Function at 0x18004c880
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov dword [rax + 0x10], edx
push r14
push r15
sub rsp, 0xa8
mov r14d, edx
mov r10, r9
imul edx, edx, 0x22
mov r9, r8
mov r15, rcx
mov dword [rsp + 0x34], edx
cmp r14d, edx
ja 0x18004cef7
mov qword [rax + 8], rbx
lea r8d, [r14 + r14]
mov rbx, qword [rsp + 0x40]
lea r11, [0x180000000]
mov qword [rax - 0x18], rbp
mov ebp, dword [rsp + 0xc8]
mov qword [rax - 0x20], rsi
mov rsi, qword [rsp + 0x40]
mov qword [rax - 0x28], rdi
mov edi, dword [rsp + 0x3c]
mov qword [rax - 0x30], r12
mov r12d, dword [rsp + 0xc8]
mov qword [rax - 0x38], r13
mov r13, qword [rsp + 0x40]
mov dword [rsp + 0x38], r8d
nop
cmp r14d, 0xea
ja 0x18004cc7a
je 0x18004cc5a
lea eax, [r14 - 0xd]
cmp eax, 0x9c
ja case.0x18004c936.17
movzx eax, byte [r11 + rax + 0x4cf28]
mov ecx, dword [r11 + rax*4 + 0x4cf04]
add rcx, r11
jmp rcx
movabs rax, 0xaaaaaaaaaaaaaaab
mul qword [r15 + 0x10]
shr rdx, 1
lea rax, [rdx + rdx*2]
mov edx, dword [rsp + 0x34]
mov qword [rsp + 0x78], rax
jmp case.0x18004c936.17
movzx eax, byte [rsp + 0x30]
xor ecx, ecx
test edi, edi
cmove ecx, eax
mov byte [rsp + 0x30], cl
jmp case.0x18004c936.17
mov rcx, qword [r15 + 0x10]
movabs rax, 0xaaaaaaaaaaaaaaab
add rcx, 2
mov byte [rsp + 0x30], 1
mul rcx
mov rax, rdx
mov edx, dword [rsp + 0x34]
shr rax, 1
shl rax, 2
mov qword [rsp + 0x40], rax
jmp case.0x18004c936.17
cmp qword [r15 + 0x18], 0x10
mov rsi, r15
jb 0x18004c9af
mov rsi, qword [r15]
cmp qword [r9 + 0x18], 0x10
mov rbx, r9
jb case.0x18004c936.17
mov rbx, qword [r9]
jmp case.0x18004c936.17
mov rax, qword [rsp + 0x78]
xor r13d, r13d
test rax, rax
je 0x18004caa9
lea rcx, [rax - 1]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
mov r8, rdx
shr r8, 1
inc r8
lea r13, [r8 + r8*2]
mov eax, 0x11b
nop dword [rax]
cmp eax, 0x11b
je 0x18004ca6f
cmp eax, 0x1af
je 0x18004ca2b
cmp eax, 0x243
je 0x18004ca22
cmp eax, 0x2d7
jne 0x18004ca86
add rsi, 3
jmp 0x18004ca86
movzx edx, byte [rsi + 2]
and edx, 0x3f
jmp 0x18004ca76
movzx edx, byte [rsi]
movzx ecx, byte [rsi + 1]
and edx, 3
shl edx, 4
shr ecx, 4
add edx, ecx
mov rcx, qword [0x1800a4448]
movzx edx, byte [rdx + rcx]
mov byte [rbx], dl
movzx edx, byte [rsi + 2]
movzx ecx, byte [rsi + 1]
shr edx, 6
and ecx, 0xf
lea edx, [rdx + rcx*4]
mov rcx, qword [0x1800a4448]
movzx edx, byte [rdx + rcx]
mov byte [rbx + 1], dl
add rbx, 2
jmp 0x18004ca86
movzx edx, byte [rsi]
shr rdx, 2
mov rcx, qword [0x1800a4448]
movzx edx, byte [rdx + rcx]
mov byte [rbx], dl
inc rbx
add eax, 0x94
cmp eax, 0x36b
jb 0x18004ca00
sub r8, 1
jne 0x18004c9f4
mov edx, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x38]
cmp byte [rsp + 0x30], 0
je case.0x18004c936.17
mov edi, 0xc1
nop dword [rax]
mov eax, edi
sub eax, 0xbf
je 0x18004caf7
sub eax, 1
je 0x18004caf0
cmp eax, 1
jne 0x18004cb06
lea r8, [rsp + 0x68]
mov qword [rsp + 0x68], 0
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov dword [rsp + 0x3c], eax
jmp 0x18004cb06
mov rcx, qword [rsp + 0x70]
jmp 0x18004cafc
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x18004cb06
call sub.RPCRT4.dll_MesHandleFree
dec edi
cmp edi, 0xbe
ja 0x18004cac0
mov edi, dword [rsp + 0x3c]
jmp 0x18004cd26
cmp r13, qword [r15 + 0x10]
jae case.0x18004c936.17
mov r14d, dword [rsp + 0x48]
mov edx, 0x35
nop dword [rax]
cmp edx, 0x35
je 0x18004cbf4
cmp edx, 0x1553
je 0x18004cbe0
cmp edx, 0x2a71
je 0x18004cbc4
cmp edx, 0x3f8f
je 0x18004cb6c
cmp edx, 0x54ad
jne 0x18004cbf8
mov byte [rbx], 0x3d
inc rbx
jmp 0x18004cbf8
mov ecx, r12d
mov eax, ebp
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, eax
mov rax, qword [0x1800a4448]
movzx ecx, byte [rcx + rax]
lea rax, [r13 + 1]
mov byte [rbx], cl
cmp rax, qword [r15 + 0x10]
jae 0x18004cbb7
mov ecx, ebp
mov eax, r14d
and ecx, 0xf
shr eax, 6
lea ecx, [rax + rcx*4]
mov rax, qword [0x1800a4448]
movzx r8d, byte [rcx + rax]
mov byte [rbx + 1], r8b
add rbx, 2
jmp 0x18004cbf8
mov r8b, 0x3d
mov byte [rbx + 1], r8b
add rbx, 2
jmp 0x18004cbf8
mov rax, qword [0x1800a4448]
xor r14d, r14d
mov ecx, r12d
shr rcx, 2
movzx ecx, byte [rcx + rax]
mov byte [rbx], cl
inc rbx
jmp 0x18004cbf8
lea rax, [r13 + 1]
cmp rax, qword [r15 + 0x10]
jae 0x18004cbf0
movzx ebp, byte [rsi + 1]
jmp 0x18004cbf8
xor ebp, ebp
jmp 0x18004cbf8
movzx r12d, byte [rsi]
add edx, 0x151e
cmp edx, 0x6996
jbe 0x18004cb30
mov edx, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x38]
mov dword [rsp + 0x48], r14d
mov r14d, dword [rsp + 0xc8]
jmp case.0x18004c936.17
mov rdx, qword [rsp + 0x40]
xor r8d, r8d
mov rcx, r9
call fcn.18005b7b0
lea r9, [rsp + 0x70]
mov qword [rsp + 0x70], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov edi, eax
mov dword [rsp + 0x3c], eax
jmp 0x18004cd26
mov rax, qword [0x180091038]
mov dword [rax + 8], 1
mov rax, qword [0x180091038]
mov dword [rax], 1
jmp case.0x18004c936.17
cmp r14d, 0x492
ja 0x18004cdf5
je 0x18004cdda
mov eax, r14d
sub eax, 0x114
je 0x18004cdb0
sub eax, 0xb8
je 0x18004cd4b
sub eax, 0xb8
je 0x18004ccd5
cmp eax, 0x3a
jne case.0x18004c936.17
mov rax, qword [0x180091038]
mov ecx, dword [r15]
mov dword [rax + 0x2c], ecx
mov rax, qword [0x180091038]
mov ecx, dword [r9]
mov dword [rax + 0x30], ecx
jmp case.0x18004c936.17
mov ecx, dword [r9]
lea r8, [rsp + 0x58]
mov edx, dword [r15]
lea r9, [rsp + 0x50]
mov eax, 0x19
mov dword [rsp + 0x50], ecx
sub eax, ecx
mov dword [rsp + 0x58], edx
shr eax, 1
lea rcx, [rsp + 0x60]
mov dword [rsp + 0xc8], eax
mov eax, 0x28
sub eax, edx
mov edx, 0x104
shr eax, 1
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
call fcn.180043290
mov r9, qword [rsp + 0xd0]
lea r11, [0x180000000]
mov r10, qword [rsp + 0xd8]
mov edx, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x38]
jmp case.0x18004c936.17
mov ecx, 2
mov eax, ecx
sub eax, 0x11
je 0x18004cd75
sub eax, 3
je 0x18004cd63
cmp eax, 1
je 0x18004cd26
jmp 0x18004cda4
cmp byte [0x1800966e0], 0
je 0x18004cd63
mov byte [0x1800966e0], 0
jmp 0x18004cda4
cmp dword [0x180096fb0], 2
jne 0x18004cd8b
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x24]
call fcn.18000a020
mov ecx, 0x11
mov dword [0x1800a3af0], 0
mov dword [0x1800a3aec], 0
inc ecx
cmp ecx, 5
jb 0x18004cd50
jmp 0x18004cd26
mov eax, dword [r15]
lea rdx, [rsp + 0xc8]
imul eax, dword [r9]
mov r8, r10
mov ecx, 0x72
add eax, eax
mov dword [rsp + 0xc8], eax
call fcn.180034e70
jmp 0x18004cd26
mov ecx, dword [r15]
mov rax, qword [0x180091038]
shl ecx, 0x10
add ecx, 0x8000
mov dword [rax + 0x24], ecx
jmp case.0x18004c936.17
cmp r14d, 0x666
je 0x18004ce8b
cmp r14d, 0x83a
je 0x18004ce66
cmp r14d, 0xa0e
jne case.0x18004c936.17
mov r8, qword [0x180091038]
mov r9d, 0x109
xor edx, edx
xor ecx, ecx
call fcn.180045d90
mov rcx, qword [0x180091038]
lea r11, [0x180000000]
mov r9, qword [rsp + 0xd0]
mov r10, qword [rsp + 0xd8]
mov edx, dword [rsp + 0x34]
mov eax, dword [rcx + 0x3c]
mov r8d, dword [rsp + 0x38]
test eax, eax
jns case.0x18004c936.17
add eax, 0x168
mov dword [rcx + 0x3c], eax
jmp case.0x18004c936.17
imul eax, dword [r10], 0x5a
mov ecx, 0x5a
sub ecx, eax
mov rax, qword [0x180091038]
mov dword [rax + 0x3c], ecx
mov rax, qword [0x180091038]
mov dword [rax + 0x48], 0x6666
jmp case.0x18004c936.17
mov ecx, dword [r9]
mov rax, qword [0x180091038]
shl ecx, 0x10
add ecx, 0x8000
mov dword [rax + 0x28], ecx
lea rcx, [0x180070378]
mov rax, qword [0x180091038]
mov qword [rax + 0x10], rcx
add r14d, r8d
mov dword [rsp + 0xc8], r14d
cmp r14d, edx
jbe 0x18004c900
mov r13, qword [rsp + 0x80]
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa8
pop r15
pop r14
ret