Function at 0x180042940
Capabilities:
Encode data using base64
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov rax, qword [0x1800624d0]
xor rax, rsp
mov qword [rbp + 0x430], rax
mov ebx, dword [rsp + 0x4c]
lea eax, [rdx + 0xa]
mov qword [rsp + 0x50], r8
mov r9, r8
mov dword [rsp + 0x40], edx
mov r12, rcx
mov dword [rsp + 0x44], eax
cmp edx, eax
jae case.0x1800429f0.12
mov r14, qword [rsp + 0x60]
lea edi, [rdx - 0x5e]
mov rsi, qword [rsp + 0x60]
mov eax, edx
mov r13, qword [rsp + 0x60]
mov r15d, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x58], ebx
mov r8d, 0x64
xor edx, edx
lea r10d, [r8 + 1]
lea r11d, [r8 + 0x10]
cmp edi, 0x1f
ja case.default.0x1800429f0
lea rcx, [0x180000000]
movzx eax, byte [rcx + rdi + 0x42f7c]
mov ecx, dword [rcx + rax*4 + 0x42f50]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0x8e
call fcn.1800200e0
mov rcx, qword [0x180062590]
mov edx, 8
mov rcx, qword [rcx + 0x48]
call fcn.18004c238
jmp 0x180042efc
mov rcx, qword [r12 + 0x10]
movabs rax, 0xaaaaaaaaaaaaaaab
add rcx, 2
xor r8d, r8d
mul rcx
mov rcx, r9
shr rdx, 1
shl rdx, 2
call fcn.18004a1a0
cmp qword [r12 + 0x18], 0x10
mov r14, r12
jb 0x180042a55
mov r14, qword [r12]
mov r9, qword [rsp + 0x50]
mov rsi, r9
cmp qword [r9 + 0x18], 0x10
jb 0x180042a67
mov rsi, qword [r9]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
jmp case.0x1800429f0.3
mov qword [0x180062590], rdx
jmp case.0x1800429f0.3
mov ecx, 0x3358
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x70], rax
mov qword [r12], rax
jmp 0x180042efc
cmp qword [rsp + 0x70], 0
je 0x180042f49
mov edi, r11d
nop dword [rax + rax]
mov eax, edi
sub eax, 0x74
je 0x180042ada
cmp eax, 1
jne 0x180042ae4
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
mov eax, r9d
mov qword [rcx + 0x3350], r9
mov dword [rcx + 0xc48], r9d
jmp 0x180042f1f
mov ecx, 0x59
call fcn.18001a620
inc edi
cmp edi, 0x76
jb 0x180042ab0
jmp 0x180042ef8
mov qword [rsp + 0x60], r12
jmp case.0x1800429f0.3
mov rax, qword [rsp + 0x60]
mov edx, 0x42
mov rcx, qword [rax + 0x10]
call fcn.18003fad0
mov ebx, eax
mov dword [rsp + 0x58], eax
jmp 0x180042efc
movabs rax, 0xaaaaaaaaaaaaaaab
mov ecx, 0x104
mul qword [r12 + 0x10]
shr rdx, 1
lea rdi, [rdx + rdx*2]
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor r9d, r9d
mov r13d, r9d
test rdi, rdi
je 0x180042c1a
lea rcx, [rdi - 1]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
inc rdx
lea r13, [rdx + rdx*2]
nop word [rax + rax]
mov r8d, pe_nt_image_headers64
mov eax, r8d
sub eax, 0x108
je 0x180042bc5
cmp eax, 1
jne 0x180042c00
movzx ecx, byte [r14 + 1]
movzx eax, byte [r14 + 2]
and ecx, 0xf
shr eax, 6
lea ecx, [rax + rcx*4]
mov rax, qword [0x180062718]
movzx ecx, byte [rcx + rax]
mov byte [rsi], cl
movzx ecx, byte [r14 + 2]
mov rax, qword [0x180062718]
and ecx, 0x3f
movzx ecx, byte [rcx + rax]
mov byte [rsi + 1], cl
add rsi, 2
add r14, 3
jmp 0x180042c00
mov rax, qword [0x180062718]
movzx ecx, byte [r14]
shr rcx, 2
movzx ecx, byte [rcx + rax]
mov byte [rsi], cl
movzx ecx, byte [r14]
movzx eax, byte [r14 + 1]
and ecx, 3
shl ecx, 4
shr eax, 4
add ecx, eax
mov rax, qword [0x180062718]
movzx ecx, byte [rcx + rax]
mov byte [rsi + 1], cl
add rsi, 2
inc r8d
cmp r8d, 0x10a
jb 0x180042b76
sub rdx, 1
jne 0x180042b70
mov qword [rsp + 0x38], r9
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rdx, [rbp + 0x220]
lea rax, [rsp + 0x78]
mov r8d, 0x104
mov qword [rsp + 0x28], rax
mov rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
jmp 0x180042ef8
cmp r13, qword [r12 + 0x10]
jae case.0x1800429f0.3
mov ebx, dword [rsp + 0x4c]
mov edi, 0x66
nop dword [rax]
cmp edi, 0x19206
ja 0x180042d81
je 0x180042d65
cmp edi, 0xc936
ja 0x180042d15
je 0x180042cfb
cmp edi, 0x66
je 0x180042cea
cmp edi, 0x329a
je 0x180042cd2
cmp edi, 0x64ce
je 0x180042cbf
cmp edi, 0x9702
jne 0x180042ede
mov eax, 0x6d
mov word [rbp - 0x48], ax
jmp 0x180042ede
mov dword [rbp - 0x50], 0x740065
mov dword [rbp - 0x4c], 0x720065
jmp 0x180042ede
mov dword [rbp - 0x5a], 0x6c0062
mov dword [rbp - 0x56], 0x200065
mov word [rbp - 0x52], r8w
jmp 0x180042ede
mov word [rbp - 0x60], r8w
mov dword [rbp - 0x5e], 0x75006f
jmp 0x180042ede
mov dword [rbp - 0x46], 0x6e0069
mov dword [rbp - 0x42], 0x6e0061
mov dword [rbp - 0x3e], 0x280074
jmp 0x180042ede
cmp edi, 0xfb6a
je 0x180042d4f
cmp edi, 0x12d9e
je 0x180042d3a
cmp edi, 0x15fd2
jne 0x180042ede
mov word [rbp - 0x2c], dx
jmp 0x180042ede
mov eax, 0x3b
mov dword [rbp - 0x32], 0x290034
mov word [rbp - 0x2e], ax
jmp 0x180042ede
mov word [rbp - 0x3a], r8w
mov dword [rbp - 0x38], 0x61006d
mov word [rbp - 0x34], r11w
jmp 0x180042ede
mov eax, 0x70
mov dword [rbp - 0x26], 0x7a0073
mov word [rbp - 0x28], ax
mov dword [rbp - 0x22], 0x650052
jmp 0x180042ede
cmp edi, 0x28d0a
ja 0x180042e2c
je 0x180042e23
cmp edi, 0x1c43a
je 0x180042e09
cmp edi, 0x1f66e
je 0x180042de8
cmp edi, 0x228a2
je 0x180042dd8
cmp edi, 0x25ad6
jne 0x180042ede
movzx ebx, byte [r14]
lea rax, [r13 + 1]
cmp rax, qword [r12 + 0x10]
jae 0x180042dd0
movzx r15d, byte [r14 + 1]
jmp 0x180042ede
mov r15d, edx
jmp 0x180042ede
mov dword [rbp - 2], 0x65006e
mov word [rbp + 2], dx
jmp 0x180042ede
mov dword [rbp - 0x12], 0x740069
mov dword [rbp - 0xe], 0x540068
mov dword [rbp - 0xa], 0x690068
mov dword [rbp - 6], 0x4f0073
jmp 0x180042ede
mov dword [rbp - 0x1e], 0x6c0070
mov dword [rbp - 0x1a], 0x630061
mov dword [rbp - 0x16], 0x570065
jmp 0x180042ede
mov dword [rsp + 0x68], edx
jmp 0x180042ede
cmp edi, 0x2bf3e
je 0x180042ea5
cmp edi, 0x2f172
je 0x180042e53
cmp edi, 0x323a6
jne 0x180042ede
mov byte [rsi], 0x3d
inc rsi
jmp 0x180042ede
lea rax, [r13 + 1]
cmp rax, qword [r12 + 0x10]
jae 0x180042e7b
mov eax, dword [rsp + 0x68]
mov ecx, r15d
and ecx, 0xf
shr eax, 6
lea ecx, [rax + rcx*4]
mov rax, qword [0x180062718]
movzx edx, byte [rcx + rax]
jmp 0x180042e7d
mov dl, 0x3d
mov r8d, dword [rsp + 0x6c]
lea rcx, [rbp - 0x60]
mov byte [rsi], dl
lea rdx, [rbp - 0x28]
inc rsi
call qword [sym.imp.SHLWAPI.dll_UrlCompareW]
xor edx, edx
lea r8d, [rdx + 0x64]
lea r10d, [rdx + 0x65]
lea r11d, [rdx + 0x74]
jmp 0x180042ede
mov rax, qword [0x180062718]
mov ecx, ebx
shr rcx, 2
mov dword [rsp + 0x6c], edx
movzx ecx, byte [rcx + rax]
mov eax, r15d
mov byte [rsi], cl
mov ecx, ebx
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, eax
mov rax, qword [0x180062718]
movzx ecx, byte [rcx + rax]
mov byte [rsi + 1], cl
add rsi, 2
add edi, 0x3234
cmp edi, 0x35574
jbe 0x180042c70
mov dword [rsp + 0x4c], ebx
mov ebx, dword [rsp + 0x58]
mov edi, dword [rsp + 0x48]
mov r9, qword [rsp + 0x50]
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
inc eax
inc edi
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x48], edi
cmp eax, ecx
jb 0x1800429b7
mov eax, ebx
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.18004c9e0
mov rbx, qword [rsp + 0x588]
add rsp, 0x540
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 0xffffffff
jmp 0x180042f1f