Function at 0x4ea540
Capabilities:
Encode data using base64 via winapi
Hash data via bcrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
lea ecx, [ebp - 0x20]
mov dword [ecx + 8], eax
movsd xmm0, qword [ebp + 0x18]
movsd qword [ecx], xmm0
xor eax, eax
mov dword [ecx + 0xc], eax
lea edx, [ebp - 0x28]
mov dword [edx + 4], eax
mov dword [edx], eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x4ea858
mov edi, str.User_Choice_set_via_Windows_User_Experience_D18B6DD5_6124_4341_9318_804003BAFA0B
mov esi, str._s_s_s_08lx_08lx_s
push edi
push dword [ebp - 0x28]
push dword [ebp - 0x24]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.004ebcd0
add esp, 0x1c
mov esi, eax
inc esi
xor eax, eax
dec eax
mov ebx, esi
add ebx, esi
cmovb ebx, eax
push ebx
call fcn.0064cda3
add esp, 4
push ebx
push 0
push eax
mov ebx, eax
call fcn.00650600
add esp, 0xc
push edi
mov edi, dword [ebp + 8]
push dword [ebp - 0x28]
push dword [ebp - 0x24]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, str._s_s_s_08lx_08lx_s
push eax
push 0xffffffffffffffff
push esi
mov esi, ebx
push ebx
call fcn.004ebd30
add esp, 0x28
push ebx
call dword [sym.imp.USER32.dll_CharLowerW]
test ebx, ebx
je 0x4ea858
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax]
add ebx, 2
cmp ebx, 7
jbe 0x4ea86d
mov dword [ebp - 0x30], esi
xor esi, esi
mov dword [ebp - 0x20], esi
push esi
push esi
push 0x74d09e
lea eax, [ebp - 0x20]
push eax
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
js 0x4ea86a
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x20]
sub esp, 0x1c
mov dword [esp + 0x18], esi
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
lea ecx, [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.bcrypt.dll_BCryptCreateHash
test eax, eax
js 0x4ea860
push 0
push ebx
mov esi, dword [ebp - 0x30]
push esi
push dword [ebp - 0x28]
call sub.bcrypt.dll_BCryptHashData
test eax, eax
js 0x4ea6b1
mov esi, 0x10
push esi
call fcn.0064cda3
add esp, 4
xorps xmm0, xmm0
movups xmmword [eax], xmm0
push 0
push esi
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
push eax
push dword [ebp - 0x28]
call sub.bcrypt.dll_BCryptFinishHash
test eax, eax
jns 0x4ea6b8
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4ea6b1
push eax
call fcn.0064cdac
add esp, 4
mov dword [ebp - 0x2c], 0
push dword [ebp - 0x28]
call sub.bcrypt.dll_BCryptDestroyHash
push 0
push dword [ebp - 0x20]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4ea86d
shr ebx, 3
mov ecx, dword [eax]
mov eax, dword [eax + 4]
or ecx, 1
mov dword [ebp - 0x38], ecx
or eax, 1
mov dword [ebp - 0x44], eax
xor eax, eax
inc eax
cmp ebx, 2
cmovae eax, ebx
mov dword [ebp - 0x40], eax
xor esi, esi
xor edx, edx
xor ebx, ebx
xor edi, edi
xor eax, eax
mov dword [ebp - 0x3c], esi
mov ecx, dword [ebp - 0x30]
mov esi, dword [ecx + esi*8]
mov dword [ebp - 0x34], esi
add eax, esi
imul eax, dword [ebp - 0x38]
rol eax, 0x10
imul eax, eax, 0xcf98b111
rol eax, 0x10
mov esi, dword [ebp - 0x3c]
mov esi, dword [ecx + esi*8 + 4]
mov dword [ebp - 0x48], esi
imul eax, eax, 0x87085b9f
rol eax, 0x10
imul eax, eax, 0x12ceb96d
rol eax, 0x10
imul ecx, eax, 0x257e1d83
add ebx, ecx
add edi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
imul eax, edi
rol edi, 0x10
imul edi, edi, 0xef0569fb
add edi, eax
imul eax, edi, 0x79f8a395
mov dword [ebp - 0x34], eax
shr edi, 0x10
imul eax, edi, 0x689b6b9f
add eax, dword [ebp - 0x34]
mov edi, eax
rol edi, 0x10
imul edi, edi, 0xc3efea97
add ecx, esi
mov esi, dword [ebp - 0x44]
imul ecx, esi
rol ecx, 0x10
add edi, eax
imul ecx, ecx, 0xa27416f5
rol ecx, 0x10
add edx, edi
add edi, dword [ebp - 0x48]
mov eax, esi
mov esi, dword [ebp - 0x3c]
imul eax, edi
rol edi, 0x10
imul edi, edi, 0xc31713db
add edi, eax
imul eax, edi, 0x59c3af2d
mov dword [ebp - 0x34], eax
shr edi, 0x10
imul eax, edi, 0xddcd1f0f
add eax, dword [ebp - 0x34]
mov edi, eax
rol edi, 0x10
imul edi, edi, 0x35bd1ec9
add edi, eax
imul eax, ecx, 0xd38396ff
rol eax, 0x10
imul eax, eax, 0x7c932b89
rol eax, 0x10
imul eax, eax, 0xbfa49f69
add ebx, eax
add edx, edi
inc esi
cmp dword [ebp - 0x40], esi
jne 0x4ea6ff
xor edi, eax
xor edx, ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edx
xor eax, eax
mov dword [ebp - 0x28], eax
lea esi, [ebp - 0x28]
push esi
push eax
push 0x40000001
push 8
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x4ea892
mov edi, esi
mov esi, dword [ebp - 0x28]
add esi, esi
mov eax, 0xffffffff
cmovb esi, eax
push esi
call fcn.0064cda3
add esp, 4
mov ebx, eax
push esi
push 0
push eax
call fcn.00650600
add esp, 0xc
push edi
push ebx
push 0x40000001
push 8
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
mov edi, dword [ebp + 8]
je 0x4ea8ac
mov dword [edi], ebx
jmp 0x4ea89b
mov dword [edi], 0
jmp 0x4ea87c
push 0
push dword [ebp - 0x20]
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
mov esi, dword [ebp - 0x30]
mov dword [edi], 0
push esi
call fcn.0064cdac
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, edi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret 0x20
mov edi, dword [ebp + 8]
mov dword [edi], 0
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0064cdac
add esp, 4
jmp 0x4ea873
mov dword [edi], 0
test ebx, ebx
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
je 0x4ea8a1
push ebx
call fcn.0064cdac
mov eax, dword [ebp - 0x2c]
add esp, 4
jmp 0x4ea8a1