Function at 0x1400fd900
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test edx, edx
je 0x1400fdd50
mov esi, edx
mov eax, dword [str.u9_]
xor edx, edx
div dword [0x141f38bc4]
mov rdi, rcx
nop dword [rax + rax]
mov eax, dword [0x141f38bc8]
xor eax, dword [0x141f38bcc]
and eax, 0x8c29289
imul eax, eax, 0xcf1bd15
cmp eax, 0x4ea07ea2
ja 0x1400fd930
nop
mov eax, dword [0x141f38bd0]
add eax, dword [0x141f38bd4]
and eax, 0x2577f8bd
add eax, 0x2680faee
cmp eax, 0x611f78be
ja 0x1400fd950
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400fdd50
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400fd990
mov eax, 0xe18496fb
nop dword [rax]
mov ecx, dword [0x141f38bd8]
or ecx, dword [0x141f38bdc]
imul rcx, rax
shr rcx, 0x3d
add ecx, 0xa40a19b9
and ecx, 0xa40a1131
cmp ecx, 0x822d79cc
je 0x1400fd9a0
nop dword [rax + rax]
mov eax, dword [0x141f38be0]
imul eax, dword [0x141f38be4]
xor eax, 0x40004140
or eax, 0x29040620
and eax, 0x69246764
cmp eax, 0x6a8b9146
ja 0x1400fd9d0
xor r12d, r12d
xor ebp, ebp
jmp 0x1400fda0b
cmp rbp, qword [rsp + 0x20]
je 0x1400fdd50
mov r14, rbp
mov eax, dword [0x141f38be8]
sub eax, dword [0x141f38bec]
imul rax, rax, 0x39e898c9
shr rax, 0x3d
or eax, 0x6a705962
imul rax, rax, 0xb18d30b
shr rax, 0x38
cmp eax, 0x5affe1fe
ja 0x1400fda0e
cmp qword [rdi + 0x10], r14
jbe 0x1400fdd85
lea rbp, [r14 + 1]
nop word [rax + rax]
mov eax, dword [str.hk_fM]
xor edx, edx
div dword [0x141f38bf4]
add eax, 0xa04889c5
or eax, 0x39320000
and eax, 0x39b31086
cmp eax, 0xd3864af0
ja 0x1400fda50
shl r14, 7
add r14, qword [rdi + 8]
xor eax, eax
mov cl, 1
lock cmpxchg byte [r14 + 4], cl
lea rbx, [r14 + 4]
sete al
nop dword [rax]
test r12b, r12b
jne 0x1400fda90
test al, al
je 0x1400fdb98
mov eax, dword [0x141f38c10]
xor eax, dword [0x141f38c14]
add eax, 0x561a019f
xor eax, 0xd2dfc60a
imul eax, eax, 0xf5315be
cmp eax, 0x524c68ad
jb 0x1400fda9d
movzx r15d, byte [r14 + 5]
mov eax, dword [0x141f38c18]
xor edx, edx
div dword [0x141f38c1c]
nop word cs:[rax + rax]
mov eax, dword [0x141f38c20]
sub eax, dword [0x141f38c24]
add eax, 0x48c09697
or eax, 0xa601c868
imul rax, rax, 0x76c0e5a1
shr rax, 0x3d
cmp eax, 0xac4e9f18
ja 0x1400fdae0
test r15b, r15b
je 0x1400fdc57
mov eax, dword [0x141f38c28]
or eax, dword [0x141f38c2c]
imul eax, eax, 0xfdfde42f
or eax, 0x4b320774
and eax, 0x7f765f7c
cmp eax, 0x91505dd8
jbe 0x1400fdb40
mov byte [r14 + 5], 0
nop dword [rax]
mov eax, dword [0x141f38c30]
add eax, dword [0x141f38c34]
imul eax, eax, 0xe72550f6
xor eax, 0x9028040
or eax, 0xc4552f91
mov byte [r14 + 5], 0
cmp eax, 0xa9aa948d
jb 0x1400fdb40
lock inc dword [r14]
mov eax, dword [0x141f38c38]
imul eax, dword [0x141f38c3c]
xor eax, 0xa020010b
or eax, 0x5dd5f8d0
add eax, 0xda2a5925
cmp eax, 0x7ae161d
jae 0x1400fdc20
jmp 0x1400fdd30
mov eax, dword [0x141f38bf8]
xor edx, edx
div dword [0x141f38bfc]
imul eax, eax, 0xfb465843
cmp eax, 0x7c324037
je 0x1400fdc14
mov eax, dword [0x141f38c00]
imul eax, dword [0x141f38c04]
imul r15d, eax, 0xc2e26014
mov eax, 0xa339f4f5
imul r15, rax
shr r15, 0x3f
mov rcx, rbx
call fcn.140101410
cmp r15d, 0xf5847b79
ja 0x1400fdc14
nop word cs:[rax + rax]
mov eax, dword [0x141f38c08]
xor edx, edx
div dword [0x141f38c0c]
add eax, 0xeab719b0
or eax, 0xf6509e38
cmp eax, 0x4b49a3f5
je 0x1400fdbf0
jmp 0x1400fda9d
mov rcx, rbx
call fcn.140101410
jmp 0x1400fdbb3
mov r13d, dword [0x141f38c40]
or r13d, dword [0x141f38c44]
or r13d, 0x12792026
and r13d, 0x1a7b202e
mov rcx, r14
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
lock dec qword [rdi + 0x18]
cmp r13d, 0xa9f8e0e
jb 0x1400fdd30
mov eax, dword [0x141f38c48]
xor eax, dword [0x141f38c4c]
imul eax, eax, 0xe69b0660
or eax, 0xd4d56c2e
cmp eax, 0x122a2ad4
jae 0x1400fdc80
xor eax, eax
xchg byte [rbx], al
nop dword [rax]
mov eax, dword [0x141f38c50]
xor edx, edx
div dword [0x141f38c54]
imul ecx, eax, 0xa8a76ada
or ecx, 0x4b1ecb3e
and ecx, 0x7fbfef7e
mov eax, 0
xchg byte [rbx], al
cmp ecx, 0x144f95d0
je 0x1400fdc80
nop
mov ecx, dword [0x141f38c58]
sub ecx, dword [0x141f38c5c]
xor ecx, 0x801208
or ecx, 0xed5facf7
cmp ecx, 0x21732dda
je 0x1400fdcb0
cmp al, 2
jne 0x1400fdce0
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
nop dword [rax]
mov eax, dword [0x141f38c60]
sub eax, dword [0x141f38c64]
and eax, 0x7cdc07da
imul rax, rax, 0x25604195
shr rax, 0x3a
or eax, 0x4a8d7051
cmp eax, 0x864b0c10
ja 0x1400fdce0
test r15b, r15b
je 0x1400fda00
cmp esi, 1
mov esi, 1
jne 0x1400fda00
jmp 0x1400fdd50
mov rcx, r14
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
lock dec qword [rdi + 0x18]
jmp 0x1400fdc20
mov eax, dword [str.dib]
imul eax, dword [0x141f38c6c]
imul eax, eax, 0x60a7242f
add eax, 0xefe4ad1e
xor eax, 0x98501481
cmp eax, 0xbc2bee5
jb 0x1400fdd50
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2