Function at 0x18000d550
Capabilities:
Encode data using base64
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x90
mov r10, r9
mov r13, r8
mov rsi, rdx
mov eax, ecx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x11], xmm0
xor ebx, ebx
mov qword [rbp - 1], rbx
mov r15d, ecx
lea edx, [rcx + 0xc]
mov dword [rbp - 0x3d], edx
lea r9, [0x180000000]
movzx r8d, byte [rbp + 0x5f]
mov byte [rbp - 0x41], r8b
cmp ecx, edx
jae 0x18000d8ec
lea r14d, [rcx - 0xae]
mov r12d, dword [rbp + 0x5f]
mov eax, dword [rbp + 0x5f]
mov dword [rbp - 0x39], eax
mov eax, edx
cmp r14d, 0x3d
ja case.default.0x18000d5e0
movzx eax, byte [r9 + r14 + 0xdce0]
mov ecx, dword [r9 + rax*4 + 0xdcb0]
add rcx, r9
jmp rcx
mov rax, qword [rbp + 0x7f]
mov ecx, dword [rax]
mov eax, dword [r10]
cmp ecx, eax
cmovg eax, ecx
mov dword [rbp - 0x31], eax
jmp case.0x18000d5e0.11
mov rax, qword [r10]
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x19], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 0x8a
mov r8, qword [0x1801d8150]
mov rdx, qword [rbp + 0x7f]
lea rcx, [rbp - 0x31]
call fcn.18011a4a0
mov qword [rbp - 0x31], rax
jmp 0x18000d881
test r12d, r12d
jne 0x18000d8b0
mov ecx, 0xe
nop dword [rax]
cmp ecx, 0xe
je 0x18000d653
cmp ecx, 0xab8
je case.0x18000d934.6
jmp 0x18000d65b
mov eax, dword [r10]
sub eax, dword [rsi]
mov dword [rbp - 0x31], eax
add ecx, 0xaaa
cmp ecx, 0x1554
jbe 0x18000d640
jmp case.0x18000d5e0.11
mov edx, 0xffffffff
mov dword [rbp - 0x39], edx
mov eax, dword [rbp - 0x3d]
jmp 0x18000d88e
mov rdi, qword [rbp + 0x7f]
cmp rdi, r13
je 0x18000d8c0
mov r8, qword [r10]
cmp r8, qword [rsi]
cmovae r8, qword [rsi]
mov rdx, r13
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
mov r12d, eax
jmp 0x18000d881
lea rcx, str.foreground_red
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x18000d881
mov dword [rbp - 0x29], ebx
mov r8d, 0x11e
lea rdx, [rbp - 0x29]
mov rcx, rax
call fcn.1800647c0
test eax, eax
jne 0x18000d881
mov edi, 0x90
mov eax, edi
sub eax, 0x90
je 0x18000d764
sub eax, 1
je 0x18000d74e
sub eax, 1
je 0x18000d72e
sub eax, 1
je 0x18000d717
cmp eax, 1
jne 0x18000d776
mov rax, qword [rbp + 0x7f]
mov rcx, qword [rax]
mov rax, qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov qword [rcx + 0x170], rax
jmp case.0x18000d934.6
mov rax, qword [rbp + 0x7f]
mov rcx, qword [rax]
mov rax, qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rcx + 0x168], rax
jmp 0x18000d776
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rcx]
mov dword [rax], 1
mov rcx, qword [rcx]
mov rax, qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rcx + 0x160], rax
jmp 0x18000d776
xor edx, edx
mov r8d, 0x178
mov rax, qword [rbp + 0x7f]
mov rcx, qword [rax]
call sub.VCRUNTIME140.dll_memset
jmp 0x18000d776
mov ecx, 0x178
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [rbp + 0x7f]
mov qword [rcx], rax
inc edi
cmp edi, 0x95
jb 0x18000d6e0
jmp 0x18000d881
mov rax, qword [0x1801d8150]
mov ecx, dword [rax]
test ecx, ecx
je case.0x18000d5e0.11
cmp ecx, 2
je 0x18000d8d0
mov edi, 0x27
cmp edi, 0x27
je 0x18000d7bb
cmp edi, 0xca
je case.0x18000d934.6
jmp 0x18000d7d7
mov rdx, qword [r10]
mov rcx, qword [rbp + 0x7f]
mov rax, qword [0x1801d8150]
call qword [rax + 0x170]
mov qword [rbp - 0x31], rax
mov r10, qword [rbp + 0x77]
add edi, 0xa3
cmp edi, 0x16d
jb 0x18000d7a8
jmp 0x18000d881
mov qword [rsp + 0x20], rbx
mov r9d, 0xf4
lea r8, [rbp - 0x11]
mov rdi, qword [rbp + 0x7f]
mov rdx, rdi
xor ecx, ecx
call fcn.18000cfb0
test al, al
jne 0x18000d834
mov eax, 0x93
cmp eax, 0x93
je 0x18000d824
cmp eax, 0x54fc
je case.0x18000d934.6
jmp 0x18000d828
mov byte [rbp - 0x31], 0
add eax, 0x5469
cmp eax, 0xa8d2
jbe 0x18000d810
mov edx, 0xffffffff
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x18000d881
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x54]
call fcn.18009d150
mov rcx, qword [rbp + 0x7f]
mov qword [rcx], rax
jmp 0x18000d881
mov rdi, qword [rbp + 0x7f]
lea rcx, [rdi + 0x18]
lea rdx, [rbp - 0x11]
call fcn.180004c10
mov byte [rbp - 0x41], al
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea r9, [0x180000000]
mov eax, dword [rbp - 0x3d]
mov edx, dword [rbp - 0x39]
inc r15d
inc r14d
mov r10, qword [rbp + 0x77]
cmp r15d, eax
jb 0x18000d5c2
mov eax, dword [rbp + 0x5f]
movzx r8d, byte [rbp - 0x41]
jmp 0x18000d8f2
mov dword [rbp - 0x31], r12d
jmp case.0x18000d934.6
mov dword [rbp - 0x31], ebx
jmp case.0x18000d934.6
mov rdx, qword [r10]
mov rcx, qword [rbp + 0x7f]
mov rax, qword [0x1801d8150]
call qword [rax + 0x170]
mov rbx, rax
jmp 0x18000dc10
mov edx, dword [rbp + 0x5f]
mov dword [rbp - 0x39], edx
cmp eax, dword [rbp - 0x3d]
jae case.0x18000d934.6
lea edi, [rax - 0xba]
mov dword [rbp - 0x29], edi
mov r15, qword [rbp - 0x19]
mov r12d, dword [rbp + 0x5f]
mov esi, dword [rbp + 0x5f]
mov r14d, dword [rbp + 0x5f]
mov r13d, dword [rbp + 0x5f]
mov eax, dword [rbp - 0x3d]
nop word [rax + rax]
cmp edi, 0x1c
ja case.default.0x18000d934
mov ecx, dword [r9 + rdi*4 + 0xdd20]
add rcx, r9
jmp rcx
mov rax, qword [rbp + 0x7f]
lea rdi, [rax + 0x18]
lea rcx, [rbp - 0x11]
cmp rdi, rcx
je 0x18000d976
mov rcx, rdi
call fcn.18001bae0
mov rax, qword [rbp - 0x11]
mov qword [rdi], rax
mov rax, qword [rbp - 9]
mov qword [rdi + 8], rax
mov rax, qword [rbp - 1]
mov qword [rdi + 0x10], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], rbx
mov rax, qword [rbp + 0x7f]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [rbp - 0x39]
mov edi, dword [rbp - 0x29]
movzx r8d, byte [rbp - 0x41]
jmp case.0x18000d934.7
mov qword [rbp - 0x19], rbx
mov dword [rsp + 0x28], 0xa5
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180142920
test eax, eax
je 0x18000dc10
mov edx, dword [rbp - 0x39]
movzx r8d, byte [rbp - 0x41]
jmp case.0x18000d934.7
lea rax, [rbp - 0x21]
mov qword [rbp + 7], rax
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop dword [rax]
dec rcx
shr rax, 1
cmp rax, 0x7fff
ja 0x18000d9e0
mov qword [rbp + 0x17], rax
mov qword [rbp + 0xf], rcx
lea r8, [rbp + 7]
mov rdx, qword [rbp - 9]
mov rcx, qword [rbp - 0x11]
call fcn.180003420
mov edx, 0xffffffff
mov rax, qword [rbp + 0x7f]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [rbp - 0x39]
movzx r8d, byte [rbp - 0x41]
jmp case.0x18000d934.7
mov r11, qword [rbp + 0x7f]
mov eax, dword [r11 + 0x18]
test eax, eax
jle case.0x18000d934.7
mov r9, rbx
mov edi, eax
mov ebx, dword [rbp - 0x1d]
nop
mov r8d, 0xe6
nop word [rax + rax]
cmp r8d, 0xe6
je 0x18000db0b
cmp r8d, 0x17c
je 0x18000dacc
cmp r8d, 0x212
jne 0x18000db34
cmp r14d, r13d
jb 0x18000da91
jne 0x18000db34
cmp r12d, edx
jb 0x18000da91
jne 0x18000db34
cmp esi, ebx
jae 0x18000db34
mov eax, 0xc
cmp eax, 0xc
je 0x18000dab7
cmp eax, 0x198
je 0x18000daae
cmp eax, 0x324
jne 0x18000dabb
mov r13d, r14d
jmp 0x18000dabb
mov dword [rbp - 0x39], r12d
mov dword [rbp - 0x1d], esi
jmp 0x18000dabb
mov qword [rbp - 0x19], r15
add eax, 0x18c
cmp eax, 0x4a4
jbe 0x18000da96
mov ebx, dword [rbp - 0x1d]
jmp 0x18000db34
mov ecx, dword [r15 + 4]
sub ecx, dword [r10 + 4]
mov eax, dword [r15]
sub eax, dword [r10]
imul eax, eax
imul ecx, ecx
add eax, ecx
cdq
mov r12d, eax
xor r12d, edx
sub r12d, edx
mov ecx, dword [r10 + 0x14]
test ecx, ecx
je 0x18000db03
mov eax, dword [r15 + 0x14]
sub eax, ecx
cdq
mov esi, eax
xor esi, edx
sub esi, edx
jmp 0x18000db34
mov esi, dword [r15 + 0x14]
not esi
jmp 0x18000db34
mov r15, qword [r11 + 0x10]
add r15, r9
mov eax, dword [r15 + 0x10]
add eax, dword [r15 + 0xc]
add eax, dword [r15 + 8]
sub eax, dword [r10 + 8]
sub eax, dword [r10 + 0x10]
sub eax, dword [r10 + 0xc]
cdq
mov r14d, eax
xor r14d, edx
sub r14d, edx
add r8d, 0x96
cmp r8d, 0x2a8
mov edx, dword [rbp - 0x39]
jb 0x18000da50
add r9, 0x18
sub rdi, 1
jne 0x18000da40
xor ebx, ebx
mov edi, dword [rbp - 0x29]
movzx r8d, byte [rbp - 0x41]
jmp case.0x18000d934.7
mov r13d, 0xffffffff
jmp case.0x18000d934.7
mov rax, qword [rbp - 0x19]
mov qword [rbp - 0x31], rax
jmp case.0x18000d934.7
test r8b, r8b
je case.0x18000d934.7
mov ecx, 0x24
mov eax, ecx
sub eax, 0x23
je case.0x18000d934.6
cmp eax, 1
jne 0x18000db94
mov byte [rbp - 0x31], al
dec ecx
cmp ecx, 0x22
ja 0x18000db81
jmp case.0x18000d934.7
mov dword [rbp - 0x1d], 0xffffffff
jmp case.0x18000d934.7
mov r11, qword [rbp + 0x7f]
mov rax, qword [r11 + 0x30]
test rax, rax
je case.0x18000d934.7
mov rcx, qword [r11 + 0x38]
call rax
mov edx, dword [rbp - 0x39]
movzx r8d, byte [rbp - 0x41]
jmp case.0x18000d934.7
mov r15, qword [rbp - 0x19]
mov eax, dword [rbp - 0x3d]
mov r10d, dword [rbp + 0x5f]
inc r10d
mov dword [rbp + 0x5f], r10d
inc edi
mov dword [rbp - 0x29], edi
cmp r10d, eax
jae case.0x18000d934.6
mov r10, qword [rbp + 0x77]
lea r9, [0x180000000]
jmp 0x18000d920
mov eax, 6
cmp eax, 6
je 0x18000dc00
cmp eax, 0x3f
je case.0x18000d934.6
jmp 0x18000dc04
mov byte [rbp - 0x31], 1
add eax, 0x39
cmp eax, 0x78
jb 0x18000dbf4
mov rbx, qword [rbp - 0x31]
mov rdi, qword [rbp - 0x11]
test rdi, rdi
je 0x18000dc91
mov rsi, qword [rbp - 9]
cmp rdi, rsi
je 0x18000dc37
mov rcx, rdi
call fcn.180004330
add rdi, 0x28
cmp rdi, rsi
jne 0x18000dc22
mov rdi, qword [rbp - 0x11]
mov rcx, qword [rbp - 1]
sub rcx, rdi
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rdi
cmp rdx, 0x1000
jb 0x18000dc89
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000dc89
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.18015bd10
mov rax, rbx
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret