Function at 0x14005a947
Capabilities:
Encode data using base64
Get proxy

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm7
movaps xmmword [rsp + 0x2c0], xmm6
mov rcx, qword [rcx]
mov rax, qword [rcx]
and qword [rcx], 0
test rax, rax
je 0x14005b740
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
lea rdx, [0x1400abb70]
lea rsi, [rsp + 0xb0]
mov r8d, 0x3b
mov rcx, rsi
call fcn.14005c8e2
lea rax, [rsp + 0x1c0]
and qword [rax], 0
mov rsi, qword [rsi]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov rdx, rsi
xor r8d, r8d
mov r9d, 0x20019
call sub.advapi32.dll_RegOpenKeyExW
mov edi, eax
test eax, eax
jne 0x14005a9de
mov rbx, qword [rsp + 0x1c0]
jmp 0x14005a9e9
mov rbx, rdi
shl rbx, 0x20
or rbx, 2
mov rdx, qword [rsp + 0xb8]
mov rcx, rsi
call fcn.140060147
test edi, edi
je 0x14005aa0d
mov rcx, rbx
call fcn.140021116
mov rsi, rax
jmp 0x14005b02d
lea r8, [0x1400abbab]
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov rdx, rbx
call fcn.14005c7ba
mov sil, byte [rsi + 0x18]
cmp sil, 0xc
jne 0x14005aa3e
mov r15, qword [rsp + 0xb0]
jmp 0x14005b01a
cmp sil, 4
jne 0x14005aa4e
mov rax, qword [rsp + 0xb0]
mov edi, dword [rax]
lea rcx, [rsp + 0xb0]
call fcn.14005c8c9
movabs r15, 0xde00000002
cmp sil, 4
jne 0x14005b01a
lea r8, [0x1400abbb6]
lea rsi, [rsp + 0x1c0]
mov rcx, rsi
mov rdx, rbx
call fcn.14005c7ba
movzx r14d, byte [rsi + 0x18]
cmp r14, 0xc
jne 0x14005aaa1
mov r15, qword [rsp + 0x1c0]
jmp 0x14005b01a
xor esi, esi
cmp r14, 7
ja 0x14005aff2
mov eax, 0x86
bt rax, r14
jae 0x14005aff2
mov dword [rsp + 0x4c], edi
mov r15, qword [rsp + 0x1c0]
mov rax, qword [rsp + 0x1d0]
mov r12, rax
and r12, 0xfffffffffffffffe
add r12, r15
xorps xmm0, xmm0
lea rsi, [rsp + 0x240]
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 1
mov rdx, rax
shr rdx, 2
bt eax, 1
adc rdx, 0
mov rcx, rsi
call fcn.140003b46
lea rdi, [rsp + 0xb0]
mov qword [rdi], r15
mov qword [rdi + 8], r12
and word [rdi + 0x10], 0
mov ebp, 0xfffd
mov rcx, rdi
call fcn.140003d4d
movzx ecx, ax
cmp rcx, 2
je 0x14005ab47
shr rax, 0x20
test rcx, rcx
cmovne eax, ebp
mov rcx, rsi
mov edx, eax
call fcn.140003a15
jmp 0x14005ab20
mov rsi, qword [rsp + 0x240]
mov r12, qword [rsp + 0x248]
mov rbp, qword [rsp + 0x250]
mov edi, dword [rsp + 0x4c]
mov r15, rbp
mov rcx, rsi
mov rdx, r15
xor r8d, r8d
call fcn.140006381
test al, al
je 0x14005ac27
test r15, r15
je 0x14005abee
movzx edx, byte [rsi + r15 - 1]
mov rcx, 0xffffffffffffffff
test dl, dl
jns 0x14005ac1c
movzx r8d, byte [rsi + r15 - 2]
cmp r8b, 0xbf
jg 0x14005abc5
movzx r9d, byte [rsi + r15 - 3]
cmp r9b, 0xc0
jge 0x14005abcb
movzx r10d, byte [rsi + r15 - 4]
and r10d, 7
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
jmp 0x14005abcf
and r8d, 0x1f
jmp 0x14005abda
and r9d, 0xf
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
shl r8d, 6
and edx, 0x3f
or edx, r8d
cmp edx, 0x110000
je 0x14005ab74
jmp 0x14005abf6
xor r15d, r15d
jmp 0x14005ab66
cmp edx, 0x80
jb 0x14005ac1c
mov rcx, 0xfffffffffffffffe
cmp edx, 0x800
jb 0x14005ac1c
xor ecx, ecx
cmp edx, 0x10000
setb cl
or rcx, 0xfffffffffffffffc
add rcx, r15
mov rbp, rcx
jmp 0x14005ab63
cmp r14d, 7
jne 0x14005afa0
mov qword [rsp + 0x130], r12
xorps xmm0, xmm0
lea rcx, [rsp + 0x240]
movups xmmword [rcx + 8], xmm0
mov eax, 1
mov qword [rcx], rax
mov qword [rsp + 0x20], rax
lea r9, [0x1400cfbcb]
lea r12, [rsp + 0xb0]
mov rcx, r12
mov rdx, rsi
mov qword [rsp + 0x138], rbp
mov r8, rbp
call fcn.1400082a8
mov rax, qword [r12]
mov qword [rsp + 0x160], rax
mov rdi, qword [r12 + 8]
mov rax, qword [r12 + 0x18]
mov rcx, qword [r12 + 0x20]
mov qword [rsp + 0x168], rcx
mov r15, qword [r12 + 0x28]
mov r9, qword [r12 + 0x38]
mov r14, qword [r12 + 0x48]
mov r13, qword [r12 + 0x50]
mov rbp, qword [r12 + 0x58]
mov r12, qword [r12 + 0x60]
lea rcx, [r12 - 1]
mov qword [rsp + 0x170], rcx
mov rcx, rax
and rcx, 0xffffffffffffff00
mov qword [rsp + 0x150], rcx
mov qword [rsp + 0x140], rax
mov r10d, eax
xor edx, edx
cmp qword [rsp + 0x160], 0
mov qword [rsp + 0x38], r9
je 0x14005ae8d
mov qword [rsp + 0xa0], rdx
mov byte [rsp + 0x37], r10b
movzx eax, r10b
or rax, qword [rsp + 0x150]
mov rcx, r12
mov qword [rsp + 0x158], rax
sub rcx, rax
mov qword [rsp + 0x148], rcx
lea rax, [rdi - 1]
mov qword [rsp + 0x40], rax
mov rax, r9
cmp rdi, rax
mov rcx, rax
cmova rcx, rdi
cmp r9, 0xffffffffffffffff
cmove rcx, rdi
mov r11d, 0
cmovne r11, rax
mov rdx, qword [rsp + 0x170]
add rdx, r15
cmp rdx, r13
jae 0x14005afa5
movzx edx, byte [r14 + rdx]
mov r8, qword [rsp + 0x168]
bt r8, rdx
jae 0x14005adb4
lea r9, [r14 + r15]
mov r10, rcx
cmp r10, r12
jae 0x14005adbf
mov rdx, r10
lea r8, [r15 + r10]
cmp r8, r13
jae 0x14005b740
lea r10, [rdx + 1]
mov r8b, byte [rbp + rdx]
cmp r8b, byte [r9 + rdx]
je 0x14005ad80
sub r15, rdi
add r15, rdx
inc r15
mov r9, qword [rsp + 0x38]
jmp 0x14005adb7
add r15, r12
cmp r9, 0xffffffffffffffff
je 0x14005ad52
jmp 0x14005ae19
mov rdx, qword [rsp + 0x40]
lea r10, [rdx + 1]
cmp r11, r10
jae 0x14005ae20
cmp rdx, r12
jae 0x14005b740
lea r10, [r15 + rdx]
cmp r10, r13
jae 0x14005b740
mov r10b, byte [rbp + rdx]
lea r8, [rdx - 1]
cmp r10b, byte [r9 + rdx]
mov rdx, r8
je 0x14005adc4
add r15, qword [rsp + 0x158]
mov r9, qword [rsp + 0x38]
cmp r9, 0xffffffffffffffff
je 0x14005ad52
mov rax, qword [rsp + 0x148]
jmp 0x14005ad36
xor eax, eax
jmp 0x14005ad36
cmp qword [rsp + 0x38], 0xffffffffffffffff
mov ecx, 0
cmovne rax, rcx
lea rcx, [r15 + r12]
mov r8, r15
mov qword [rsp + 0x40], rcx
mov r15, rcx
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0xa0]
add rdx, rsi
add r8, rsi
lea rcx, [rsp + 0x240]
call fcn.140003b03
lea rcx, [rsp + 0x240]
lea rdx, [0x1400cfbca]
lea r8, [0x1400cfbcb]
call fcn.140003b03
mov rdx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
mov r10b, byte [rsp + 0x37]
jmp 0x14005ace7
test dword [rsp + 0x140], 0xff0000
jne 0x14005afad
test rdi, rdi
je 0x14005aeba
cmp rdi, r13
jae 0x14005aeb4
cmp byte [r14 + rdi], 0xbf
jg 0x14005aeba
jmp 0x14005b740
jne 0x14005b740
cmp rdi, r13
je 0x14005af5f
movzx ecx, byte [r14 + rdi]
test cl, cl
js 0x14005aed0
mov eax, ecx
jmp 0x14005af22
mov eax, ecx
and eax, 0x1f
movzx r8d, byte [r14 + rdi + 1]
and r8d, 0x3f
cmp cl, 0xdf
jbe 0x14005af14
movzx r9d, byte [r14 + rdi + 2]
shl r8d, 6
and r9d, 0x3f
or r9d, r8d
cmp cl, 0xf0
jb 0x14005af1c
movzx ecx, byte [r14 + rdi + 3]
and eax, 7
shl eax, 0x12
shl r9d, 6
and ecx, 0x3f
or ecx, r9d
or eax, ecx
jmp 0x14005af22
shl eax, 6
or eax, r8d
jmp 0x14005af22
shl eax, 0xc
or eax, r9d
test r10b, r10b
jne 0x14005af8a
cmp eax, 0x110000
je 0x14005afad
mov ecx, 1
cmp eax, 0x80
jb 0x14005af54
mov ecx, 2
cmp eax, 0x800
jb 0x14005af54
cmp eax, 0x10000
mov ecx, 4
sbb rcx, 0
add rdi, rcx
mov r10b, 1
jmp 0x14005ae9e
test r10b, r10b
je 0x14005b744
test r14, r14
je 0x14005b744
xor r10b, 1
mov byte [rsp + 0x37], r10b
mov r8, r13
mov qword [rsp + 0x40], r13
mov rdi, r13
jmp 0x14005ae4b
xor r10b, 1
mov byte [rsp + 0x37], r10b
mov r8, rdi
mov qword [rsp + 0x40], rdi
jmp 0x14005ae4b
mov r15, r12
jmp 0x14005aff2
mov rdx, qword [rsp + 0xa0]
add rdx, rsi
mov r8, qword [rsp + 0x138]
add r8, rsi
lea r12, [rsp + 0x240]
mov rcx, r12
call fcn.140003b03
mov rdi, qword [r12]
mov r15, qword [r12 + 8]
mov rbp, qword [r12 + 0x10]
mov rcx, rsi
mov rdx, qword [rsp + 0x130]
call fcn.140003e5c
mov rsi, rdi
mov edi, dword [rsp + 0x4c]
jmp 0x14005aff2
lea rcx, [rsp + 0x1c0]
call fcn.14005c8c9
test rsi, rsi
je 0x14005b01a
mov rcx, rbx
call fcn.140072041
mov rcx, 0xffffffff80000001
call fcn.140072041
jmp 0x14005b04a
mov rcx, r15
call fcn.140021116
mov rsi, rax
mov rcx, rbx
call fcn.140072041
mov rcx, 0xffffffff80000001
call fcn.140072041
lea rdx, fcn.14001939b
mov rcx, rsi
call fcn.140023a35
xor esi, esi
call fcn.14004505b
movups xmm6, xmmword [0x1400ab2c0]
movaps xmmword [rsp + 0xb0], xmm6
movups xmm7, xmmword [0x1400ab2d0]
movaps xmmword [rsp + 0xc0], xmm7
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rdx
lea rdx, [0x1400abb62]
lea rbx, [rsp + 0x1c0]
mov r8d, 0xe
mov rcx, rbx
call fcn.14006271b
cmp byte [rbx + 0x18], 2
jne 0x14005b0fa
mov qword [rsp + 0x20], 0xa
lea rdx, [0x1400cf9ca]
lea r9, str.HTTP_PROXYhttp_proxyHTTPS_PROXYhttps_proxyREQUEST_METHODSoftwareMicrosoftWindowsCurrentVersionInternet_SettingsProxyEnableProxyServer
lea rcx, [rsp + 0xb0]
mov r8d, 4
call fcn.14005b752
test al, al
jne 0x14005b10f
mov qword [rsp + 0x20], 0xa
lea rdx, [0x1400cf9ca]
lea r9, [0x1400abb42]
lea rcx, [rsp + 0xb0]
mov r8d, 4
call fcn.14005b752
jmp 0x14005b10f
mov rcx, qword [rsp + 0x1c0]
mov rdx, qword [rsp + 0x1c8]
call fcn.140003e5c
mov qword [rsp + 0x20], 0xb
lea rdx, [0x1400cf9ce]
lea r9, [0x1400abb4c]
lea rcx, [rsp + 0xb0]
mov r8d, 5
call fcn.14005b752
test al, al
jne 0x14005b167
mov qword [rsp + 0x20], 0xb
lea rdx, [0x1400cf9ce]
lea r9, [0x1400abb57]
lea rcx, [rsp + 0xb0]
mov r8d, 5
call fcn.14005b752
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmm1, xmmword [rsp + 0xc0]
movaps xmm2, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x1b0], xmm2
movaps xmmword [rsp + 0x1a0], xmm1
movaps xmmword [rsp + 0x190], xmm0
mov r13, qword [rsp + 0x1a8]
test r13, r13
jne 0x14005b403
test rsi, rsi
je 0x14005b403
mov qword [rsp + 0x178], rsi
mov qword [rsp + 0x180], r15
mov qword [rsp + 0x188], rbp
test edi, edi
je 0x14005b445
call fcn.14004505b
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x80], xmm7
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rdx
cmp rbp, 1
jbe 0x14005b474
mov cl, 0x3d
mov rdx, rsi
mov r8, rbp
call fcn.1400173df
test rax, rax
je 0x14005b493
lea r9, [0x1400ace42]
lea rcx, [rsp + 0x240]
mov rdx, rsi
mov r8, rbp
call fcn.14005b863
lea r15, [rsp + 0x1c0]
lea r12, [rsp + 0xb0]
lea r13, [rsp + 0x58]
lea rcx, [rsp + 0x240]
call fcn.14004d700
test rax, rax
je 0x14005b602
mov r8, rdx
mov rcx, r15
mov rdx, rax
lea r9, [0x1400ace44]
call fcn.14005b863
mov rcx, r15
call fcn.14004d700
test rax, rax
je 0x14005b4d6
mov rsi, rax
mov rdi, rdx
call fcn.140069dd9
mov rbp, rax
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 4
mov qword [rsp + 0x68], 1
mov ecx, 0x10
mov rdi, r12
mov rsi, r15
rep movsq qword [rdi], qword [rsi]
mov ebx, 1
mov r14d, 0x18
mov rcx, r12
call fcn.14004d700
test rax, rax
je 0x14005b302
mov rsi, rax
mov rdi, rdx
cmp rbx, qword [rsp + 0x60]
jne 0x14005b2ea
mov rcx, r13
call fcn.140069e00
mov rbp, qword [rsp + 0x58]
mov qword [rbp + r14 - 8], rsi
mov qword [rbp + r14], rdi
inc rbx
mov qword [rsp + 0x68], rbx
add r14, 0x10
jmp 0x14005b2c3
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
cmp rbx, 2
jne 0x14005b4dd
lea rax, [rsi + 0x10]
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
call fcn.14005b7ae
test rax, rax
je 0x14005b386
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
mov r14, qword [rax + 8]
mov rcx, r14
call fcn.14003f438
mov rbx, rax
mov rdi, r15
mov r15, rdx
mov rcx, rax
mov rdx, qword [rsp + 0x38]
mov r8, r14
call fcn.140080da0
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x1c8], r15
mov r15, rdi
mov qword [rsp + 0x1d0], r14
jmp 0x14005b3df
lea rax, [0x1400abae0]
mov qword [rsp + 0xb0], rax
mov ecx, 1
mov qword [rsp + 0xb8], rcx
and qword [rsp + 0xd0], 0
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x58], rax
lea rax, [0x14005f3a1]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xc8], rcx
mov rcx, r15
mov rdx, r12
call fcn.14004262c
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0x70]
mov r9, r15
call fcn.14005b893
mov rcx, rsi
mov rdx, rbp
call fcn.14005ea0a
jmp 0x14005b242
mov rbp, qword [rsp + 0x190]
mov r14, qword [rsp + 0x198]
mov r12, qword [rsp + 0x1a0]
mov rdi, qword [rsp + 0x1b0]
mov rbx, qword [rsp + 0x1b8]
test rsi, rsi
je 0x14005b43b
mov rcx, rsi
mov rdx, r15
call fcn.140003e5c
mov rsi, qword [rsp + 0x50]
jmp 0x14005b6c9
call fcn.14004505b
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rcx, rsi
mov rdx, r15
call fcn.140003e5c
lea rbp, [0x1400ab2b0]
xor r13d, r13d
xor r12d, r12d
xor r14d, r14d
xor edi, edi
jmp 0x14005b64d
lea rcx, [0x1400ace44]
mov edx, 1
mov r8, rsi
mov r9, rbp
call fcn.14000e262
test al, al
jne 0x14005b213
mov rcx, rsi
mov rdx, rbp
call fcn.14005b7ae
test rax, rax
je 0x14005b543
mov r14, rax
mov r15, rdx
lea rbx, [rsp + 0xb0]
mov rcx, rbx
mov rdx, rsi
mov r8, rbp
call fcn.1400042c9
lea rcx, [rsp + 0x70]
mov rdx, r14
mov r8, r15
mov r9, rbx
jmp 0x14005b5fd
mov esi, 8
xor ebp, ebp
cmp qword [rsp + 0x88], 0
je 0x14005b533
lea rbx, [rsp + 0x70]
mov rcx, rbx
call fcn.1400255a7
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x14005b50e
mov rcx, qword [rsp + 0x70]
lea r8, [rbx + 0x11]
mov dl, 0xff
call fcn.140081520
and qword [rsp + 0x88], 0
lea rax, [rbx + 1]
shr rax, 3
imul rax, rax, 7
cmp rbx, 8
cmovb rax, rbx
mov qword [rsp + 0x80], rax
mov rcx, rsi
mov rdx, rbp
call fcn.14005ea0a
jmp 0x14005b602
lea r15, [rsp + 0x178]
lea rsi, [rsp + 0x1c0]
mov qword [rsi], r15
lea r12, [0x1400abae0]
lea rdi, [rsp + 0xb0]
mov qword [rdi], r12
mov r13d, 1
mov qword [rdi + 8], r13
and qword [rdi + 0x20], 0
lea rbp, [0x140003edb]
mov qword [rsi + 8], rbp
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], r13
lea rbx, [rsp + 0x240]
mov rcx, rbx
mov rdx, rdi
call fcn.14004262c
lea rdx, [0x1400cf9ca]
lea r14, [rsp + 0x70]
mov r8d, 4
mov rcx, r14
mov r9, rbx
call fcn.14005b893
lea rax, [rsp + 0x58]
mov qword [rdi], r12
mov qword [rdi + 8], r13
and qword [rdi + 0x20], 0
mov qword [rax], r15
mov qword [rax + 8], rbp
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], r13
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call fcn.14004262c
lea rdx, [0x1400cf9ce]
mov r8d, 5
mov rcx, r14
mov r9, rsi
call fcn.14005b893
mov rbp, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x178]
mov rdx, qword [rsp + 0x180]
call fcn.140003e5c
test rbp, rbp
sete dil
call fcn.14004505b
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xc0], xmm7
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rdx
test dil, dil
je 0x14005b6a5
mov rsi, rax
mov r15, rdx
mov rcx, r14
mov rdx, r12
call fcn.140023a35
lea rbp, [0x1400ab2b0]
xor r14d, r14d
xor r12d, r12d
xor r13d, r13d
mov rdi, rsi
mov rbx, r15
mov rsi, qword [rsp + 0x50]
jmp 0x14005b6bc
lea rcx, [rsp + 0xb0]
call fcn.140025571
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x38]
lea rcx, [rsp + 0x190]
call fcn.140025571
mov ecx, 0x40
mov edx, 8
call fcn.140064d62
mov ecx, 1
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], r14
mov qword [rax + 0x20], r12
mov qword [rax + 0x28], r13
mov qword [rax + 0x30], rdi
mov qword [rax + 0x38], rbx
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsp + 0xb0], rcx
test rcx, rcx
je 0x14005b71c
lea rcx, [rsp + 0xb0]
call fcn.14002552b
movaps xmm6, xmmword [rsp + 0x2c0]
movaps xmm7, xmmword [rsp + 0x2d0]
add rsp, 0x2e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
xor eax, eax
test r10b, r10b
cmovne rdx, rax
jmp 0x14005afad