Function at 0x412d80
Capabilities:
Contain obfuscated stackstrings
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Parse pe header
Read file on windows
Run powershell expression

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447685
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x2800
call fcn.00445a10
mov eax, dword [0x467040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2790], esi
push str.____Found_ImportCode_string:_Invoke_RestMethod.
push str.Invoke_RestMethod
lea ecx, [ebp - 0x2740]
mov dword [ebp - 0x2778], 0
call fcn.004156b0
push str.____Found_ImportCode_string:_Invoke_Expression.
push str.Invoke_Expression
lea ecx, [ebp - 0x2710]
mov dword [ebp - 4], 0
call fcn.004156b0
push str.____Found_ImportCode_string:_import_base64.
push str.import_base64
lea ecx, ds:[ebp - 0x26e0]
mov byte [ebp - 4], 1
call fcn.004156b0
push 0x44ddd0
push 0x44de2c
lea ecx, [ebp - 0x26b0]
mov byte [ebp - 4], 2
call fcn.004156b0
push 0x44de48
push 0x44dea4
lea ecx, [ebp - 0x2680]
mov byte [ebp - 4], 3
call fcn.004156b0
push 0x44dec0
push 0x44df1c
lea ecx, [ebp - 0x2650]
mov byte [ebp - 4], 4
call fcn.004156b0
push 0x44df38
push 0x44df94
lea ecx, [ebp - 0x2620]
mov byte [ebp - 4], 5
call fcn.004156b0
push str.____Found_ImportCode_string:_Convert.FromBase32String.
push str.Convert.FromBase32String
lea ecx, ds:[ebp - 0x25f0]
mov byte [ebp - 4], 6
call fcn.004156b0
push str.____Found_ImportCode_string:_Convert.FromBase64String.
push str.Convert.FromBase64String
lea ecx, [ebp - 0x25c0]
mov byte [ebp - 4], 7
call fcn.004156b0
push str.____Found_ImportCode_string:_Base64.getDecoder__.
push str.Base64.getDecoder__
lea ecx, [ebp - 0x2590]
mov byte [ebp - 4], 8
call fcn.004156b0
push str.____Found_ImportCode_string:_Base32.getDecoder__.
push str.Base32.getDecoder__
lea ecx, [ebp - 0x2560]
mov byte [ebp - 4], 9
call fcn.004156b0
push str.____Found_ImportCode_string:_js_base64.
push str.js_base64
lea ecx, [ebp - 0x2530]
mov byte [ebp - 4], 0xa
call fcn.004156b0
push str.____Found_ImportCode_string:_js_base32.
push str.js_base32
lea ecx, ds:[ebp - 0x2500]
mov byte [ebp - 4], 0xb
call fcn.004156b0
push str.____Found_ImportCode_string:_base64_js.
mov byte [ebp - 4], 0xc
push str.base64_js
lea ecx, [ebp - 0x24d0]
call fcn.004156b0
push str.____Found_ImportCode_string:_base32_js.
push str.base32_js
lea ecx, [ebp - 0x24a0]
mov byte [ebp - 4], 0xd
call fcn.004156b0
push str.____Found_ImportCode_string:_base64.b64decode.
push str.base64.b64decode
lea ecx, [ebp - 0x2470]
mov byte [ebp - 4], 0xe
call fcn.004156b0
push str.____Found_ImportCode_string:_base32.b32decode.
push str.base32.b32decode
lea ecx, [ebp - 0x2440]
mov byte [ebp - 4], 0xf
call fcn.004156b0
push str.____Found_ImportCode_string:_base64.b64encode.
push str.base64.b64encode
lea ecx, ds:[ebp - 0x2410]
mov byte [ebp - 4], 0x10
call fcn.004156b0
push str.____Found_ImportCode_string:_base32.b32encode.
push str.base32.b32encode
lea ecx, [ebp - 0x23e0]
mov byte [ebp - 4], 0x11
call fcn.004156b0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x23b0]
push 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x23a0], 0
push str.Base64.decode64
movups xmmword [ebp - 0x23b0], xmm0
mov dword [ebp - 0x239c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x2398]
push 0x2f
xorps xmm0, xmm0
mov dword [ebp - 0x2388], 0
push str.____Found_ImportCode_string:_Base64.decode64.
movups xmmword [ebp - 0x2398], xmm0
mov dword [ebp - 0x2384], 0
call fcn.004063e0
push str.____Found_ImportCode_string:_Base32.decode32.
push str.Base32.decode32
lea ecx, [ebp - 0x2380]
mov byte [ebp - 4], 0x14
call fcn.004156b0
push str.____Found_ImportCode_string:_Base64.encode64.
push str.Base64.encode64
lea ecx, [ebp - 0x2350]
mov byte [ebp - 4], 0x15
call fcn.004156b0
push str.____Found_ImportCode_string:_Base32.encode32.
push str.Base32.encode32
lea ecx, [ebp - 0x2320]
mov byte [ebp - 4], 0x16
call fcn.004156b0
push str.____Found_ImportCode_string:_encoding_base64.
push str.encoding_base64
lea ecx, [ebp - 0x22f0]
mov byte [ebp - 4], 0x17
call fcn.004156b0
push str.____Found_ImportCode_string:_encoding_base32.
mov byte ds:[ebp - 4], 0x18
lea ecx, [ebp - 0x22c0]
push str.encoding_base32
call fcn.004156b0
push str.____Found_ImportCode_string:_decoding_base32.
push str.decoding_base32
lea ecx, [ebp - 0x2290]
mov byte [ebp - 4], 0x19
call fcn.004156b0
push str.____Found_ImportCode_string:_decoding_base64.
push str.decoding_base64
lea ecx, [ebp - 0x2260]
mov byte [ebp - 4], 0x1a
call fcn.004156b0
push str.____Found_ImportCode_string:_decode_base64.
push str.decode_base64
lea ecx, [ebp - 0x2230]
mov byte [ebp - 4], 0x1b
call fcn.004156b0
push str.____Found_ImportCode_string:_decode_base32.
push str.decode_base32
lea ecx, [ebp - 0x2200]
mov byte [ebp - 4], 0x1c
call fcn.004156b0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x21d0]
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0x21c0], 0
push str.encode_base64
movups xmmword [ebp - 0x21d0], xmm0
mov dword [ebp - 0x21bc], 0
call fcn.004063e0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x21b8]
push 0x2d
xorps xmm0, xmm0
mov dword [ebp - 0x21a8], 0
push str.____Found_ImportCode_string:_encode_base64.
movups xmmword [ebp - 0x21b8], xmm0
mov dword [ebp - 0x21a4], 0
call fcn.004063e0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x21a0]
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0x2190], 0
push str.encode_base32
movups xmmword [ebp - 0x21a0], xmm0
mov dword [ebp - 0x218c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x2188]
push 0x2d
xorps xmm0, xmm0
mov dword [ebp - 0x2178], 0
push str.____Found_ImportCode_string:_encode_base32.
movups xmmword [ebp - 0x2188], xmm0
mov dword [ebp - 0x2174], 0
call fcn.004063e0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x2170]
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x2160], 0
push str.base64::decode
movups xmmword [ebp - 0x2170], xmm0
mov dword [ebp - 0x215c], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x22
xorps xmm0, xmm0
movups xmmword [ebp - 0x2158], xmm0
mov dword [ebp - 0x2148], 0
mov dword [ebp - 0x2144], 0
push 0x2e
push str.____Found_ImportCode_string:_base64::decode.
lea ecx, [ebp - 0x2158]
call fcn.004063e0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x2140]
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x2130], 0
push str.base32::decode
movups xmmword [ebp - 0x2140], xmm0
mov dword [ebp - 0x212c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x2128]
push 0x2e
xorps xmm0, xmm0
mov dword [ebp - 0x2118], 0
push str.____Found_ImportCode_string:_base32::decode.
movups xmmword [ebp - 0x2128], xmm0
mov dword [ebp - 0x2114], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x25
lea ecx, [ebp - 0x2110]
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x2100], 0
push str.base64::encode
movups xmmword [ebp - 0x2110], xmm0
mov dword [ebp - 0x20fc], 0
call fcn.004063e0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x20f8]
push 0x2e
xorps xmm0, xmm0
mov dword [ebp - 0x20e8], 0
push str.____Found_ImportCode_string:_base64::encode.
movups xmmword [ebp - 0x20f8], xmm0
mov dword [ebp - 0x20e4], 0
call fcn.004063e0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x20e0]
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x20d0], 0
push str.base64::encode
movups xmmword [ebp - 0x20e0], xmm0
mov dword [ebp - 0x20cc], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x28
lea ecx, [ebp - 0x20c8]
push 0x2e
xorps xmm0, xmm0
mov dword [ebp - 0x20b8], 0
push str.____Found_ImportCode_string:_base64::encode.
movups xmmword [ebp - 0x20c8], xmm0
mov dword [ebp - 0x20b4], 0
call fcn.004063e0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x20b0]
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0x20a0], 0
push str.Base64.decode
movups xmmword [ebp - 0x20b0], xmm0
mov dword [ebp - 0x209c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x2a
xorps xmm0, xmm0
movups xmmword [ebp - 0x2098], xmm0
mov dword [ebp - 0x2088], 0
mov dword [ebp - 0x2084], 0
push 0x2d
push str.____Found_ImportCode_string:_Base64.decode.
lea ecx, [ebp - 0x2098]
call fcn.004063e0
mov byte ds:[ebp - 4], 0x2b
lea ecx, [ebp - 0x2080]
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0x2070], 0
push str.Base64.encode
movups xmmword [ebp - 0x2080], xmm0
mov dword [ebp - 0x206c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x2068]
push 0x2d
xorps xmm0, xmm0
mov dword [ebp - 0x2058], 0
push str.____Found_ImportCode_string:_Base64.encode.
movups xmmword [ebp - 0x2068], xmm0
mov dword [ebp - 0x2054], 0
call fcn.004063e0
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x2050]
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0x2040], 0
push str.Base32.decode
movups xmmword [ebp - 0x2050], xmm0
mov dword [ebp - 0x203c], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x2e
lea ecx, [ebp - 0x2038]
push 0x2d
xorps xmm0, xmm0
mov dword [ebp - 0x2028], 0
push str.____Found_ImportCode_string:_Base32.decode.
movups xmmword [ebp - 0x2038], xmm0
mov dword [ebp - 0x2024], 0
call fcn.004063e0
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x2020]
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0x2010], 0
push str.Base32.encode
movups xmmword [ebp - 0x2020], xmm0
mov dword [ebp - 0x200c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x2008]
push 0x2d
xorps xmm0, xmm0
mov dword [ebp - 0x1ff8], 0
push str.____Found_ImportCode_string:_Base32.encode.
movups xmmword [ebp - 0x2008], xmm0
mov dword [ebp - 0x1ff4], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x31
lea ecx, [ebp - 0x1ff0]
push 0x15
xorps xmm0, xmm0
mov dword [ebp - 0x1fe0], 0
push str.NSString_base64Decode
movups xmmword [ebp - 0x1ff0], xmm0
mov dword [ebp - 0x1fdc], 0
call fcn.004063e0
mov byte [ebp - 4], 0x32
xorps xmm0, xmm0
push 0x35
movups xmmword [ebp - 0x1fd8], xmm0
mov dword [ebp - 0x1fc8], 0
mov dword [ebp - 0x1fc4], 0
push str.____Found_ImportCode_string:_NSString_base64Decode.
lea ecx, [ebp - 0x1fd8]
call fcn.004063e0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x1fc0]
push 0x15
xorps xmm0, xmm0
mov dword [ebp - 0x1fb0], 0
push str.NSString_base32Decode
movups xmmword [ebp - 0x1fc0], xmm0
mov dword [ebp - 0x1fac], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x34
lea ecx, [ebp - 0x1fa8]
push 0x35
xorps xmm0, xmm0
mov dword [ebp - 0x1f98], 0
push str.____Found_ImportCode_string:_NSString_base32Decode.
movups xmmword [ebp - 0x1fa8], xmm0
mov dword [ebp - 0x1f94], 0
call fcn.004063e0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x1f90]
push 0x15
xorps xmm0, xmm0
mov dword [ebp - 0x1f80], 0
push str.NSString_base32Encode
movups xmmword [ebp - 0x1f90], xmm0
mov dword [ebp - 0x1f7c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x1f78]
push 0x35
xorps xmm0, xmm0
mov dword [ebp - 0x1f68], 0
push str.____Found_ImportCode_string:_NSString_base32Encode.
movups xmmword [ebp - 0x1f78], xmm0
mov dword [ebp - 0x1f64], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x37
lea ecx, [ebp - 0x1f60]
push 0x15
xorps xmm0, xmm0
mov dword [ebp - 0x1f50], 0
push str.NSString_base64Encode
movups xmmword [ebp - 0x1f60], xmm0
mov dword [ebp - 0x1f4c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x1f48]
push 0x35
xorps xmm0, xmm0
mov dword [ebp - 0x1f38], 0
push str.____Found_ImportCode_string:_NSString_base64Encode.
movups xmmword [ebp - 0x1f48], xmm0
mov dword [ebp - 0x1f34], 0
call fcn.004063e0
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x1f30]
push 0x2f
xorps xmm0, xmm0
mov dword [ebp - 0x1f20], 0
push str.com.google.common.io.BaseEncoding.base64.decode
movups xmmword [ebp - 0x1f30], xmm0
mov dword [ebp - 0x1f1c], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x3a
lea ecx, [ebp - 0x1f18]
xorps xmm0, xmm0
mov dword [ebp - 0x1f08], 0
push 0x4f
movups xmmword [ebp - 0x1f18], xmm0
mov dword [ebp - 0x1f04], 0
push str.____Found_ImportCode_string:_com.google.common.io.BaseEncoding.base64.decode.
call fcn.004063e0
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x1f00]
push 0x2f
xorps xmm0, xmm0
mov dword [ebp - 0x1ef0], 0
push str.com.google.common.io.BaseEncoding.base32.decode
movups xmmword [ebp - 0x1f00], xmm0
mov dword [ebp - 0x1eec], 0
call fcn.004063e0
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x1ee8]
push 0x4f
xorps xmm0, xmm0
mov dword [ebp - 0x1ed8], 0
push str.____Found_ImportCode_string:_com.google.common.io.BaseEncoding.base32.decode.
movups xmmword [ebp - 0x1ee8], xmm0
mov dword [ebp - 0x1ed4], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x3d
lea ecx, [ebp - 0x1ed0]
push 0x2f
xorps xmm0, xmm0
mov dword [ebp - 0x1ec0], 0
push str.com.google.common.io.BaseEncoding.base32.encode
movups xmmword [ebp - 0x1ed0], xmm0
mov dword [ebp - 0x1ebc], 0
call fcn.004063e0
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x1eb8]
push 0x4f
xorps xmm0, xmm0
mov dword [ebp - 0x1ea8], 0
push str.____Found_ImportCode_string:_com.google.common.io.BaseEncoding.base32.encode.
movups xmmword [ebp - 0x1eb8], xmm0
mov dword [ebp - 0x1ea4], 0
call fcn.004063e0
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x1ea0]
push 0x2f
xorps xmm0, xmm0
mov dword [ebp - 0x1e90], 0
push str.com.google.common.io.BaseEncoding.base64.encode
movups xmmword [ebp - 0x1ea0], xmm0
mov dword [ebp - 0x1e8c], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x40
lea ecx, [ebp - 0x1e88]
push 0x4f
xorps xmm0, xmm0
mov dword [ebp - 0x1e78], 0
push str.____Found_ImportCode_string:_com.google.common.io.BaseEncoding.base64.encode.
movups xmmword [ebp - 0x1e88], xmm0
mov dword [ebp - 0x1e74], 0
call fcn.004063e0
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x1e70]
push 0x21
xorps xmm0, xmm0
mov dword [ebp - 0x1e60], 0
push str.Codec.Binary.Base64.String.decode
movups xmmword [ebp - 0x1e70], xmm0
mov dword [ebp - 0x1e5c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x1e58]
push 0x41
xorps xmm0, xmm0
mov dword [ebp - 0x1e48], 0
push str.____Found_ImportCode_string:_Codec.Binary.Base64.String.decode.
movups xmmword [ebp - 0x1e58], xmm0
mov dword [ebp - 0x1e44], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x43
lea ecx, [ebp - 0x1e40]
push 0x21
xorps xmm0, xmm0
mov dword [ebp - 0x1e30], 0
push str.Codec.Binary.Base32.String.decode
movups xmmword [ebp - 0x1e40], xmm0
mov dword [ebp - 0x1e2c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1e28]
push 0x41
xorps xmm0, xmm0
mov dword [ebp - 0x1e18], 0
push str.____Found_ImportCode_string:_Codec.Binary.Base32.String.decode.
movups xmmword [ebp - 0x1e28], xmm0
mov dword [ebp - 0x1e14], 0
call fcn.004063e0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x1e10]
push 0x21
xorps xmm0, xmm0
mov dword [ebp - 0x1e00], 0
push str.Codec.Binary.Base64.String.encode
movups xmmword [ebp - 0x1e10], xmm0
mov dword [ebp - 0x1dfc], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x46
lea ecx, [ebp - 0x1df8]
push 0x41
xorps xmm0, xmm0
mov dword [ebp - 0x1de8], 0
push str.____Found_ImportCode_string:_Codec.Binary.Base64.String.encode.
movups xmmword [ebp - 0x1df8], xmm0
mov dword [ebp - 0x1de4], 0
call fcn.004063e0
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x1de0]
push 0x21
xorps xmm0, xmm0
mov dword [ebp - 0x1dd0], 0
push str.Codec.Binary.Base32.String.encode
movups xmmword [ebp - 0x1de0], xmm0
mov dword [ebp - 0x1dcc], 0
call fcn.004063e0
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x1dc8]
push 0x41
xorps xmm0, xmm0
mov dword [ebp - 0x1db8], 0
push str.____Found_ImportCode_string:_Codec.Binary.Base32.String.encode.
movups xmmword [ebp - 0x1dc8], xmm0
mov dword [ebp - 0x1db4], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x49
lea ecx, [ebp - 0x1db0]
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x1da0], 0
push str.:base64.decode_to_string
movups xmmword [ebp - 0x1db0], xmm0
mov dword [ebp - 0x1d9c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0x1d98]
push 0x38
xorps xmm0, xmm0
mov dword [ebp - 0x1d88], 0
push str.____Found_ImportCode_string:_:base64.decode_to_string.
movups xmmword [ebp - 0x1d98], xmm0
mov dword [ebp - 0x1d84], 0
call fcn.004063e0
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x1d80]
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x1d70], 0
push str.:base32.decode_to_string
movups xmmword [ebp - 0x1d80], xmm0
mov dword [ebp - 0x1d6c], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x4c
lea ecx, [ebp - 0x1d68]
push 0x38
xorps xmm0, xmm0
mov dword [ebp - 0x1d58], 0
push str.____Found_ImportCode_string:_:base32.decode_to_string.
movups xmmword [ebp - 0x1d68], xmm0
mov dword [ebp - 0x1d54], 0
call fcn.004063e0
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x1d50]
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x1d40], 0
push str.:base32.encode_to_string
movups xmmword [ebp - 0x1d50], xmm0
mov dword [ebp - 0x1d3c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x1d38]
push 0x38
xorps xmm0, xmm0
mov dword [ebp - 0x1d28], 0
push str.____Found_ImportCode_string:_:base32.encode_to_string.
movups xmmword [ebp - 0x1d38], xmm0
mov dword [ebp - 0x1d24], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x4f
lea ecx, [ebp - 0x1d20]
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x1d10], 0
push str.:base64.encode_to_string
movups xmmword [ebp - 0x1d20], xmm0
mov dword [ebp - 0x1d0c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x1d08]
push 0x38
xorps xmm0, xmm0
mov dword [ebp - 0x1cf8], 0
push str.____Found_ImportCode_string:_:base64.encode_to_string.
movups xmmword [ebp - 0x1d08], xmm0
mov dword [ebp - 0x1cf4], 0
call fcn.004063e0
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x1cf0]
push 0x13
xorps xmm0, xmm0
mov dword [ebp - 0x1ce0], 0
push str.Base64.base64decode
movups xmmword [ebp - 0x1cf0], xmm0
mov dword [ebp - 0x1cdc], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x52
lea ecx, [ebp - 0x1cd8]
push 0x33
xorps xmm0, xmm0
mov dword [ebp - 0x1cc8], 0
push str.____Found_ImportCode_string:_Base64.base64decode.
movups xmmword [ebp - 0x1cd8], xmm0
mov dword [ebp - 0x1cc4], 0
call fcn.004063e0
mov byte [ebp - 4], 0x53
push 0x13
xorps xmm0, xmm0
mov dword [ebp - 0x1cb0], 0
push str.Base64.base64encode
lea ecx, [ebp - 0x1cc0]
mov dword [ebp - 0x1cac], 0
movups xmmword [ebp - 0x1cc0], xmm0
call fcn.004063e0
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x1ca8]
push 0x33
xorps xmm0, xmm0
mov dword [ebp - 0x1c98], 0
push str.____Found_ImportCode_string:_Base64.base64encode.
movups xmmword [ebp - 0x1ca8], xmm0
mov dword [ebp - 0x1c94], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x55
lea ecx, [ebp - 0x1c90]
push 0x13
xorps xmm0, xmm0
mov dword [ebp - 0x1c80], 0
push str.Base32.base32encode
movups xmmword [ebp - 0x1c90], xmm0
mov dword [ebp - 0x1c7c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x1c78]
push 0x33
xorps xmm0, xmm0
mov dword [ebp - 0x1c68], 0
push str.____Found_ImportCode_string:_Base32.base32encode.
movups xmmword [ebp - 0x1c78], xmm0
mov dword [ebp - 0x1c64], 0
call fcn.004063e0
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x1c60]
push 0x13
xorps xmm0, xmm0
mov dword [ebp - 0x1c50], 0
push str.Base32.base32decode
movups xmmword [ebp - 0x1c60], xmm0
mov dword [ebp - 0x1c4c], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x58
lea ecx, [ebp - 0x1c48]
push 0x33
xorps xmm0, xmm0
mov dword [ebp - 0x1c38], 0
push str.____Found_ImportCode_string:_Base32.base32decode.
movups xmmword [ebp - 0x1c48], xmm0
mov dword [ebp - 0x1c34], 0
call fcn.004063e0
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x1c30]
push 6
xorps xmm0, xmm0
mov dword [ebp - 0x1c20], 0
push str.btoa__
movups xmmword [ebp - 0x1c30], xmm0
mov dword [ebp - 0x1c1c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x1c18]
push 0x26
xorps xmm0, xmm0
mov dword [ebp - 0x1c08], 0
push str.____Found_ImportCode_string:_btoa__.
movups xmmword [ebp - 0x1c18], xmm0
mov dword [ebp - 0x1c04], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x5b
xorps xmm0, xmm0
push 6
push str.atob__
lea ecx, [ebp - 0x1c00]
mov dword [ebp - 0x1bf0], 0
movups xmmword [ebp - 0x1c00], xmm0
mov dword [ebp - 0x1bec], 0
call fcn.004063e0
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x1be8]
push 0x26
xorps xmm0, xmm0
mov dword [ebp - 0x1bd8], 0
push str.____Found_ImportCode_string:_atob__.
movups xmmword [ebp - 0x1be8], xmm0
mov dword [ebp - 0x1bd4], 0
call fcn.004063e0
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x1bd0]
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x1bc0], 0
push str.Convert.ToBase64String__
movups xmmword [ebp - 0x1bd0], xmm0
mov dword [ebp - 0x1bbc], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x5e
lea ecx, [ebp - 0x1bb8]
push 0x38
xorps xmm0, xmm0
mov dword [ebp - 0x1ba8], 0
push str.____Found_ImportCode_string:_Convert.ToBase64String__.
movups xmmword [ebp - 0x1bb8], xmm0
mov dword [ebp - 0x1ba4], 0
call fcn.004063e0
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x1ba0]
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x1b90], 0
push str.Convert.ToBase32String__
movups xmmword [ebp - 0x1ba0], xmm0
mov dword [ebp - 0x1b8c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x1b88]
push 0x38
xorps xmm0, xmm0
mov dword [ebp - 0x1b78], 0
push str.____Found_ImportCode_string:_Convert.ToBase32String__.
movups xmmword [ebp - 0x1b88], xmm0
mov dword [ebp - 0x1b74], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x61
lea ecx, [ebp - 0x1b70]
push 0x1a
xorps xmm0, xmm0
mov dword [ebp - 0x1b60], 0
push str.Convert.FromBase64String__
movups xmmword [ebp - 0x1b70], xmm0
mov dword [ebp - 0x1b5c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x62
lea ecx, [ebp - 0x1b58]
push 0x3a
xorps xmm0, xmm0
mov dword [ebp - 0x1b48], 0
push str.____Found_ImportCode_string:_Convert.FromBase64String__.
movups xmmword [ebp - 0x1b58], xmm0
mov dword [ebp - 0x1b44], 0
call fcn.004063e0
xorps xmm0, xmm0
mov byte [ebp - 4], 0x63
movups xmmword [ebp - 0x1b40], xmm0
push 0x1a
push str.Convert.FromBase32String__
lea ecx, [ebp - 0x1b40]
mov dword [ebp - 0x1b30], 0
mov dword [ebp - 0x1b2c], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x64
lea ecx, [ebp - 0x1b28]
push 0x3a
xorps xmm0, xmm0
mov dword [ebp - 0x1b18], 0
push str.____Found_ImportCode_string:_Convert.FromBase32String__.
movups xmmword [ebp - 0x1b28], xmm0
mov dword [ebp - 0x1b14], 0
call fcn.004063e0
mov byte [ebp - 4], 0x65
lea ecx, [ebp - 0x1b10]
push 0x16
xorps xmm0, xmm0
mov dword [ebp - 0x1b00], 0
push str.ConvertTo_Base64String
movups xmmword [ebp - 0x1b10], xmm0
mov dword [ebp - 0x1afc], 0
call fcn.004063e0
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x1af8]
push 0x36
xorps xmm0, xmm0
mov dword [ebp - 0x1ae8], 0
push str.____Found_ImportCode_string:_ConvertTo_Base64String.
movups xmmword [ebp - 0x1af8], xmm0
mov dword [ebp - 0x1ae4], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x67
lea ecx, [ebp - 0x1ae0]
push 0x16
xorps xmm0, xmm0
mov dword [ebp - 0x1ad0], 0
push str.ConvertTo_Base32String
movups xmmword [ebp - 0x1ae0], xmm0
mov dword [ebp - 0x1acc], 0
call fcn.004063e0
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x1ac8]
push 0x36
xorps xmm0, xmm0
mov dword [ebp - 0x1ab8], 0
push str.____Found_ImportCode_string:_ConvertTo_Base32String.
movups xmmword [ebp - 0x1ac8], xmm0
mov dword [ebp - 0x1ab4], 0
call fcn.004063e0
mov byte [ebp - 4], 0x69
lea ecx, [ebp - 0x1ab0]
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x1aa0], 0
push str.ConvertFrom_Base32String
movups xmmword [ebp - 0x1ab0], xmm0
mov dword [ebp - 0x1a9c], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x6a
lea ecx, [ebp - 0x1a98]
push 0x38
xorps xmm0, xmm0
mov dword [ebp - 0x1a88], 0
push str.____Found_ImportCode_string:_ConvertFrom_Base32String.
movups xmmword [ebp - 0x1a98], xmm0
mov dword [ebp - 0x1a84], 0
call fcn.004063e0
mov byte [ebp - 4], 0x6b
xorps xmm0, xmm0
movups xmmword [ebp - 0x1a80], xmm0
mov dword [ebp - 0x1a70], 0
push 0x18
push str.ConvertFrom_Base64String
lea ecx, [ebp - 0x1a80]
mov dword [ebp - 0x1a6c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x6c
lea ecx, [ebp - 0x1a68]
push 0x38
xorps xmm0, xmm0
mov dword [ebp - 0x1a58], 0
push str.____Found_ImportCode_string:_ConvertFrom_Base64String.
movups xmmword [ebp - 0x1a68], xmm0
mov dword [ebp - 0x1a54], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x6d
lea ecx, [ebp - 0x1a50]
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x1a40], 0
push str.base64decode
movups xmmword [ebp - 0x1a50], xmm0
mov dword [ebp - 0x1a3c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x6e
lea ecx, [ebp - 0x1a38]
push 0x2c
xorps xmm0, xmm0
mov dword [ebp - 0x1a28], 0
push str.____Found_ImportCode_string:_base64decode.
movups xmmword [ebp - 0x1a38], xmm0
mov dword [ebp - 0x1a24], 0
call fcn.004063e0
mov byte [ebp - 4], 0x6f
lea ecx, [ebp - 0x1a20]
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x1a10], 0
push str.base64encode
movups xmmword [ebp - 0x1a20], xmm0
mov dword [ebp - 0x1a0c], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x70
lea ecx, [ebp - 0x1a08]
push 0x2c
xorps xmm0, xmm0
mov dword [ebp - 0x19f8], 0
push str.____Found_ImportCode_string:_base64encode.
movups xmmword [ebp - 0x1a08], xmm0
mov dword [ebp - 0x19f4], 0
call fcn.004063e0
mov byte [ebp - 4], 0x71
lea ecx, [ebp - 0x19f0]
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x19e0], 0
push str.base32decode
movups xmmword [ebp - 0x19f0], xmm0
mov dword [ebp - 0x19dc], 0
call fcn.004063e0
mov byte [ebp - 4], 0x72
lea ecx, [ebp - 0x19d8]
push 0x2c
xorps xmm0, xmm0
mov dword [ebp - 0x19c8], 0
push str.____Found_ImportCode_string:_base32decode.
movups xmmword [ebp - 0x19d8], xmm0
mov dword [ebp - 0x19c4], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x73
xorps xmm0, xmm0
movups xmmword [ebp - 0x19c0], xmm0
mov dword [ebp - 0x19b0], 0
mov dword [ebp - 0x19ac], 0
push 0xc
push str.base32encode
lea ecx, [ebp - 0x19c0]
call fcn.004063e0
mov byte [ebp - 4], 0x74
lea ecx, [ebp - 0x19a8]
push 0x2c
xorps xmm0, xmm0
mov dword [ebp - 0x1998], 0
push str.____Found_ImportCode_string:_base32encode.
movups xmmword [ebp - 0x19a8], xmm0
mov dword [ebp - 0x1994], 0
call fcn.004063e0
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x1990]
push 0x33
xorps xmm0, xmm0
mov dword [ebp - 0x1980], 0
push str.org.apache.commons.codec.binary.Base64.decodeBase64
movups xmmword [ebp - 0x1990], xmm0
mov dword [ebp - 0x197c], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x76
lea ecx, [ebp - 0x1978]
push 0x53
xorps xmm0, xmm0
mov dword [ebp - 0x1968], 0
push str.____Found_ImportCode_string:_org.apache.commons.codec.binary.Base64.decodeBase64.
movups xmmword [ebp - 0x1978], xmm0
mov dword [ebp - 0x1964], 0
call fcn.004063e0
mov byte [ebp - 4], 0x77
lea ecx, [ebp - 0x1960]
push 0x33
xorps xmm0, xmm0
mov dword [ebp - 0x1950], 0
push str.org.apache.commons.codec.binary.Base32.decodeBase32
movups xmmword [ebp - 0x1960], xmm0
mov dword [ebp - 0x194c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x78
lea ecx, [ebp - 0x1948]
push 0x53
xorps xmm0, xmm0
mov dword [ebp - 0x1938], 0
push str.____Found_ImportCode_string:_org.apache.commons.codec.binary.Base32.decodeBase32.
movups xmmword [ebp - 0x1948], xmm0
mov dword [ebp - 0x1934], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x79
lea ecx, [ebp - 0x1930]
push 0x33
xorps xmm0, xmm0
mov dword [ebp - 0x1920], 0
push str.org.apache.commons.codec.binary.Base32.encodeBase32
movups xmmword [ebp - 0x1930], xmm0
mov dword [ebp - 0x191c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x1918]
push 0x53
xorps xmm0, xmm0
mov dword [ebp - 0x1908], 0
push str.____Found_ImportCode_string:_org.apache.commons.codec.binary.Base32.encodeBase32.
movups xmmword [ebp - 0x1918], xmm0
mov dword [ebp - 0x1904], 0
call fcn.004063e0
mov byte [ebp - 4], 0x7b
xorps xmm0, xmm0
movups xmmword [ebp - 0x1900], xmm0
mov dword [ebp - 0x18f0], 0
mov dword [ebp - 0x18ec], 0
push 0x33
push str.org.apache.commons.codec.binary.Base64.encodeBase64
lea ecx, [ebp - 0x1900]
call fcn.004063e0
mov byte ds:[ebp - 4], 0x7c
lea ecx, [ebp - 0x18e8]
push 0x53
xorps xmm0, xmm0
mov dword [ebp - 0x18d8], 0
push str.____Found_ImportCode_string:_org.apache.commons.codec.binary.Base64.encodeBase64.
movups xmmword [ebp - 0x18e8], xmm0
mov dword [ebp - 0x18d4], 0
call fcn.004063e0
mov byte [ebp - 4], 0x7d
lea ecx, [ebp - 0x18d0]
push 0x10
xorps xmm0, xmm0
mov dword [ebp - 0x18c0], 0
push str.base64Url.decode
movups xmmword [ebp - 0x18d0], xmm0
mov dword [ebp - 0x18bc], 0
call fcn.004063e0
mov byte [ebp - 4], 0x7e
lea ecx, [ebp - 0x18b8]
push 0x30
xorps xmm0, xmm0
mov dword [ebp - 0x18a8], 0
push str.____Found_ImportCode_string:_base64Url.decode.
movups xmmword [ebp - 0x18b8], xmm0
mov dword [ebp - 0x18a4], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x7f
lea ecx, [ebp - 0x18a0]
push 0x10
xorps xmm0, xmm0
mov dword [ebp - 0x1890], 0
push str.base64Url.encode
movups xmmword [ebp - 0x18a0], xmm0
mov dword [ebp - 0x188c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x80
lea ecx, [ebp - 0x1888]
push 0x30
xorps xmm0, xmm0
mov dword [ebp - 0x1878], 0
push str.____Found_ImportCode_string:_base64Url.encode.
movups xmmword [ebp - 0x1888], xmm0
mov dword [ebp - 0x1874], 0
call fcn.004063e0
push str.____Found_ImportCode_string:_base32Url.decode.
push str.base32Url.decode
lea ecx, [ebp - 0x1870]
mov byte [ebp - 4], 0x81
call fcn.004156b0
mov byte [ebp - 4], 0x82
lea ecx, [ebp - 0x1840]
push 0x10
xorps xmm0, xmm0
mov dword [ebp - 0x1830], 0
push str.base32Url.encode
movups xmmword [ebp - 0x1840], xmm0
mov dword [ebp - 0x182c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x83
lea ecx, [ebp - 0x1828]
push 0x30
xorps xmm0, xmm0
mov dword [ebp - 0x1818], 0
push str.____Found_ImportCode_string:_base32Url.encode.
movups xmmword [ebp - 0x1828], xmm0
mov dword [ebp - 0x1814], 0
call fcn.004063e0
mov byte [ebp - 4], 0x84
push 0x46
xorps xmm0, xmm0
mov dword [ebp - 0x1800], 0
push str.System.Text.Encoding.Default.GetString_System.Convert.FromBase64String
lea ecx, [ebp - 0x1810]
mov dword [ebp - 0x17fc], 0
movups xmmword [ebp - 0x1810], xmm0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x85
lea ecx, [ebp - 0x17f8]
push 0x66
xorps xmm0, xmm0
mov dword [ebp - 0x17e8], 0
push str.____Found_ImportCode_string:_System.Text.Encoding.Default.GetString_System.Convert.FromBase64String.
movups xmmword [ebp - 0x17f8], xmm0
mov dword [ebp - 0x17e4], 0
call fcn.004063e0
mov byte [ebp - 4], 0x86
lea ecx, [ebp - 0x17e0]
push 0x44
xorps xmm0, xmm0
mov dword [ebp - 0x17d0], 0
push str.System.Text.Encoding.Default.GetString_System.Convert.ToBase64String
movups xmmword [ebp - 0x17e0], xmm0
mov dword [ebp - 0x17cc], 0
call fcn.004063e0
mov byte [ebp - 4], 0x87
lea ecx, [ebp - 0x17c8]
push 0x64
xorps xmm0, xmm0
mov dword [ebp - 0x17b8], 0
push str.____Found_ImportCode_string:_System.Text.Encoding.Default.GetString_System.Convert.ToBase64String.
movups xmmword [ebp - 0x17c8], xmm0
mov dword [ebp - 0x17b4], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x88
lea ecx, [ebp - 0x17b0]
push 0x46
xorps xmm0, xmm0
mov dword [ebp - 0x17a0], 0
push str.System.Text.Encoding.Default.GetString_System.Convert.FromBase32String
movups xmmword [ebp - 0x17b0], xmm0
mov dword [ebp - 0x179c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x89
lea ecx, [ebp - 0x1798]
push 0x66
xorps xmm0, xmm0
mov dword [ebp - 0x1788], 0
push str.____Found_ImportCode_string:_System.Text.Encoding.Default.GetString_System.Convert.FromBase32String.
movups xmmword [ebp - 0x1798], xmm0
mov dword [ebp - 0x1784], 0
call fcn.004063e0
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0x1780]
push 0x44
xorps xmm0, xmm0
mov dword [ebp - 0x1770], 0
push str.System.Text.Encoding.Default.GetString_System.Convert.ToBase32String
movups xmmword [ebp - 0x1780], xmm0
mov dword [ebp - 0x176c], 0
call fcn.004063e0
mov byte ds:[ebp - 4], 0x8b
lea ecx, [ebp - 0x1768]
push 0x64
xorps xmm0, xmm0
mov dword [ebp - 0x1758], 0
push str.____Found_ImportCode_string:_System.Text.Encoding.Default.GetString_System.Convert.ToBase32String.
movups xmmword [ebp - 0x1768], xmm0
mov dword [ebp - 0x1754], 0
call fcn.004063e0
mov byte [ebp - 4], 0x8c
xorps xmm0, xmm0
push 0x12
push str.base64url:decode_1
lea ecx, [ebp - 0x1750]
mov dword [ebp - 0x1740], 0
movups xmmword [ebp - 0x1750], xmm0
mov dword [ebp - 0x173c], 0
call fcn.004063e0
mov byte [ebp - 4], 0x8d
lea ecx, [ebp - 0x1738]
push 0x32
xorps xmm0, xmm0
mov dword [ebp - 0x1728], 0
push str.____Found_ImportCode_string:_base64url:decode_1.
movups xmmword [ebp - 0x1738], xmm0
mov dword [ebp - 0x1724], 0
call fcn.004063e0
push str.____Found_ImportCode_string:_base32url:decode_1.
push str.base32url:decode_1
lea ecx, [ebp - 0x1720]
mov byte [ebp - 4], 0x8e
call fcn.004156b0
push str.____Found_ImportCode_string:_base32url:encode_1.
push str.base32url:encode_1
lea ecx, [ebp - 0x16f0]
mov byte [ebp - 4], 0x8f
call fcn.004156b0
push str.____Found_ImportCode_string:_base64url:encode_1.
push str.base64url:encode_1
lea ecx, [ebp - 0x16c0]
mov byte [ebp - 4], 0x90
call fcn.004156b0
push str.____Found_ImportCode_string:_base64dec_2.
push str.base64dec_2
lea ecx, [ebp - 0x1690]
mov byte [ebp - 4], 0x91
call fcn.004156b0
push str.____Found_ImportCode_string:_base32dec_2.
push str.base32dec_2
lea ecx, [ebp - 0x1660]
mov byte [ebp - 4], 0x92
call fcn.004156b0
push str.____Found_ImportCode_string:_jsonlite::base64_decode.
push str.jsonlite::base64_decode
lea ecx, ds:[ebp - 0x1630]
mov byte [ebp - 4], 0x93
call fcn.004156b0
push str.____Found_ImportCode_string:_jsonlite::base32_decode.
push str.jsonlite::base32_decode
lea ecx, [ebp - 0x1600]
mov byte [ebp - 4], 0x94
call fcn.004156b0
push str.____Found_ImportCode_string:_jsonlite::base64_encode.
push str.jsonlite::base64_encode
lea ecx, [ebp - 0x15d0]
mov byte [ebp - 4], 0x95
call fcn.004156b0
push str.____Found_ImportCode_string:_jsonlite::base32_encode.
push str.jsonlite::base32_encode
lea ecx, [ebp - 0x15a0]
mov byte [ebp - 4], 0x96
call fcn.004156b0
push str.____Found_ImportCode_string:_Base64.decode_bytes.
push str.Base64.decode_bytes
lea ecx, [ebp - 0x1570]
mov byte [ebp - 4], 0x97
call fcn.004156b0
push str.____Found_ImportCode_string:_Base32.decode_bytes.
mov byte ds:[ebp - 4], 0x98
push str.Base32.decode_bytes
lea ecx, [ebp - 0x1540]
call fcn.004156b0
push str.____Found_ImportCode_string:_Base32.encode_bytes.
push str.Base32.encode_bytes
lea ecx, [ebp - 0x1510]
mov byte [ebp - 4], 0x99
call fcn.004156b0
push str.____Found_ImportCode_string:_Base32.decode_bytes.
push str.Base32.decode_bytes
lea ecx, [ebp - 0x14e0]
mov byte [ebp - 4], 0x9a
call fcn.004156b0
push str.____Found_ImportCode_string:_Ada.Strings.Base64.Decoder.Decode.
push str.Ada.Strings.Base64.Decoder.Decode
lea ecx, [ebp - 0x14b0]
mov byte [ebp - 4], 0x9b
call fcn.004156b0
push str.____Found_ImportCode_string:_Ada.Strings.Base64.Encoder.Encode.
push str.Ada.Strings.Base64.Encoder.Encode
lea ecx, [ebp - 0x1480]
mov byte [ebp - 4], 0x9c
call fcn.004156b0
push str.____Found_ImportCode_string:_Ada.Strings.Base32.Decoder.Decode.
push str.Ada.Strings.Base32.Decoder.Decode
lea ecx, ds:[ebp - 0x1450]
mov byte [ebp - 4], 0x9d
call fcn.004156b0
push str.____Found_ImportCode_string:_Ada.Strings.Base32.Encoder.Encode.
push str.Ada.Strings.Base32.Encoder.Encode
lea ecx, [ebp - 0x1420]
mov byte [ebp - 4], 0x9e
call fcn.004156b0
push str.____Found_ImportCode_string:_decode64_char.
push str.decode64_char
lea ecx, [ebp - 0x13f0]
mov byte [ebp - 4], 0x9f
call fcn.004156b0
push str.____Found_ImportCode_string:_encode64_char.
push str.encode64_char
lea ecx, [ebp - 0x13c0]
mov byte [ebp - 4], 0xa0
call fcn.004156b0
push str.____Found_ImportCode_string:_decode32_char.
push str.decode32_char
lea ecx, [ebp - 0x1390]
mov byte [ebp - 4], 0xa1
call fcn.004156b0
push str.____Found_ImportCode_string:_encode32_char.
push str.encode32_char
lea ecx, ds:[ebp - 0x1360]
mov byte [ebp - 4], 0xa2
call fcn.004156b0
push str.____Found_ImportCode_string:_Base64.decode_string.
push str.Base64.decode_string
lea ecx, [ebp - 0x1330]
mov byte [ebp - 4], 0xa3
call fcn.004156b0
push str.____Found_ImportCode_string:_Base32.decode_string.
push str.Base32.decode_string
lea ecx, [ebp - 0x1300]
mov byte [ebp - 4], 0xa4
call fcn.004156b0
push str.____Found_ImportCode_string:_Base32.encode_string.
push str.Base32.encode_string
lea ecx, [ebp - 0x12d0]
mov byte [ebp - 4], 0xa5
call fcn.004156b0
push str.____Found_ImportCode_string:_Base64.encode_string.
push str.Base64.encode_string
lea ecx, [ebp - 0x12a0]
mov byte [ebp - 4], 0xa6
call fcn.004156b0
push str.____Found_ImportCode_string:_base64_decode.
push str.base64_decode
lea ecx, ds:[ebp - 0x1270]
mov byte [ebp - 4], 0xa7
call fcn.004156b0
push str.____Found_ImportCode_string:_base64_encode.
push str.base64_encode
lea ecx, [ebp - 0x1240]
mov byte [ebp - 4], 0xa8
call fcn.004156b0
push str.____Found_ImportCode_string:_base32_decode.
push str.base32_decode
lea ecx, [ebp - 0x1210]
mov byte [ebp - 4], 0xa9
call fcn.004156b0
push str.____Found_ImportCode_string:_base32_encode.
push str.base32_encode
lea ecx, [ebp - 0x11e0]
mov byte [ebp - 4], 0xaa
call fcn.004156b0
push str.____Found_ImportCode_string:_import_base64.
push str.import_base64
lea ecx, [ebp - 0x11b0]
mov byte [ebp - 4], 0xab
call fcn.004156b0
push str.____Found_ImportCode_string:_base64.b32encode.
push str.base64.b32encode
lea ecx, ds:[ebp - 0x1180]
mov byte [ebp - 4], 0xac
call fcn.004156b0
push str.____Found_ImportCode_string:_base64.b32decode.
push str.base64.b32decode
lea ecx, [ebp - 0x1150]
mov byte [ebp - 4], 0xad
call fcn.004156b0
sub esp, 8
mov byte [ebp - 4], 0xae
lea ecx, [ebp - 0x1120]
call fcn.00415780
sub esp, 8
mov byte [ebp - 4], 0xaf
lea ecx, [ebp - 0x10f0]
call fcn.00415820
lea ecx, [ebp - 0x2740]
mov dword [ebp - 4], 0xb0
push ecx
lea eax, [ebp - 0x10c0]
push eax
push ecx
lea ecx, [ebp - 0x27b8]
call fcn.004154c0
push fcn.00415400
push 0x78
push 0x30
lea eax, [ebp - 0x2740]
mov byte [ebp - 4], 0xb2
push eax
call fcn.00444e54
mov edx, esi
lea ecx, [ebp - 0x2758]
call fcn.00412ce0
mov byte ds:[ebp - 4], 0xb3
push eax
mov edx, str.memory_scanner.exe__p
lea ecx, [ebp - 0x1090]
call fcn.004158b0
add esp, 4
lea ecx, [ebp - 0x2758]
mov byte [ebp - 4], 0xb5
call fcn.004044a0
push 0
lea eax, [ebp - 0x27ac]
mov dword [ebp - 0x27ac], 0xc
push eax
lea eax, [ebp - 0x2774]
mov dword [ebp - 0x27a4], 1
push eax
lea eax, [ebp - 0x2764]
mov dword [ebp - 0x27a8], 0
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0
push 1
push dword [ebp - 0x2764]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0x40
lea eax, [ebp - 0x280c]
mov dword [ebp - 0x2810], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x2774]
lea ecx, [ebp - 0x1090]
or dword [ebp - 0x27e4], 0x101
add esp, 0xc
mov dword [ebp - 0x27d4], eax
xor eax, eax
mov word [ebp - 0x27e0], ax
lea eax, [ebp - 0x27c8]
push eax
lea eax, [ebp - 0x2810]
push eax
push 0
push 0
push 0x10
push 1
push 0
push 0
call fcn.004057d0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x415346
push dword [ebp - 0x2774]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1000
lea eax, [ebp - 0x1018]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x278c]
push 0
push eax
push 0x1000
lea eax, [ebp - 0x1018]
push eax
push dword [ebp - 0x2764]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41531d
nop
mov ecx, dword [ebp - 0x278c]
test ecx, ecx
je 0x41531d
shr ecx, 1
lea eax, [ebp - 0x1018]
add eax, ecx
mov dword [ebp - 0x1050], 0
lea edx, [ebp - 0x1018]
mov dword [ebp - 0x104c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1060], xmm0
cmp edx, eax
jne 0x414db8
xor eax, eax
mov ecx, 7
mov dword [ebp - 0x277c], eax
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x276c], ecx
mov dword [ebp - 0x104c], ecx
mov word [ebp - 0x1060], ax
jmp 0x414de4
push ecx
push ecx
lea eax, [ebp - 0x1018]
push eax
lea ecx, [ebp - 0x1060]
call fcn.00412240
mov eax, dword [ebp - 0x104c]
mov dword [ebp - 0x276c], eax
mov eax, dword [ebp - 0x1050]
mov dword [ebp - 0x277c], eax
mov byte [ebp - 4], 0xb6
mov eax, dword [ebp - 0x27b4]
mov esi, dword [ebp - 0x27b8]
mov ecx, dword [ebp - 0x1060]
mov dword [ebp - 0x2770], eax
mov dword [ebp - 0x2788], ecx
cmp esi, eax
je 0x4152b2
add esi, 0x18
mov dword [ebp - 0x2784], esi
nop word [eax + eax]
cmp dword [esi - 4], 7
lea edx, [esi - 0x18]
mov eax, dword [esi - 8]
jbe 0x414e35
mov ecx, dword [edx]
mov edx, ecx
lea eax, [ecx + eax*2]
jmp 0x414e38
lea eax, [edx + eax*2]
mov dword [ebp - 0x1038], 0
xorps xmm0, xmm0
mov dword [ebp - 0x1034], 0
movups xmmword [ebp - 0x1048], xmm0
cmp edx, eax
jne 0x414e7e
mov eax, 7
xor edi, edi
mov dword [ebp - 0x2768], eax
mov dword [ebp - 0x1034], eax
xor eax, eax
mov dword [ebp - 0x1038], edi
mov word [ebp - 0x1048], ax
jmp 0x414ea1
sub eax, edx
lea ecx, [ebp - 0x1048]
sar eax, 1
push eax
push edx
call fcn.004063e0
mov eax, dword [ebp - 0x1034]
mov edi, dword [ebp - 0x1038]
mov dword [ebp - 0x2768], eax
mov dword [ebp - 0x2780], edi
mov edx, dword [ebp - 0x2790]
lea ecx, [ebp - 0x10a8]
mov byte [ebp - 4], 0xb7
call fcn.00412ce0
mov dword [ebp - 0x275c], eax
mov byte [ebp - 4], 0xb8
mov ecx, SysReAllocString
mov edx, dword [esi + 0x10]
sub ecx, edx
cmp ecx, 0x16
jb 0x4153db
lfence
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x414ee6
mov eax, dword [esi]
push 0x16
push str._on_process_with_pid:
push edx
push eax
push ecx
push dword [ebp - 0x2770]
lea ecx, [ebp - 0x10c0]
call fcn.00408c60
mov esi, dword [ebp - 0x2778]
or esi, 1
push dword [ebp - 0x275c]
lea eax, [ebp - 0x10c0]
mov byte [ebp - 4], 0xb9
push eax
push dword [ebp - 0x2770]
lea ecx, [ebp - 0x1078]
call fcn.00410440
or esi, 2
mov dword [ebp - 0x2778], esi
push str.._This_is_bannable_
lea edx, [ebp - 0x1078]
mov byte [ebp - 4], 0xba
lea ecx, [ebp - 0x1030]
call fcn.00408260
add esp, 4
mov byte [ebp - 4], 0xbc
mov ecx, dword [ebp - 0x1064]
cmp ecx, 7
jbe 0x414f9a
mov edx, dword [ebp - 0x1078]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x414f90
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415385
push ecx
push edx
call fcn.00444ae8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1068], 0
mov dword [ebp - 0x1064], 7
mov word [ebp - 0x1078], ax
mov byte [ebp - 4], 0xbd
mov ecx, dword [ebp - 0x10ac]
cmp ecx, 7
jbe 0x414ffb
mov edx, dword [ebp - 0x10c0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x414ff1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415385
push ecx
push edx
call fcn.00444ae8
add esp, 8
mov byte [ebp - 4], 0xbe
mov ecx, dword [ebp - 0x1094]
cmp ecx, 7
jbe 0x415048
mov edx, dword ds:[ebp - 0x10a8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41503c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415385
push ecx
push edx
call fcn.00444ae8
add esp, 8
push dword [ebp - 0x1020]
xor eax, eax
mov dword [ebp - 0x1098], 0
cmp dword [ebp - 0x101c], 7
mov word [ebp - 0x10a8], ax
lea eax, [ebp - 0x1030]
cmova eax, dword [ebp - 0x1030]
push eax
mov dword [ebp - 0x1094], 7
call fcn.00404f40
add esp, 8
test al, al
mov eax, dword [ebp - 0x1048]
mov dword [ebp - 0x275c], eax
jne 0x4151d5
cmp dword [ebp - 0x2768], 7
lea ecx, [ebp - 0x1048]
mov edx, dword [ebp - 0x277c]
cmova ecx, eax
cmp dword [ebp - 0x276c], 7
lea eax, [ebp - 0x1060]
mov dword [ebp - 0x2760], ecx
cmova eax, dword [ebp - 0x2788]
mov dword [ebp - 0x27a0], eax
cmp edi, edx
ja 0x4151d5
sub edx, edi
test edi, edi
je 0x415195
movzx esi, word [ecx]
inc edx
mov dword [ebp - 0x2798], esi
lea edx, [eax + edx*2]
mov dword [ebp - 0x279c], edx
nop dword [eax + eax]
sub edx, eax
mov edi, 0
sar edx, 1
je 0x41512d
movzx ecx, word [eax]
cmp cx, si
je 0x415125
cmp edx, 1
je 0x415127
movzx ecx, word [eax + 2]
add eax, 2
dec edx
cmp cx, si
jne 0x415113
mov edi, eax
mov ecx, dword [ebp - 0x2760]
mov eax, edi
test eax, eax
je 0x4151d5
mov edi, dword ds:[ebp - 0x2780]
mov esi, ecx
test edi, edi
je 0x415188
mov ecx, eax
sub ecx, dword [ebp - 0x2760]
mov dword [ebp - 0x2794], ecx
movzx edx, word [ecx + esi]
movzx ecx, word [esi]
cmp dx, cx
jne 0x41516e
add esi, 2
sub edi, 1
je 0x415188
mov ecx, dword [ebp - 0x2794]
jmp 0x415152
mov esi, dword [ebp - 0x2798]
add eax, 2
mov ecx, dword [ebp - 0x2760]
mov edx, dword [ebp - 0x279c]
jmp 0x415100
sub eax, dword [ebp - 0x27a0]
sar eax, 1
cmp eax, 0xffffffff
je 0x4151d5
cmp dword [ebp - 0x101c], 7
lea edx, [ebp - 0x1030]
push dword [ebp - 0x1020]
cmova edx, dword [ebp - 0x1030]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.00408f60
add esp, 4
mov ecx, eax
push 0x408660
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
lea ecx, [ebp - 0x1030]
call fcn.00404f20
mov byte ds:[ebp - 4], 0xb7
mov ecx, dword [ebp - 0x101c]
cmp ecx, 7
jbe 0x41521a
mov edx, dword [ebp - 0x1030]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x415210
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415385
push ecx
push edx
call fcn.00444ae8
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0xb6
mov word [ebp - 0x1030], ax
mov eax, dword [ebp - 0x2768]
mov dword [ebp - 0x1020], 0
mov dword [ebp - 0x101c], 7
cmp eax, 7
jbe 0x415288
lea ecx, [eax*2 + 2]
mov eax, dword [ebp - 0x275c]
mov edx, eax
cmp ecx, 0x1000
jb 0x41527d
mov eax, dword [edx - 4]
add ecx, 0x23
sub edx, eax
mov dword [ebp - 0x275c], eax
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x415385
mov eax, dword [ebp - 0x275c]
push ecx
push eax
call fcn.00444ae8
add esp, 8
mov esi, dword ds:[ebp - 0x2784]
add esi, 0x30
mov dword [ebp - 0x2784], esi
lea eax, [esi - 0x18]
cmp eax, dword [ebp - 0x2770]
jne 0x414e20
mov ecx, dword [ebp - 0x2788]
mov byte ds:[ebp - 4], 0xb5
mov eax, dword [ebp - 0x276c]
cmp eax, 7
jbe 0x4152f4
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4152ea
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x415385
push edx
push ecx
call fcn.00444ae8
add esp, 8
push 0
lea eax, [ebp - 0x278c]
push eax
push 0x1000
lea eax, [ebp - 0x1018]
push eax
push dword [ebp - 0x2764]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x414d50
push 0xffffffffffffffff
push dword [ebp - 0x27c8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x27c8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword ds:[ebp - 0x27c4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x2764]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x107c]
cmp ecx, 7
jbe 0x415395
mov edx, dword [ebp - 0x1090]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41538b
mov edx, dword ds:[eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41538b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00444ae8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1080], 0
lea ecx, [ebp - 0x27b8]
mov dword [ebp - 0x107c], 7
mov word [ebp - 0x1090], ax
call fcn.00415620
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00444aa0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
nop dword [eax + eax]
call fcn.00403ca0
int3