Function at 0x1800085a0
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x358]
sub rsp, 0x430
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
movaps xmmword [rax - 0xa8], xmm12
movaps xmmword [rax - 0xb8], xmm13
mov rax, qword [0x18017d2b8]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov qword [rbp - 0x48], r9
mov rdi, r8
mov r13, rdx
mov qword [rbp - 0x50], rdx
mov ebx, ecx
mov dword [rbp - 0x70], ecx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
xor r10d, r10d
mov qword [rbp - 0x30], r10
mov esi, ecx
lea eax, [rcx + rcx*2]
shl eax, 8
mov dword [rbp - 0x5c], eax
movsd xmm13, qword [0x180159918]
cmp ecx, eax
ja 0x1800089f7
movsd xmm6, qword [0x18015a7b0]
movsd xmm7, qword [0x18015cfc0]
movsd xmm8, qword [0x18015aca0]
movsd xmm9, qword [0x18015d770]
mov r12d, dword [rbp - 0x60]
mov r15d, dword [rbp - 0x60]
mov eax, 0x51
lea ecx, [rax - 0x10]
cmp esi, 0x288b
ja 0x180008818
je case.0x180008a80.11
cmp esi, 0x101
ja 0x1800087b3
je 0x180008792
mov eax, esi
sub eax, 0x40
je 0x180008772
sub eax, 0x2b
je 0x180008723
sub eax, 0x18
je 0x1800086e6
cmp eax, 0x55
jne 0x1800089e2
movsd qword [rbp - 0x78], xmm6
movsd qword [rbp - 0x58], xmm7
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x109
xor r8d, r8d
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x58]
call fcn.180074e50
xor r10d, r10d
jmp 0x1800089e2
mov eax, dword [0x180156ac0]
mov dword [rbp + 0x50], eax
movzx eax, word [0x180156ac4]
mov word [rbp + 0x54], ax
mov word [rbp + 0x56], r10w
mov r8d, 5
lea rdx, [0x180156af2]
lea rcx, [rbp + 0x56]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor r10d, r10d
mov word [rbp + 0x60], r10w
jmp 0x1800089e2
test r13, r13
je 0x180008a8c
mov r8d, dword [r9]
cmp r8d, 0x20
ja 0x180008a82
mov r12d, r10d
mov r15d, r10d
test r8d, r8d
je 0x1800089e2
mov r9d, dword [r13]
nop dword [rax]
mov edx, r9d
mov ecx, r15d
shr edx, cl
and edx, 1
lea eax, [r12 + r12]
mov r12d, edx
or r12d, eax
inc r15d
cmp r15d, r8d
jb 0x180008750
jmp 0x1800089e2
movzx eax, word [0x180156a17]
mov word [rbp + 0x40], ax
movzx eax, byte [0x180156a19]
mov byte [rbp + 0x42], al
mov word [rbp + 0x43], 0x2e
jmp 0x1800089e2
xor r8d, r8d
lea rdx, [rbp - 0x40]
mov ecx, 0x85
call fcn.18010d280
test al, al
je 0x180008f0a
xor r10d, r10d
jmp 0x1800089e2
cmp esi, 0xc40
je 0x1800087f5
cmp esi, 0x147b
je 0x1800087e8
cmp esi, 0x1913
jne 0x1800089e2
mov eax, dword [0x180156c4e]
mov dword [rbp + 0x60], eax
movzx eax, word [0x180156c52]
mov word [rbp + 0x64], ax
jmp 0x1800089e2
mov dword [r13], r12d
mov dword [rbp - 0x80], r15d
jmp 0x1800089e2
mov r8d, 1
lea rdx, [0x180156bda]
lea rcx, [rbp + 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x45], 0
xor r10d, r10d
jmp 0x1800089e2
cmp esi, 0x4a33
ja 0x1800089bb
je 0x18000898b
mov eax, esi
sub eax, 0x2958
je 0x1800088f8
sub eax, 0x7d9
je 0x180008884
cmp eax, 0x72
jne 0x1800089e2
mov word [rbp + 0x66], r10w
lea r8d, [rax - 0x71]
lea rdx, str.jUI558VtQuSlKb5piGPPzg
lea rcx, [rbp + 0x66]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
mov word [rbp + 0x68], ax
lea r8d, [rax + 3]
lea rdx, [0x180156bb0]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
xor r10d, r10d
jmp 0x1800089e2
mov rbx, qword [rbp - 0x40]
mov r14, qword [rbp - 0x38]
cmp rbx, r14
je 0x1800088ec
mov dword [rbp + 0x30], 0x53004d
mov word [rbp + 0x34], cx
mov dword [rbp + 0x36], 0x440046
mov word [rbp + 0x3a], r10w
mov eax, dword [r13]
cmp dword [rbx + 0x4c], eax
jne 0x1800088e0
mov eax, dword [r9]
cmp dword [rbx + 0x58], eax
jne 0x1800088e0
lea rcx, [rbx + 0x74]
mov r8d, 5
lea rdx, [rbp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x180008a96
mov r9, qword [rbp - 0x48]
xor r10d, r10d
lea ecx, [r10 + 0x41]
add rbx, 0x274
cmp rbx, r14
jne 0x180008891
mov byte [rbp - 0x80], 0
mov ebx, dword [rbp - 0x70]
jmp 0x1800089e2
movsd qword [rbp - 0x68], xmm13
movsd qword [rbp - 0x78], xmm8
movsd xmm0, qword [rbp - 0x20]
movsd qword [rbp - 0x58], xmm0
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x58]
lea r8, str.rm11
lea rdx, str.eraEcm06
lea rcx, [rbp - 0x68]
call fcn.1800fe9c0
movsd qword [rbp - 0x58], xmm13
movsd qword [rbp - 0x68], xmm9
movsd xmm0, qword [rbp - 0x18]
movsd qword [rbp - 0x78], xmm0
lea rax, [rbp - 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x78]
lea r8, str.rm12
lea rdx, str.eraEcm06
lea rcx, [rbp - 0x58]
call fcn.1800fe9c0
xor r10d, r10d
jmp 0x1800089e2
mov r8d, 3
lea rdx, [0x180156a72]
lea rcx, [rbp + 0x6e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, dword [0x180156aa6]
mov dword [rbp + 0x74], eax
movzx eax, word [0x180156aaa]
mov word [rbp + 0x78], ax
xor r10d, r10d
jmp 0x1800089e2
cmp esi, 0x6161
je case.0x180008a80.11
cmp esi, 0x62c3
je 0x1800089de
cmp esi, 0x7b53
jne 0x1800089e2
mov word [rbp + 0x7c], r10w
jmp 0x1800089e2
mov word [rbp + 0x7a], ax
lea eax, [rbx + rbx*2]
shl eax, 4
add esi, eax
mov r9, qword [rbp - 0x48]
cmp esi, dword [rbp - 0x5c]
jbe 0x18000866b
lea r15d, [rbx + 0x10]
cmp ebx, r15d
jae case.0x180008a80.11
add ebx, 0xffffffc0
mov esi, 4
lea rdx, [0x180000000]
mov r8d, 0x1bb
movsd xmm6, qword [0x180159c60]
movsd xmm9, qword [0x18015d6e0]
movsd xmm10, qword [0x18015a2f0]
movsd xmm11, qword [0x18015ab80]
movsd xmm12, qword [0x18015a788]
movsd xmm7, qword [0x18015db10]
movsd xmm8, qword [0x18015ab88]
mov r12d, dword [rbp - 0x60]
mov r13d, dword [rbp - 0x60]
mov r14, qword [rbp - 0x50]
cmp ebx, 0x9a
ja case.0x180008a80.15
movzx eax, byte [rdx + rbx + 0x9008]
mov ecx, dword [rdx + rax*4 + 0x8fc8]
add rcx, rdx
jmp rcx
mov ebx, 0xfffffffb
jmp 0x180008f11
mov ebx, 0xfffffffe
jmp 0x180008f11
mov esi, 4
nop dword [rax + rax]
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rdi + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rdi + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rdi + 0x50], xmm1
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rdi + 0x60], xmm0
lea rdi, [rdi + 0x80]
movups xmm1, xmmword [rbx + 0x70]
movups xmmword [rdi - 0x10], xmm1
lea rbx, [rbx + 0x80]
sub rsi, 1
jne 0x180008aa0
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rdi + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rdi + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rdi + 0x50], xmm1
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rdi + 0x60], xmm0
mov eax, dword [rbx + 0x70]
mov dword [rdi + 0x70], eax
mov byte [rbp - 0x80], 1
jmp case.0x180008a80.11
mov dword [rbp - 0x5c], 1
mov qword [rsp + 0x88], r10
mov qword [rsp + 0x80], r10
mov qword [rsp + 0x78], r10
mov qword [rsp + 0x70], r10
mov qword [rsp + 0x68], r10
mov qword [rsp + 0x60], r10
mov qword [rsp + 0x58], r10
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], 0x89
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800ee150
test al, al
je 0x180008f0a
mov r12d, 1
jmp 0x180008ee7
movsd qword [rbp - 0x68], xmm6
movsd xmm0, qword [rbp + 0x10]
lea r8, str.rm31
jmp 0x180008eb2
mov byte [rbp + 0x39], 0
lea rax, [rbp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180008be0
lea rdx, [rbp + 0x40]
mov rcx, r9
call fcn.180027a60
lea rax, [rbp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180008c01
mov r14, qword [rbp - 0x48]
lea rdx, [rbp + 0x30]
lea rcx, [r14 + 0x20]
call fcn.180027a60
mov rax, qword [rbp - 0x50]
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x180008c2d
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [r14 + 0x20]
call fcn.1800276d0
mov r14, qword [rbp - 0x50]
jmp 0x180008ee7
mov word [r9 + 0x60], r8w
lea rdx, [r9 + 0x40]
mov dword [rsp + 0x20], 0x8b
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call fcn.18001e760
jmp 0x180008ee7
movzx eax, word [0x180156c7c]
mov word [rbp + 0x35], ax
movzx eax, byte [0x180156c7e]
mov byte [rbp + 0x37], al
mov byte [rbp + 0x38], 0x3d
jmp case.0x180008a80.15
mov r13d, esi
jmp case.0x180008a80.15
mov eax, dword [0x180156cc4]
mov dword [rbp + 0x30], eax
movzx eax, byte [0x180156cc8]
mov byte [rbp + 0x34], al
mov byte [rbp + 0x35], 0
jmp case.0x180008a80.15
mov dword [rsp + 0x20], r12d
mov r9d, dword [rbp - 0x5c]
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x50]
call qword [sym.imp.SHLWAPI.dll_UrlGetPartW]
mov ecx, r13d
call qword [sym.imp.GDI32.dll_GetStockObject]
movzx eax, word [rdi]
mov word [rbp - 0x70], ax
mov eax, dword [rbp - 0x58]
mov dword [rbp - 0x78], eax
mov dword [rsp + 0x20], 0x103
lea r9, [rbp - 0x78]
lea r8, [rbp - 0x70]
mov rdx, r14
xor ecx, ecx
call fcn.180020da0
mov byte [rbp - 0x80], al
jmp 0x180008ee7
mov word [rbp + 0x4e], 0x6d
jmp case.0x180008a80.15
movsd qword [rbp - 0x70], xmm13
movsd qword [rbp - 0x68], xmm9
movsd xmm0, qword [rbp - 0x10]
movsd qword [rbp - 0x78], xmm0
lea rax, [rbp - 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
mov r14, qword [rbp - 0x50]
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x78]
lea r8, str.rm13
lea rdx, str.eraEcm06
lea rcx, [rbp - 0x70]
call fcn.1800fe9c0
movsd qword [rbp - 0x70], xmm13
movsd qword [rbp - 0x68], xmm10
movsd xmm0, qword [rbp - 8]
movsd qword [rbp - 0x78], xmm0
lea rax, [rbp - 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x78]
lea r8, str.rm21
lea rdx, str.eraEcm06
lea rcx, [rbp - 0x70]
call fcn.1800fe9c0
movsd qword [rbp - 0x70], xmm13
movsd qword [rbp - 0x68], xmm11
movsd xmm0, qword [rbp]
movsd qword [rbp - 0x78], xmm0
lea rax, [rbp - 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x78]
lea r8, str.rm22
lea rdx, str.eraEcm06
lea rcx, [rbp - 0x70]
call fcn.1800fe9c0
movsd qword [rbp - 0x68], xmm12
movsd xmm0, qword [rbp + 8]
lea r8, str.rm23
jmp 0x180008eb2
movzx eax, word [0x180156cdf]
mov word [rbp + 0x45], ax
movzx eax, byte [0x180156ce1]
mov byte [rbp + 0x47], al
mov byte [rbp + 0x48], 0
mov r8d, 3
lea rdx, [0x180156d08]
lea rcx, [rbp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180008ee7
mov r8d, 3
lea rdx, [0x180156d34]
lea rcx, [rbp + 0x4b]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x4e], 0
jmp 0x180008ee7
mov dword [rbp - 0x60], 0x104
jmp case.0x180008a80.15
movsd qword [rbp - 0x70], xmm13
movsd qword [rbp - 0x68], xmm7
movsd xmm0, qword [rbp + 0x18]
movsd qword [rbp - 0x78], xmm0
lea rax, [rbp - 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x78]
lea r8, str.rm32
lea rdx, str.eraEcm06
lea rcx, [rbp - 0x70]
call fcn.1800fe9c0
movsd qword [rbp - 0x68], xmm8
movsd xmm0, qword [rbp + 0x20]
lea r8, str.rm33
lea rax, [rbp - 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
mov qword [rsp + 0x20], r14
movsd qword [rbp - 0x70], xmm13
movsd qword [rbp - 0x78], xmm0
lea r9, [rbp - 0x78]
lea rdx, str.eraEcm06
lea rcx, [rbp - 0x70]
call fcn.1800fe9c0
lea rdx, [0x180000000]
mov r8d, 0x1bb
inc ebx
lea eax, [rbx + 0x40]
cmp eax, r15d
jae case.0x180008a80.11
mov r9, qword [rbp - 0x48]
xor r10d, r10d
jmp 0x180008a62
mov byte [rbp - 0x80], 0
mov ebx, dword [rbp - 0x80]
mov r8, qword [rbp - 0x40]
test r8, r8
je 0x180008f73
mov rcx, qword [rbp - 0x30]
sub rcx, r8
movabs rax, 0x342da7f2f4960343
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x274
mov rax, r8
cmp rdx, 0x1000
jb 0x180008f6b
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180008f6b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.18010ff50
mov eax, ebx
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.180110960
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret