Function at 0x1400493b0
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rbx, rdx
mov rsi, rcx
xor edi, edi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov r14d, edi
mov qword [rsp + 0x78], rdi
lea rcx, [rbp - 0x38]
call fcn.1400edf80
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp + 0x20], xmm1
mov eax, dword [rax]
test eax, eax
js 0x140049b86
lea rcx, [rbp - 0x60]
call fcn.14004a71c
nop
mov rdx, rbx
lea rcx, [rbp + 0x30]
call fcn.1400edafc
nop
mov r12, qword [rbp + 0x30]
xor ebx, ebx
test r12, r12
jne 0x14004946f
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rbx
mov qword [rsi], rbx
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rbx
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x140049ba0
lea rcx, [rbx + 0x60]
call fcn.14004a65c
mov edx, 0x10088
mov rcx, rbx
call fcn.140173310
jmp 0x140049ba0
mov rax, qword [rbp + 0x38]
mov byte [r12 + rax - 1], bl
mov rdx, r12
mov rdi, qword [rbp - 0x60]
mov rcx, rdi
call fcn.14004a790
mov cl, 5
mov dword [rsp + 0x40], 0x696c4305
mov dword [rsp + 0x44], 0x696c5f60
mov dword [rsp + 0x48], 0x366469
mov rax, rbx
xor byte [rsp + rax + 0x41], cl
inc rax
cmp rax, 0xa
jae 0x1400494b7
mov cl, byte [rsp + 0x40]
jmp 0x1400494a4
mov byte [rsp + 0x4b], bl
lea rdx, [rsp + 0x41]
mov rcx, rdi
call fcn.14004a530
mov dl, Ordinal_35
mov dword [rsp + 0x40], 0x50477122
mov dword [rsp + 0x44], 0x51504754
mov byte [rsp + 0x48], bl
mov rcx, rbx
xor byte [rsp + rcx + 0x41], dl
inc rcx
cmp rcx, 7
jae 0x1400494f4
mov dl, byte [rsp + 0x40]
jmp 0x1400494e1
mov byte [rsp + 0x48], bl
lea rdx, [rsp + 0x41]
mov rcx, rax
call fcn.14004a530
lea rdx, [0x1401e5cd8]
mov rcx, rax
call fcn.14004a530
mov r13, rax
mov r15, qword [rsp + 0x70]
test rax, rax
je 0x140049b4f
mov cl, reloc.WS2_32.dll_ntohs
mov dword [rbp + 0x118], 0x7c60470f
mov word [rbp + 0x11c], 0x7b
mov rax, rbx
xor byte [rbp + rax + 0x119], cl
inc rax
cmp rax, 4
jae 0x140049555
mov cl, byte [rbp + 0x118]
jmp 0x14004953d
mov byte [rbp + 0x11d], bl
lea rdx, [rbp + 0x119]
cmp byte [rbp + 0x119], bl
je 0x140049571
inc rdx
cmp byte [rdx], bl
jne 0x14004956a
lea rax, [rbp + 0x119]
sub rdx, rax
mov r8, qword [r13 + 0x30]
jmp 0x1400495c7
mov rcx, qword [r8]
test rcx, rcx
je 0x14004958f
mov rax, qword [r8 + 0x10]
jmp 0x140049599
mov rax, rbx
lea rcx, [0x14021c960]
cmp rax, rdx
jne 0x1400495c3
lea r10, [rax + rcx]
cmp rcx, r10
jae 0x1400495cf
lea r9, [rbp + 0x119]
sub r9, rcx
mov al, byte [r9 + rcx]
cmp byte [rcx], al
jne 0x1400495c3
inc rcx
cmp rcx, r10
jae 0x1400495cf
jmp 0x1400495b1
mov r8, qword [r8 + 0x58]
test r8, r8
jne 0x140049581
mov r8, rbx
lea rdx, [0x14021c960]
cmp qword [r8 + 8], rbx
cmovne rdx, qword [r8 + 8]
mov qword [rbp], rbx
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp], bl
lea rcx, [rbp]
call fcn.140005250
nop
mov cl, 0x2b
mov dword [rsp + 0x50], 0x59447b2b
mov word [rsp + 0x54], 0x5f
mov rax, rbx
xor byte [rsp + rax + 0x51], cl
inc rax
cmp rax, 4
jae 0x140049623
mov cl, byte [rsp + 0x50]
jmp 0x140049610
mov byte [rsp + 0x55], bl
lea rdx, [rsp + 0x51]
cmp byte [rsp + 0x51], bl
je 0x140049639
inc rdx
cmp byte [rdx], bl
jne 0x140049632
lea rax, [rsp + 0x51]
sub rdx, rax
mov r8, qword [r13 + 0x30]
jmp 0x14004968b
mov rcx, qword [r8]
test rcx, rcx
je 0x140049655
mov rax, qword [r8 + 0x10]
jmp 0x14004965f
mov rax, rbx
lea rcx, [0x14021c960]
cmp rax, rdx
jne 0x140049687
lea r10, [rax + rcx]
cmp rcx, r10
jae 0x140049693
lea r9, [rsp + 0x51]
sub r9, rcx
mov al, byte [r9 + rcx]
cmp byte [rcx], al
jne 0x140049687
inc rcx
cmp rcx, r10
jae 0x140049693
jmp 0x140049675
mov r8, qword [r8 + 0x58]
test r8, r8
jne 0x140049647
mov r8, rbx
lea rdx, [0x14021c960]
cmp qword [r8 + 8], rbx
cmovne rdx, qword [r8 + 8]
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], bl
lea rcx, [rbp - 0x38]
call fcn.140005250
nop
mov cl, 0x2a
mov dword [rsp + 0x56], 0x4f597f2a
mov word [rsp + 0x5a], 0x58
mov rax, rbx
xor byte [rsp + rax + 0x57], cl
inc rax
cmp rax, 4
jae 0x1400496e7
mov cl, byte [rsp + 0x56]
jmp 0x1400496d4
mov byte [rsp + 0x5b], bl
lea rdx, [rsp + 0x57]
cmp byte [rsp + 0x57], bl
je 0x1400496fd
inc rdx
cmp byte [rdx], bl
jne 0x1400496f6
lea rax, [rsp + 0x57]
sub rdx, rax
mov r8, qword [r13 + 0x30]
jmp 0x14004974f
mov rcx, qword [r8]
test rcx, rcx
je 0x140049719
mov rax, qword [r8 + 0x10]
jmp 0x140049723
mov rax, rbx
lea rcx, [0x14021c960]
cmp rax, rdx
jne 0x14004974b
lea r10, [rcx + rax]
cmp rcx, r10
jae 0x140049757
lea r9, [rsp + 0x57]
sub r9, rcx
mov al, byte [r9 + rcx]
cmp byte [rcx], al
jne 0x14004974b
inc rcx
cmp rcx, r10
jae 0x140049757
jmp 0x140049739
mov r8, qword [r8 + 0x58]
test r8, r8
jne 0x14004970b
mov r8, rbx
lea rdx, [0x14021c960]
cmp qword [r8 + 8], rbx
cmovne rdx, qword [r8 + 8]
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], bl
lea rcx, [rbp - 0x58]
call fcn.140005250
nop
mov cl, 0x6a
mov dword [rsp + 0x5c], 0x190b3a6a
mov word [rsp + 0x60], Ordinal_27
mov rax, rbx
xor byte [rsp + rax + 0x5d], cl
inc rax
cmp rax, 4
jae 0x1400497ab
mov cl, byte [rsp + 0x5c]
jmp 0x140049798
mov byte [rsp + 0x61], bl
lea rdx, [rsp + 0x5d]
cmp byte [rsp + 0x5d], bl
je 0x1400497c1
inc rdx
cmp byte [rdx], bl
jne 0x1400497ba
lea rax, [rsp + 0x5d]
sub rdx, rax
mov r8, qword [r13 + 0x30]
jmp 0x140049813
mov rcx, qword [r8]
test rcx, rcx
je 0x1400497dd
mov rax, qword [r8 + 0x10]
jmp 0x1400497e7
mov rax, rbx
lea rcx, [0x14021c960]
cmp rax, rdx
jne 0x14004980f
lea r10, [rax + rcx]
cmp rcx, r10
jae 0x14004981b
lea r9, [rsp + 0x5d]
sub r9, rcx
mov al, byte [r9 + rcx]
cmp byte [rcx], al
jne 0x14004980f
inc rcx
cmp rcx, r10
jae 0x14004981b
jmp 0x1400497fd
mov r8, qword [r8 + 0x58]
test r8, r8
jne 0x1400497cf
mov r8, rbx
lea rdx, [0x14021c960]
cmp qword [r8 + 8], rbx
cmovne rdx, qword [r8 + 8]
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x80], bl
lea rcx, [rbp - 0x80]
call fcn.140005250
nop
mov rdx, qword [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.140048894
nop
mov edx, dword [rbp - 0x70]
mov dword [rbp + 0x110], edx
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rcx, qword [rbp - 0x80]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
lea rax, [rbp + 0x110]
mov qword [rsp + 0x20], rax
mov rbx, qword [rsp + 0x40]
mov r9, rbx
mov r8d, 1
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x1400499d2
test rbx, rbx
je 0x1400498ae
mov rcx, rbx
call fcn.140173310
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1400498e9
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400498e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049bce
call fcn.140173310
xor ebx, ebx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x80], bl
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140049935
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049930
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049bd4
call fcn.140173310
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], bl
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14004997f
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004997a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049bda
call fcn.140173310
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], bl
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140049b43
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400499c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049bc8
call fcn.140173310
jmp 0x140049b43
xor r14d, r14d
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], r14
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call fcn.140005338
nop
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], r14
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x60]
call fcn.140005338
nop
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x98], r14
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x80]
call fcn.140005338
nop
mov r14d, dword [rbp + 0x110]
xor eax, eax
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xa0], al
lea rcx, [rbp + 0xa0]
cmp r14, 0xf
ja 0x140049a81
mov qword [rbp + 0xb0], r14
mov r8d, r14d
mov rdx, rbx
call fcn.140175840
mov byte [rbp + r14 + 0xa0], 0
jmp 0x140049a94
mov r9, rbx
mov r8b, byte [rbp + 0x110]
mov rdx, r14
call fcn.140005450
nop
mov r14, qword [rsp + 0x78]
cmp r15, r14
je 0x140049ab5
lea rdx, [rbp + 0x40]
mov rcx, r15
call fcn.14004b1c0
sub r15, 0xffffffffffffff80
mov qword [rsp + 0x70], r15
jmp 0x140049ad0
lea r8, [rbp + 0x40]
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.14004acc8
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
lea rcx, [rbp + 0x40]
call fcn.140049be0
nop
test rbx, rbx
je 0x140049ae8
mov rcx, rbx
call fcn.140173310
nop
lea rcx, [rbp - 0x80]
call fcn.14000511c
nop
lea rcx, [rbp - 0x58]
call fcn.14000511c
nop
lea rcx, [rbp - 0x38]
call fcn.14000511c
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140049b41
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049b3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049bc8
call fcn.140173310
xor ebx, ebx
mov r13, qword [r13 + 0x58]
test r13, r13
jmp 0x14004951f
mov rax, qword [rsp + 0x68]
mov qword [rsi], rax
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r14
mov rcx, r12
call fcn.140173310
nop
test rdi, rdi
je 0x140049b84
lea rcx, [rdi + 0x60]
call fcn.14004a65c
mov edx, 0x10088
mov rcx, rdi
call fcn.140173310
nop
jmp 0x140049baa
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
lea rcx, [rsp + 0x68]
call fcn.14004a5d0
mov rax, rsi
mov rbx, qword [rsp + 0x200]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14018273c
nop
call fcn.14018273c
nop
call fcn.14018273c
nop
call fcn.14018273c
int3