Function at 0x18002a560
Capabilities:
Create thread
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x180082618]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov edi, r8d
mov dword [rsp + 0x48], r8d
mov r12, rdx
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], rcx
movdqa xmm0, xmmword [0x18007d280]
movdqa xmmword [rbp + 0x1b0], xmm0
mov byte [rbp + 0x1a0], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x1d0], xmm0
mov byte [rbp + 0x1c0], 0
movdqa xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1e0], 0
movdqa xmmword [rbp + 0x220], xmm0
mov byte [rbp + 0x210], 0
movdqa xmmword [rbp + 0x240], xmm0
mov byte [rbp + 0x230], 0
xor ecx, ecx
mov qword [rbp + 0x40], rcx
mov word [rbp + 0x48], cx
movdqu xmmword [rbp + 0x5a], xmm0
mov byte [rbp + 0x4a], cl
mov qword [rbp + 0x10], rcx
mov word [rbp + 0x18], cx
movdqu xmmword [rbp + 0x2a], xmm0
mov byte [rbp + 0x1a], cl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x68], rcx
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], rcx
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rcx
mov qword [rbp + 0x80], rcx
mov ecx, 0x30
call fcn.180036df4
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x78], rax
xor r8d, r8d
mov qword [rbp + 0x88], r8
xorps xmm2, xmm2
movsd qword [rbp + 0x90], xmm2
mov qword [rbp + 0x98], r8
mov dword [rbp + 0xa0], 1
mov qword [rbp + 0xa8], r8
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc0], xmm1
movdqa xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r8
mov qword [rbp + 0xe8], 0xffffffffffffffff
mov dword [rbp + 0xf0], r8d
xor eax, eax
movups xmmword [rbp + 0xf8], xmm0
movups xmmword [rbp + 0x108], xmm0
movups xmmword [rbp + 0x118], xmm0
movups xmmword [rbp + 0x128], xmm0
mov qword [rbp + 0x138], rax
movdqa xmm0, xmmword [0x18007d280]
movdqa xmmword [rbp + 0x150], xmm0
mov byte [rbp + 0x140], al
mov word [rbp + 0x160], r8w
mov dword [rbp + 0x164], r8d
mov qword [rbp + 0x168], r8
xorps xmm0, xmm0
movaps xmmword [rbp + 0x170], xmm0
movsd qword [rbp + 0x180], xmm2
mov byte [rbp + 0x188], al
mov qword [rbp + 0x18c], r8
lea ebx, [rdi - 0xf]
mov dword [rsp + 0x44], ebx
cmp edi, ebx
mov ebx, dword [rsp + 0x50]
jbe case.0x18002a7a5.0
lea r13d, [rdi - 0x1e]
mov dword [rsp + 0x60], r13d
lea rdx, [0x180000000]
mov r9d, 0x1bb
mov r10d, 0x6465
mov r11d, 0x2e75
movzx r15d, byte [rsp + 0x40]
mov r14d, dword [rsp + 0x50]
mov esi, dword [rsp + 0x58]
mov eax, dword [rsp + 0x44]
nop
cmp r13d, 0x1b
ja case.default.0x18002a7a5
mov ecx, dword [rdx + r13*4 + 0x2b060]
add rcx, rdx
jmp rcx
lea rax, [rbp + 0x250]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18002a7b5
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x1a0]
call fcn.1800183d0
jmp 0x18002ad87
lea rdx, [rbp - 0x80]
mov ecx, 0x53
call fcn.180013790
jmp 0x18002ad87
mov r8d, 1
lea rdx, [0x1800399e4]
lea rcx, [rbp + 0x1c0]
call fcn.1800183d0
jmp 0x18002ad87
mov word [rbp + 0x200], r9w
lea r8, [rbp + 0x1e0]
xor edx, edx
mov ecx, 0x128
call fcn.1800114f0
mov dword [rsp + 0x38], 0x118
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0x210]
xor ecx, ecx
call fcn.18000d9a0
mov eax, 0x1bb
mov word [rsp + 0x48], ax
lea r9, [rbp + 0x40]
lea r8, [rsp + 0x48]
lea rdx, [0x180082588]
mov ecx, 0x11
call fcn.1800340c0
jmp 0x18002ad87
lea r12, [0x180007cb0]
mov qword [rsp + 0x60], r12
mov edi, 0x9b
nop
mov eax, edi
sub eax, 0x50
je 0x18002a8e1
sub eax, 0x4b
je 0x18002a8f8
sub eax, 0x3070
je 0x18002a8f8
sub eax, 0x3070
je 0x18002a8f8
cmp eax, 0x3070
jne 0x18002a8f8
mov rdx, qword [0x180083318]
cmp rdx, qword [0x180083320]
je 0x18002a8ce
mov qword [rdx], r12
add qword [0x180083318], 8
jmp 0x18002a8f8
lea r8, [rsp + 0x60]
lea rcx, [0x180083310]
call fcn.1800011b0
jmp 0x18002a8f8
mov rcx, r12
call fcn.180004960
xor r8d, r8d
xor edx, edx
mov ecx, 0xaf
call fcn.180004840
add edi, 0x3070
cmp edi, 0xf230
jbe 0x18002a890
mov r12, qword [rbp - 0x20]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov r9d, 0x12b
lea r8, [0x180082520]
xor edx, edx
xor ecx, ecx
call fcn.180023850
mov edi, dword [rsp + 0x48]
jmp 0x18002ad87
mov dword [rbp + 0x250], 0x696e75
mov dword [rbp + 0x253], 0x2e636574
jmp case.0x18002a7a5.13
mov rax, qword [r12]
mov ecx, dword [rax + 4]
and ecx, 0xffc0
je case.0x18002a7a5.13
mov ebx, r8d
mov rax, qword [rbp - 0x18]
cmp ecx, dword [rax]
sete bl
jmp case.0x18002a7a5.0
lea rax, [rbp - 0x80]
mov qword [rbp - 0x10], rax
mov eax, dword [0x1800825d0]
mov dword [rbp - 8], eax
mov eax, dword [0x1800825d4]
mov dword [rbp - 4], eax
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp], xmm0
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], r8d
lea r9, [rbp]
lea r8, [0x18000fb70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r12, rax
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x18002ac1f
xor r8d, r8d
mov r13d, r8d
nop dword [rax + rax]
cmp r13d, 6
ja case.default.0x18002a9fe
mov ecx, r13d
lea rax, [0x180000000]
mov edx, dword [rax + rcx*4 + 0x2b0d0]
add rdx, rax
jmp rdx
mov ecx, r8d
movzx eax, byte [rsp + 0x41]
test esi, esi
cmove ecx, eax
mov byte [rsp + 0x41], cl
mov ecx, r8d
movzx eax, byte [rsp + 0x40]
cmp dword [rsp + 0x54], 0
cmove ecx, eax
movzx edi, cl
mov byte [rsp + 0x40], cl
cmp byte [rsp + 0x41], 0
je 0x18002ab14
mov esi, 0x3d
xor r12d, r12d
nop dword [rax + rax]
mov eax, esi
sub eax, 0x3d
je 0x18002aaec
sub eax, 1
je 0x18002aaab
sub eax, 1
je 0x18002aa75
cmp eax, 1
jne 0x18002aaf8
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x18002aaf8
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18002aaf8
test r15b, r15b
je 0x18002aaf8
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call sub.RPCRT4.dll_MesIncrementalHandleReset
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x18002aaf8
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18002aaf8
lea r8, [rbp - 0x30]
mov edx, r14d
lea rcx, [rbp + 0x260]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov dword [rsp + 0x58], eax
lea r9, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov edi, eax
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x18002aae3
call sub.RPCRT4.dll_MesHandleFree
test edi, edi
je 0x18002aaf8
xor r15b, r15b
jmp 0x18002aaf8
mov r15b, 1
mov qword [rbp - 0x30], r12
mov qword [rsp + 0x70], r12
inc esi
cmp esi, 0x41
jb 0x18002aa40
mov r12, qword [rsp + 0x68]
mov esi, dword [rsp + 0x58]
movzx edi, byte [rsp + 0x40]
xor r8d, r8d
test dil, dil
je 0x18002ab4c
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call sub.RPCRT4.dll_MesIncrementalHandleReset
mov dword [rsp + 0x54], eax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18002ab4c
call sub.RPCRT4.dll_MesHandleFree
mov dword [rsp + 0x54], eax
xor r8d, r8d
jmp case.default.0x18002a9fe
lea r9, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov dword [rsp + 0x54], eax
lea r9, [rbp - 0x28]
lea r8, [rsp + 0x50]
mov edx, r14d
lea rcx, [rbp + 0x260]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov esi, eax
mov dword [rsp + 0x58], eax
xor r8d, r8d
jmp case.default.0x18002a9fe
mov qword [rsp + 0x78], r8
mov dword [rsp + 0x50], r8d
mov qword [rbp - 0x28], r8
jmp case.default.0x18002a9fe
mov byte [rsp + 0x41], 1
mov byte [rsp + 0x40], 1
movups xmm0, xmmword [str._Z17convert_long3_rtpDv3_t]
movups xmmword [rbp + 0x260], xmm0
movsd xmm1, qword [0x18007cc78]
movsd qword [rbp + 0x270], xmm1
movzx eax, word [0x18007cc80]
mov word [rbp + 0x278], ax
movzx eax, byte [0x18007cc82]
mov byte [rbp + 0x27a], al
jmp case.default.0x18002a9fe
lea rax, [rbp + 0x260]
mov r14, 0xffffffffffffffff
nop
inc r14
cmp byte [rax + r14], 0
jne 0x18002abf0
jmp case.default.0x18002a9fe
mov ebx, 1
inc r13d
lea eax, [r13 + 0x10d]
cmp eax, 0x114
jb 0x18002a9e0
mov r13d, dword [rsp + 0x60]
mov edi, dword [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rbp - 0x20]
jmp 0x18002ad87
mov word [rsp + 0x48], r9w
lea r9, [rsp + 0x48]
lea r8, [rbp + 0x10]
mov edx, 0x117
lea rcx, [0x1800825a8]
call fcn.180032d90
jmp 0x18002ad87
lea rax, [rbp + 0x40]
mov qword [rsp + 0x68], rax
mov rdx, qword [rbp - 0x78]
cmp rdx, qword [rbp - 0x70]
je 0x18002ac7e
lea rax, [rbp + 0x40]
mov qword [rdx], rax
mov rdx, qword [rbp - 0x78]
add rdx, 8
mov qword [rbp - 0x78], rdx
jmp 0x18002ac90
lea r8, [rsp + 0x68]
lea rcx, [rbp - 0x80]
call fcn.1800011b0
mov rdx, qword [rbp - 0x78]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x68], rax
cmp rdx, qword [rbp - 0x70]
je 0x18002acad
lea rax, [rbp + 0x10]
mov qword [rdx], rax
add qword [rbp - 0x78], 8
jmp 0x18002acbb
lea r8, [rsp + 0x68]
lea rcx, [rbp - 0x80]
call fcn.1800011b0
mov eax, dword [0x1800825d0]
mov dword [rsp + 0x60], eax
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x80]
mov ecx, 0x5b
call fcn.18000c940
jmp 0x18002ad87
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf5
xor ecx, ecx
call fcn.180005390
xor r8d, r8d
mov ebx, r8d
jmp 0x18002ad8a
mov dword [rbp + 0x257], 0x2e756465
mov eax, 0x6576
mov word [rbp + 0x25b], ax
jmp case.0x18002a7a5.13
mov byte [rbp + 0x25d], 0
mov qword [rsp + 0x28], r8
lea rax, [0x180082528]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xcb
call fcn.18002ed90
test al, al
jne 0x18002ad79
mov ecx, 0x51
mov eax, ecx
sub eax, 0x51
je 0x18002ad6e
sub eax, 0x56
je 0x18002ad6e
sub eax, 0x56
je 0x18002ad69
cmp eax, 0x56
je case.0x18002a7a5.0
jmp 0x18002ad6e
mov ebx, 1
add ecx, 0x56
cmp ecx, 0x1a9
jb 0x18002ad51
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xor r8d, r8d
mov r11d, 0x2e75
mov r10d, 0x6465
mov r9d, 0x1bb
lea rdx, [0x180000000]
mov eax, dword [rsp + 0x44]
dec edi
mov dword [rsp + 0x48], edi
dec r13d
mov dword [rsp + 0x60], r13d
cmp edi, eax
jbe case.0x18002a7a5.0
jmp 0x18002a790
mov rax, qword [r12]
mov ebx, dword [rax + 4]
mov rax, qword [rbp - 0x18]
and ebx, dword [rax]
lea rcx, [rbp + 0xe8]
call fcn.180003230
mov rdi, qword [rbp + 0xd0]
test rdi, rdi
je 0x18002ae56
mov rsi, qword [rbp + 0xd8]
cmp rdi, rsi
je 0x18002ae08
nop
mov rcx, rdi
call fcn.180017110
add rdi, 0x20
cmp rdi, rsi
jne 0x18002adf0
mov rdi, qword [rbp + 0xd0]
mov rdx, qword [rbp + 0xe0]
sub rdx, rdi
and rdx, 0xffffffffffffffe0
mov rax, rdi
cmp rdx, 0x1000
jb 0x18002ae37
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002ae94
mov rcx, rdi
call fcn.180036e30
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xd0], xmm0
xor r14d, r14d
mov qword [rbp + 0xe0], r14
jmp 0x18002ae59
xor r14d, r14d
mov rcx, qword [rbp + 0xb8]
test rcx, rcx
je 0x18002aeb2
mov rdx, qword [rbp + 0xc8]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002ae9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002ae9b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180036e30
mov qword [rbp + 0xb8], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xc0], xmm0
lea rcx, [rbp + 0x78]
call fcn.180003160
nop
mov rdi, qword [rbp - 0x68]
test rdi, rdi
je 0x18002af4d
mov rsi, qword [rbp - 0x60]
cmp rdi, rsi
je 0x18002aee7
mov rcx, rdi
call fcn.180002a70
add rdi, 0x28
cmp rdi, rsi
jne 0x18002aed2
mov rdi, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x58]
sub rcx, rdi
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rdi
cmp rdx, 0x1000
jb 0x18002af39
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002af39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.180036e30
mov qword [rbp - 0x68], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov rdx, qword [rbp - 0x80]
test rdx, rdx
je 0x18002af76
mov r8, qword [rbp - 0x70]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x80]
call fcn.180019b50
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
mov rdx, qword [rbp + 0x32]
cmp rdx, 0x10
jb 0x18002afb4
inc rdx
mov rcx, qword [rbp + 0x1a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002afaf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002afaf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180036e30
movdqa xmm0, xmmword [0x18007d280]
movdqu xmmword [rbp + 0x2a], xmm0
mov byte [rbp + 0x1a], 0
mov rdx, qword [rbp + 0x62]
cmp rdx, 0x10
jb 0x18002b003
inc rdx
mov rcx, qword [rbp + 0x4a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002affe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002affe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180036e30
movdqa xmm0, xmmword [0x18007d280]
movdqu xmmword [rbp + 0x5a], xmm0
mov byte [rbp + 0x4a], 0
lea rcx, [rbp + 0x210]
call fcn.180002dd0
nop
lea rcx, [rbp + 0x1a0]
call fcn.180002e80
mov eax, ebx
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.1800375e0
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret