Function at 0x4385e8
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, dword [esp + 0x38]
push ebx
call fcn.0044d210
add esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], 0x78a13529
mov ecx, 0x78a13529
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
xor edi, edi
cmp ecx, 0x1e35e005
jg 0x438669
cmp ecx, 0xb2a1aad1
jg 0x4386a2
cmp ecx, 0xaa3358af
jle 0x438717
cmp ecx, 0xaeaab18d
je 0x438802
cmp ecx, 0xb1bedde3
jne 0x4388dc
mov eax, dword [esp]
shl eax, 5
and eax, 0xffff0000
lea ecx, [eax*8]
sub ecx, eax
mov dword [esp], ecx
mov ecx, 0x327a55ad
jmp 0x438617
cmp ecx, 0x4034fc6b
jg 0x4386e9
cmp ecx, 0x327a55ac
jg 0x438765
cmp ecx, 0x1e35e006
je 0x43881c
cmp ecx, 0x22eb69f6
jne 0x438617
imul ebp, ebp, 0x91
add ebp, 0x7c63
jmp 0x4387f8
cmp ecx, 0xc275a18e
jg 0x4387a9
cmp ecx, 0xb2a1aad2
je 0x43884b
cmp ecx, 0xb8b656b8
jne 0x438617
push edi
push edi
lea eax, [esp + 0x10]
push eax
push edi
push 1
push dword [esp + 0x20]
push ebx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov dword [esp + 0x1c], eax
mov ecx, 0x1249dc0b
jmp 0x438617
cmp ecx, 0x6a667c0e
jg 0x4387d6
cmp ecx, 0x4034fc6c
je 0x438859
cmp ecx, 0x626988b8
jne 0x438617
mov ecx, 0x1e35e006
jmp 0x438617
cmp ecx, 0x9978191a
je 0x438876
cmp ecx, 0xa5ae260f
jne 0x438617
imul eax, dword [esp], 0x39
mov ecx, eax
shr ecx, 6
imul eax, eax
imul ecx, ecx, 0xbe
imul edx, eax, 0x533b
dec edx
shr ecx, 2
mov dword [esp], ecx
mov ecx, 0x3de22966
cmp eax, edx
je 0x438617
mov ecx, 0x626988b8
jmp 0x438617
cmp ecx, 0x327a55ad
je 0x4388b2
cmp ecx, 0x3de22966
jne 0x438617
mov edi, ebx
mov ebx, dword [esp + 8]
lea eax, [ebx + 1]
push eax
call fcn.0044cb24
add esp, 4
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov byte [eax + ebx], 0
mov ebx, edi
xor edi, edi
mov ecx, 0xa5ae260f
jmp 0x438617
cmp ecx, 0xc275a18f
je 0x4387f8
cmp ecx, 0x1249dc0b
jne 0x438617
imul eax, dword [esp], 0x1e40000
add eax, 0xfffffa00
mov dword [esp], eax
mov ecx, 0xaeaab18d
jmp 0x438617
cmp ecx, 0x6a667c0f
je 0x4388ca
cmp ecx, 0x78a13529
jne 0x438617
mov ecx, 0xb8b656b8
jmp 0x438617
mov ecx, 0x3de22966
jmp 0x438617
cmp dword [esp + 0x1c], 0
mov ecx, 0x4034fc6c
je 0x438617
mov ecx, 0x9978191a
jmp 0x438617
push edi
push edi
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
push 1
push dword [esp + 0x20]
push ebx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov ecx, 0xb2a1aad2
test eax, eax
je 0x438617
mov ecx, 0x6a667c0f
jmp 0x438617
push dword [esp + 4]
call fcn.0044c77c
add esp, 4
jmp 0x43886a
mov eax, dword [esp]
lea eax, [eax + eax*2]
shl eax, 0x11
add eax, 0xfffd6c00
mov dword [esp], eax
mov ecx, 0xaa3358b0
xor esi, esi
jmp 0x438617
mov eax, dword [esp]
add eax, 0xffffffd7
shr eax, 6
lea ecx, [eax*8 + 0x2a0]
add eax, 0x54
sub ecx, eax
imul eax, eax
imul edx, eax, 0x32b1
add ecx, 0xffffff8d
dec edx
mov dword [esp], ecx
mov ecx, 0xb8b656b8
cmp eax, edx
je 0x438617
mov ecx, 0xc275a18f
jmp 0x438617
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x3c]
mov dword [ecx], eax
mov ecx, 0xaa3358b0
mov esi, dword [esp + 4]
jmp 0x438617
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, 0xb1bedde3
jmp 0x438617
cmp ecx, 0xaa3358b0
jne 0x438617
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], esi
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret