Function at 0x180023910
Capabilities:
Encode data using base64
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa0
mov rsi, qword [rbp - 0x19]
xor edi, edi
imul eax, r9d, 0x7b1
mov r15d, r9d
mov r13d, r9d
mov dword [rbp + 7], r9d
mov r12, r8
mov r14, rdx
mov rbx, rcx
cmp r9d, eax
mov dword [rbp + 0xf], eax
mov r9, qword [rbp - 0x19]
mov qword [rbp - 0x21], r9
ja 0x180023dc4
mov r15, qword [rbp - 0x19]
cmp r13d, 0x7bc
ja 0x180023cd8
je 0x180023ccb
mov eax, r13d
sub eax, 0xb
je 0x180023cb4
sub eax, 0x2a
je 0x180023c1d
sub eax, 0x10
je 0x180023bfa
sub eax, 0x89
je 0x180023bf1
cmp eax, 0x1a
jne 0x180023da4
mov rcx, qword [r12 + 0x18]
inc rcx
mov qword [r12 + 0x18], rcx
mov rax, qword [rbx]
cmp qword [r12 + 0x20], rax
jb 0x180023a3d
mov ebx, 0xec
cmp ebx, 0xec
je 0x1800239ff
cmp ebx, 0x7250
je 0x1800239f3
cmp ebx, 0xe3b4
jne 0x180023a26
mov qword [r12 + 0x20], rdi
jmp 0x180023a26
mov qword [r12 + 8], rdi
mov qword [r12 + 0x30], rdi
jmp 0x180023a26
inc qword [r12 + 0x20]
test r14, r14
je 0x180023a21
mov rdx, qword [r14 + 0x20]
xor r9d, r9d
mov r8, r14
mov qword [rsp + 0x20], rdi
lea ecx, [r9 + 0x72]
call fcn.18002b930
mov qword [r12 + 0x18], rdi
add ebx, 0x7164
cmp ebx, 0x1542c
jbe 0x1800239d4
mov rbx, qword [rbp + 0x5f]
jmp 0x180023da4
cmp rcx, qword [r12 + 0x28]
jb 0x180023da4
mov ebx, 0x89
mov dword [rbp - 9], ebx
mov eax, ebx
sub eax, 0x89
je 0x180023bcd
cmp eax, 0x26
jne 0x180023bd2
mov rax, qword [r12 + 0x10]
cmp qword [r12 + 8], rax
jb 0x180023b5a
mov r13d, 0xfe
nop dword [rax]
mov eax, r13d
sub eax, 0xfe
je 0x180023b1e
cmp eax, 1
jne 0x180023b47
mov rcx, qword [r12]
lea rax, [r15*8]
mov qword [rsp + 0x28], rdi
lea rdx, [rbp - 0x11]
xor r9d, r9d
mov qword [rbp - 0x11], rax
xor r8d, r8d
mov dword [rsp + 0x20], 0xbf
call fcn.180020300
mov r14, rax
test rax, rax
je 0x180023e03
mov ebx, 0xc6
mov eax, ebx
sub eax, 0xc6
je 0x180023af4
sub eax, 1
je 0x180023aee
cmp eax, 1
jne 0x180023b0e
mov qword [r12 + 0x10], r15
jmp 0x180023b0e
mov qword [r12], r14
jmp 0x180023b0e
mov rax, qword [r12 + 8]
mov r8, r15
sub r8, rax
xor edx, edx
shl r8, 3
lea rcx, [r14 + rax*8]
call sub.VCRUNTIME140.dll_memset
inc ebx
cmp ebx, 0xc9
jb 0x180023ad4
mov r14, qword [rbp + 0x67]
jmp 0x180023b47
test r14, r14
je 0x180023b3b
mov rdx, qword [r14 + 0x20]
xor r9d, r9d
mov r8, r14
mov qword [rsp + 0x20], rdi
lea ecx, [r9 + 0x72]
call fcn.18002b930
mov r15, qword [r12 + 0x10]
add r15, 0x200
inc r13d
cmp r13d, 0x100
jb 0x180023a80
mov ebx, dword [rbp - 9]
mov rcx, qword [r12 + 8]
mov rax, qword [r12]
cmp qword [rax + rcx*8], rdi
jne 0x180023bc6
mov rax, qword [r12 + 0x28]
lea r9, [rbp - 0x11]
mov qword [rsp + 0x40], rdi
xor r8d, r8d
mov qword [rsp + 0x38], rdi
xor edx, edx
mov qword [rsp + 0x30], rdi
lea rcx, [rax + rax*2]
mov qword [rsp + 0x28], rdi
shl rcx, 3
mov qword [rbp - 0x11], rcx
mov ecx, 0xca
mov qword [rsp + 0x20], rdi
call fcn.18003b6f0
mov rcx, qword [r12]
mov rdx, qword [r12 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r12 + 8]
mov rax, qword [r12]
cmp qword [rax + rcx*8], rdi
je 0x180023e20
mov qword [r12 + 0x18], rdi
jmp 0x180023bd2
inc qword [r12 + 8]
add ebx, 0x26
mov dword [rbp - 9], ebx
cmp ebx, 0xd5
jb 0x180023a50
mov r13d, dword [rbp + 7]
mov rbx, qword [rbp + 0x5f]
jmp 0x180023da4
mov qword [rbp - 0x19], r14
jmp 0x180023da4
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
mov r8d, 0xf6
call fcn.18000e210
mov r9, rax
mov qword [rbp - 0x21], rax
jmp 0x180023da8
mov r8, qword [r14 + 0x88]
xor edx, edx
mov ecx, 0xa4
call fcn.18000c280
test eax, eax
je 0x180023c84
mov eax, 0x3f
nop dword [rax]
cmp eax, 0x3f
je 0x180023c6a
cmp eax, 0x29d6
jne 0x180023c78
mov rax, rsi
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test rbx, rbx
je 0x180023c75
mov dword [rbx], 1
mov rsi, rdi
add eax, 0x2997
cmp eax, 0x532e
jbe 0x180023c40
mov rax, qword [r12]
lea r8, [rbp - 0x11]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov rdx, rbx
mov qword [rbp - 0x11], rax
mov rcx, r14
mov dword [rsp + 0x20], 0xff
call fcn.18003c090
mov qword [rbp + 0x17], rax
jmp 0x180023da4
mov rax, qword [rbp + 0x7f]
mov rax, qword [rax]
mov qword [r14], rax
mov qword [r14 + 0x20], rdi
mov qword [r14 + 0x18], rdi
jmp 0x180023da4
mov rax, qword [r12]
mov qword [r14 + 0x10], rax
jmp 0x180023da4
cmp r13d, 0xf6d
je 0x180023d70
cmp r13d, 0x2544
je 0x180023d5b
cmp r13d, 0x4a53
je 0x180023d55
cmp r13d, 0x90d8
je 0x180023e4c
cmp r13d, 0xa320
jne 0x180023da4
mov eax, 0x90
nop word [rax + rax]
cmp eax, 0x90
je 0x180023e37
cmp eax, 0x6c90
jne 0x180023e3c
mov rax, qword [r12 + 0x18]
mov r8, qword [r12 + 8]
mov rdx, qword [r12]
lea rcx, [rax + rax*2]
mov rax, qword [rdx + r8*8]
lea rax, [rax + rcx*8]
jmp 0x180023c4f
mov rsi, qword [rbp + 0x17]
jmp 0x180023da4
mov r8, qword [r14 + 0x88]
xor edx, edx
mov ecx, 0x85
call fcn.180016510
jmp 0x180023da4
mov rax, qword [r12]
lea rdx, [rbp - 0x11]
mov qword [rsp + 0x28], rdi
lea rcx, [rbp + 7]
mov r9d, 0xef
mov qword [rbp + 7], rax
xor r8d, r8d
mov qword [rbp - 0x11], 8
mov qword [rsp + 0x20], rdi
call fcn.1800292f0
mov qword [r14 + 8], rax
mov r9, qword [rbp - 0x21]
imul eax, dword [rbp + 0x77], 0xb3
add r13d, eax
mov dword [rbp + 7], r13d
cmp r13d, dword [rbp + 0xf]
jbe 0x180023973
mov r15d, dword [rbp + 0x77]
lea r13d, [r15 + 0xb]
cmp r15d, r13d
jae case.0x180023e01.2
mov rbx, qword [rbp - 0x19]
lea rdx, [0x180000000]
mov r14, qword [rbp - 0x19]
add r15d, 0xfffffff5
cmp r15d, 0x77
ja case.0x180023e01.10
movzx eax, byte [rdx + r15 + 0x240f8]
mov ecx, dword [rdx + rax*4 + 0x240cc]
add rcx, rdx
jmp rcx
mov rax, qword [rbp + 0x7f]
test rax, rax
je 0x180023e12
mov dword [rax], 0x3d
mov rax, rdi
jmp 0x180023c4f
mov rax, qword [rbp + 0x7f]
test rax, rax
je 0x180023e12
mov dword [rax], 0x3e
mov rax, rdi
jmp 0x180023c4f
inc qword [r12 + 0x20]
add eax, 0x6c00
cmp eax, 0xd800
jbe 0x180023d20
mov rbx, qword [rbp - 0x19]
imul ecx, dword [rbx + 0xc], 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rbx + 8]
mov r9d, 0x102
mov dword [rbp + 0x77], eax
xor r8d, r8d
lea rax, [rbp + 0x77]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
call fcn.180028290
jmp 0x180023e50
mov rax, qword [rbp + 0x67]
mov rsi, qword [rax + 8]
jmp case.0x180023e01.10
lea rax, [rbp - 1]
mov qword [rbp - 1], rdi
mov edx, 0xf0
mov qword [rsp + 0x20], rax
mov r8d, 3
mov qword [rbp - 0x19], 3
lea rcx, [rbp - 0x19]
call fcn.18002ccc0
jmp 0x18002403e
mov rax, qword [rbp + 0x67]
cmp qword [rax + 8], rdi
je case.0x180023e01.2
jmp case.0x180023e01.10
mov rcx, qword [rbp + 0x7f]
mov r9d, 0x56
mov rax, qword [rbp + 0x5f]
xor r8d, r8d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov rax, qword [rax]
imul rax, qword [rcx]
mov rcx, qword [rbp + 0x67]
mov qword [rsp + 0x38], rdi
mov rdx, rcx
mov qword [rsp + 0x30], rdi
mov qword [rcx + 0x28], rax
mov rax, qword [rcx + 0x18]
xor ecx, ecx
mov qword [rbp - 0x19], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call fcn.180024170
test rax, rax
je case.0x180023e01.2
jmp 0x18002403e
mov rcx, qword [rbp + 0x67]
mov rax, qword [r12]
mov qword [rcx + 8], rax
jmp case.0x180023e01.10
lea rax, [rbp - 1]
mov qword [rbp - 0x19], 2
mov edx, 0xf0
mov qword [rsp + 0x20], rax
mov r8d, 2
lea rcx, [rbp - 0x19]
call fcn.18002ccc0
mov r9, qword [rbp - 0x21]
lea rax, [rbp - 1]
mov edx, 0xf0
mov qword [rsp + 0x20], rax
mov r8d, 1
mov qword [rbp - 0x19], 1
lea rcx, [rbp - 0x19]
call fcn.18002ccc0
mov rax, qword [rbp - 1]
test rax, rax
je 0x180023fb0
cmp qword [rax + 8], 2
je 0x18002403e
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str._s:_stream__u_out_of_bounds___u_
call fcn.180042f40
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp qword [rbp + 0x67], rdi
je 0x180023e12
jmp case.0x180023e01.10
lea r8, [rbp + 0x77]
mov byte [rbp + 0x77], 1
mov rdx, r9
mov ecx, 0xec
call fcn.180030880
mov r9, rax
mov qword [rbp - 0x21], rax
jmp 0x180024042
mov r8, qword [rbp - 1]
mov edx, 0xb9
nop dword [rax]
mov eax, edx
sub eax, 0xb9
je 0x18002408e
sub eax, 0x23
je 0x180024086
sub eax, 0x5d
je 0x18002402f
sub eax, 0x23
je 0x18002405e
cmp eax, 0x80
jne 0x1800240ae
mov r8, rbx
xor edx, edx
mov ecx, 0xb2
call fcn.18000c280
mov r9, qword [rbp - 0x21]
lea rdx, [0x180000000]
inc r15d
lea eax, [r15 + 0xb]
cmp eax, r13d
jb 0x180023de4
jmp case.0x180023e01.2
mov rcx, qword [r8]
test rcx, rcx
je 0x180024081
mov rax, qword [r9]
test cl, 1
je 0x180024072
imul r14, rax
imul rax, rax
mov qword [r9], rax
shr qword [r8], 1
mov rcx, qword [r8]
jne 0x180024066
mov rbx, r14
jmp 0x1800240ae
mov r14d, 1
jmp 0x1800240ae
test r8, r8
je 0x1800240ab
cmp qword [r8 + 8], 1
je 0x1800240c2
jbe 0x1800240a2
mov r8, qword [r8 + 0x10]
jmp 0x1800240a6
mov r8, qword [r8 + 0x18]
test r8, r8
jne 0x180024093
mov rbx, rdi
sub edx, 0xffffff80
cmp edx, 0x339
jb 0x180024010
jmp 0x18002402f
mov rbx, r8
jmp 0x180024032