Function at 0x14006dd20
Capabilities:
Encode data using base64 via winapi
Hash data via bcrypt

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r14, r9
mov rbx, r8
mov r13, rdx
mov rax, qword [rsp + 0xe8]
mov rcx, qword [0x1401f0038]
xor rcx, rsp
mov qword [rsp + 0x70], rcx
mov rdx, qword [rax]
lea rcx, [rsp + 0x50]
mov qword [rcx], rdx
mov eax, dword [rax + 8]
mov dword [rcx + 8], eax
mov dword [rcx + 0xc], 0
lea rdx, [rsp + 0x68]
mov qword [rdx], 0
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x14006df24
mov r9, qword [rsp + 0xe0]
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x6c]
lea rsi, str.User_Choice_set_via_Windows_User_Experience_D18B6DD5_6124_4341_9318_804003BAFA0B
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea r12, str._s_s_s_08lx_08lx_s
mov rcx, r12
mov rdx, rbx
mov r8, r14
call fcn.14006f780
cdqe
mov r15, r13
lea r13, [rax + 1]
lea rbp, [rax*2 + 2]
cmp eax, 0xffffffff
mov rax, 0xffffffffffffffff
cmovl rbp, rax
mov rcx, rbp
call fcn.14012c51c
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call fcn.14012ffe0
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x6c]
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbx
mov rcx, rdi
mov rdx, r13
mov r13, r15
mov r8, 0xffffffffffffffff
mov r9, r12
call fcn.14006f800
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharLowerW]
test rdi, rdi
je 0x14006df24
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebp, [rax*2 + 2]
cmp ebp, 7
jbe 0x14006df12
lea rcx, [rsp + 0x68]
mov qword [rcx], 0
lea rdx, [0x1401cfa2c]
xor esi, esi
xor r8d, r8d
xor r9d, r9d
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
js 0x14006df12
lea r14, [rsp + 0x60]
mov qword [r14], rsi
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call sub.bcrypt.dll_BCryptCreateHash
test eax, eax
js 0x14006df06
mov rcx, qword [rsp + 0x60]
xor ebx, ebx
mov rdx, rdi
mov r8d, ebp
xor r9d, r9d
call sub.bcrypt.dll_BCryptHashData
test eax, eax
js 0x14006df69
mov ecx, reloc.WS2_32.dll_recv
call fcn.14012c51c
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rcx, qword [rsp + 0x60]
mov rdx, rax
mov r8d, reloc.WS2_32.dll_recv
xor r9d, r9d
call sub.bcrypt.dll_BCryptFinishHash
test eax, eax
jns 0x14006df69
test rbx, rbx
jne 0x14006df5f
jmp 0x14006df67
mov rcx, qword [rsp + 0x68]
xor edx, edx
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
mov qword [r13], 0
mov rcx, rdi
call fcn.14012c524
jmp 0x14006df2c
mov qword [r13], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14012d050
mov rax, r13
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [r13], 0
mov rcx, rbx
call fcn.14012c524
jmp 0x14006df1a
mov rcx, rbx
call fcn.14012c524
xor ebx, ebx
mov rcx, qword [rsp + 0x60]
call sub.bcrypt.dll_BCryptDestroyHash
mov rcx, qword [rsp + 0x68]
xor r15d, r15d
xor edx, edx
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
test rbx, rbx
je 0x14006df12
sar ebp, 3
mov eax, 0
test ebp, ebp
jle 0x14006e0a5
mov ecx, dword [rbx]
mov edx, dword [rbx + 4]
or ecx, 1
or edx, 1
mov r8d, ebp
xor r10d, r10d
xor eax, eax
xor r9d, r9d
xor r15d, r15d
xor ebp, ebp
mov r12d, dword [rdi + r10*8]
add ebp, r12d
imul ebp, ecx
rol ebp, 0x10
imul esi, ebp, 0xcf98b111
rol esi, 0x10
mov r11d, dword [rdi + r10*8 + 4]
imul esi, esi, 0x87085b9f
rol esi, 0x10
imul esi, esi, 0x12ceb96d
rol esi, 0x10
imul esi, esi, 0x257e1d83
add r9d, esi
add r15d, r12d
mov ebp, ecx
imul ebp, r15d
rol r15d, 0x10
imul r15d, r15d, 0xef0569fb
add r15d, ebp
imul ebp, r15d, 0x79f8a395
shr r15d, 0x10
imul r12d, r15d, 0x689b6b9f
add r12d, ebp
mov ebp, r12d
rol ebp, 0x10
imul r15d, ebp, 0xc3efea97
add esi, r11d
imul esi, edx
rol esi, 0x10
add r15d, r12d
imul esi, esi, 0xa27416f5
rol esi, 0x10
add eax, r15d
imul esi, esi, 0xd38396ff
rol esi, 0x10
imul esi, esi, 0x7c932b89
rol esi, 0x10
imul ebp, esi, 0xbfa49f69
add r9d, ebp
add r15d, r11d
mov r11d, edx
imul r11d, r15d
rol r15d, 0x10
imul esi, r15d, 0xc31713db
add esi, r11d
imul r11d, esi, 0x59c3af2d
shr esi, 0x10
imul esi, esi, 0xddcd1f0f
add esi, r11d
mov r11d, esi
rol r11d, 0x10
imul r15d, r11d, 0x35bd1ec9
add r15d, esi
add eax, r15d
inc r10
cmp r8, r10
jne 0x14006dfb2
xor r15d, ebp
xor eax, r9d
lea rcx, [rsp + 0x68]
mov dword [rcx], r15d
mov dword [rcx + 4], eax
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x20], r14
mov edx, 8
mov r8d, 0x40000001
xor r9d, r9d
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x14006df4d
mov r12d, dword [rsp + 0x60]
add r12, r12
mov rcx, r12
call fcn.14012c51c
mov r15, rax
xor esi, esi
mov rcx, rax
xor edx, edx
mov r8, r12
call fcn.14012ffe0
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x68]
mov edx, 8
mov r8d, 0x40000001
mov r9, r15
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
cmovne rsi, r15
mov qword [r13], rsi
test r15, r15
je 0x14006df55
test eax, eax
jne 0x14006df55
mov rcx, r15
call fcn.14012c524
jmp 0x14006df55