14b
mov qword [rbp - 0x40], rdi
clc
and r13, rdx
mov byte [rbp - 0x38], dil
stc
sub edx, edx
jmp 0x1404d59f4
call fcn.1404a19f4
mov rax, qword [rsp + 0x38]
btc r15w, 0xc2
bsr r15d, esp
add r15w, r10w
mov r15d, 0xfde9
cmp dword [rax + 0xc], r15d
jmp 0x1404d5a1b
jne 0x1404d5a57
cmp byte [rsp + 0x48], dil
je 0x1404d5a4a
mov rax, qword [rsp + 0x30]
cmovno r8w, ax
sal r8w, cl
sub r8w, di
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1404d5a4a
mov r8d, r15d
jmp 0x1404d5a52
jmp 0x1404d5abe
call fcn.1404c78e4
test eax, eax
jmp 0x1404d5a63
jne 0x1404d5a90
cmp byte [rsp + 0x48], dil
je 0x1404d5a80
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, 1
jmp 0x1404d5a8b
jmp 0x1404d5abe
cmp byte [rsp + 0x48], dil
je 0x1404d5ab2
mov rax, qword [rsp + 0x30]
mov r8d, eax
sar dx, cl
sar r8w, 0x4e
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, edi
sets cl
not dl
movzx rdx, bp
lea rdx, [rbp - 0x60]
movzx rcx, sp
mov cx, r15w
mov rcx, rsi
jmp 0x1404d5ad2
call fcn.1404a247a
mov rcx, qword [rbp - 0x50]
jmp 0x1404d5ae0
lea r8, [rbp - 0x30]
test eax, eax
jmp 0x1404d5aeb
mov dword [rsp + 0x28], edi
jmp 0x1404d5af4
mov qword [rsp + 0x20], rdi
cmovne rcx, rdi
cmp r9b, 0x3a
cmp spl, dl
sub r9d, r9d
clc
jmp 0x1404d5b0e
xor edx, edx
jmp 0x1404d5b15
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
test r11d, 0x3b80756b
jmp 0x1404d5b2a
cmp rax, 0xffffffffffffffff
jmp 0x1404d5b33
jne 0x1404d5b6b
mov r9, r12
sub r8d, r8d
bts cx, r8w
inc ch
stc
xor edx, edx
movsx ecx, ax
mov rcx, 0x114f0808
movzx rcx, r12w
mov rcx, rsi
jmp 0x1404d5b5f
call fcn.1404d54b4
mov edi, eax
jmp 0x1404d5e17
mov r14, qword [r12 + 8]
add ecx, 0x71df6a98
btc rcx, 0xff
sub r14, qword [r12]
bsf cx, r15w
or rcx, r14
sub cl, r8b
sar r14, 3
inc ecx
dec ch
xor edx, edx
cmove cx, r13w
not rcx
mov ecx, edx
mov qword [rsp + 0x70], rdi
not rcx
movzx cx, r8b
mov cl, 0xea
lea rcx, [rsp + 0x50]
jmp 0x1404d5bb7
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
jmp 0x1404d5bc5
mov qword [rbp - 0x78], rdi
jmp 0x1404d5bce
mov qword [rbp - 0x70], rdi
jmp 0x1404d5bd7
mov byte [rbp - 0x68], dil
jmp 0x1404d5be0
call fcn.1404a19f4
mov rax, qword [rsp + 0x58]
test sil, 0x2a
cmp dword [rax + 0xc], r15d
jmp 0x1404d5bf7
jne 0x1404d5c3d
cmp byte [rsp + 0x68], dil
jmp 0x1404d5c07
je 0x1404d5c30
mov rax, qword [rsp + 0x50]
shld r8, rbx, 0xcc
shrd r8w, r9w, 0x31
cmp bl, 0xea
and dword [rax + 0x3a8], 0xfffffffd
setp r8b
cmovle r8w, r8w
mov r8d, r15d
jmp 0x1404d5c38
jmp 0x1404d5ca8
call fcn.1404c78e4
test eax, eax
jne 0x1404d5c79
cmp byte [rsp + 0x68], dil
je 0x1404d5c6e
mov rax, qword [rsp + 0x50]
shl r8, cl
cmp dil, r9b
and dword [rax + 0x3a8], 0xfffffffd
movsx r8d, r8w
xchg r8b, r8b
mov r8d, 1
jmp 0x1404d5ca8
cmp byte [rsp + 0x68], dil
jmp 0x1404d5c83
je 0x1404d5ca5
mov rax, qword [rsp + 0x50]
sar dh, cl
movzx r8, r15w
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1404d5ca5
mov r8d, edi
lea rdx, [rsp + 0x70]
movsxd rcx, eax
mov cl, spl
movzx cx, dh
lea rcx, [rbp - 4]
jmp 0x1404d5cc0
call fcn.1404d4cf9
mov r15, qword [rbp - 0x80]
test eax, eax
movsxd rcx, eax
mov rcx, r15
jmp 0x1404d5cd6
cmovne rcx, rdi
cmp rbp, 0x14a0530a
cmp byte [rcx], 0x2e
jmp 0x1404d5ce9
jne 0x1404d5d1c
mov al, byte [rcx + 1]
cmp r13, 0x6aa466e2
test r12b, 0x56
test al, al
jmp 0x1404d5d04
je 0x1404d5d4f
cmp al, 0x2e
jne 0x1404d5d1c
cmp byte [rcx + 2], dil
je 0x1404d5d4f
mov r9, r12
bswap dx
mov r8, r13
cqo
mov rdx, rsi
jmp 0x1404d5d2f
call fcn.1404d54b4
mov edi, eax
clc
cmc
test eax, eax
jne 0x1404d5df2
xor edi, edi
test r15w, 0x6550
cmp r10d, 0x2b5252b5
cmp byte [rbp - 0x68], dil
jmp 0x1404d5d58
je 0x1404d5d6b
mov rcx, r15
jmp 0x1404d5d66
call fcn.1404c67c1
lea rdx, [rbp - 0x30]
movsxd rcx, edi
movzx cx, ah
mov rcx, rbx
jmp 0x1404d5d7e
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
test eax, eax
jmp 0x1404d5d91
jne 0x1404d5b92
mov rax, qword [r12]
and edx, 0x3405053
mov rdx, qword [r12 + 8]
stc
sub rdx, rax
jmp 0x1404d5daf
sar rdx, 3
stc
cmp r14, rdx
jmp 0x1404d5dbc
je 0x1404d5e0e
sub rdx, r14
lea rcx, [rax + r14*8]
cmovbe r9d, r14d
movzx r8w, r14b
lea r9, [0x1400acc8c]
setae r8b
mov r8d, 8
jmp 0x1404d5de8
call fcn.1404e1cf4
jmp 0x1404d5e0e
cmp byte [rbp - 0x68], 0
jmp 0x1404d5dfb
je 0x1404d5e0e
mov rcx, r15
jmp 0x1404d5e09
call fcn.1404c67c1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
jmp 0x1404d5e20
je 0x1404d5e34
mov rcx, qword [rbp - 0x50]
jmp 0x1404d5e2f
call fcn.1404c67c1
mov eax, edi
add rcx, r12
sub ecx, 0x46f96c56
mov rcx, qword [rbp + 0x220]
stc
xor rcx, rsp
jmp 0x1404d5e4f
call fcn.14049cefa
mov rbx, qword [rsp + 0x388]
add rsp, 0x330
xchg r13w, r15w
cmovge r13w, bx
pop r15
xchg di, r14w
pop r14
pop r13
mov dil, 0x3d
movzx bp, r10b
pop r12
mov bpl, al
pop rdi
movsx esi, r10w
cmovbe rbp, rdx
pop rsi
sete bpl
pop rbp
ret