Function at 0x14000116c
Capabilities:
Encode data using base64

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x10], rax
movzx esi, word [r9 + 0x22]
mov r15, rdx
mov r13, qword [rbp + 0x90]
add esi, 0x40
and dword [rbp + 0xc], 0
mov rbx, rcx
mov edx, esi
mov ecx, 0x40
mov r14, r9
mov dword [rbp + 8], esi
mov r12d, r8d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
movups xmm0, xmmword [r14 + 0x20]
mov rdx, qword [r14 + 0x28]
mov rdi, rax
mov eax, 8
and dword [rdi + 0x20], 0
lea rcx, [rdi + 0x40]
and dword [rdi + 0x28], 0
movdqu xmmword [rdi + 0x10], xmm0
movzx r8d, word [rdi + 0x12]
mov qword [rdi + 0x18], rcx
mov dword [rdi], eax
mov qword [rdi + 4], rbx
mov dword [rdi + 0x24], eax
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0xc]
mov r9d, esi
mov qword [rsp + 0x30], rax
mov r8, rdi
lea rax, [rbp + 8]
mov edx, r12d
mov qword [rsp + 0x28], rax
mov rcx, r15
lea rax, [rbp]
mov qword [rsp + 0x20], rax
call qword [sym.imp.Secur32.dll_LsaCallAuthenticationPackage]
or rbx, 0xffffffffffffffff
mov r8, rbx
xor r15d, r15d
inc r8
cmp word [r13 + r8*2], r15w
jne 0x140001232
mov rax, qword [rbp]
mov rdx, r13
mov rcx, qword [rax + 0x10]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14000146f
lea rcx, str._n_n
call fcn.140001008
mov rax, qword [rbp]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, str.___Client_name___:__wZ__wZ_n
movups xmm0, xmmword [rax + 0x18]
mov rax, qword [rax + 0x10]
movdqu xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 8]
movdqu xmmword [rsp + 0x50], xmm1
call fcn.140001008
mov rax, qword [rbp]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, qword [rax]
movups xmm0, xmmword [rcx + 0x18]
movups xmm1, xmmword [rcx + 8]
lea rcx, str.___Service_name__:__wZ__wZ
movdqu xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.140001008
mov rax, qword [rbp]
lea rcx, [rsp + 0x60]
mov edx, 0x80
mov r14d, 1
movups xmm0, xmmword [rax]
mov esi, dword [rax + 0x88]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + rdx]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x70]
mov rax, qword [rax + rdx + 0x10]
movups xmmword [rcx + rdx - 0x10], xmm0
movups xmmword [rcx + rdx], xmm1
mov qword [rcx + rdx + 0x10], rax
lea rcx, [rsi + 2]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
shl rdx, 2
add rdx, r14
cmovb rdx, rbx
mov ecx, edx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r10d, r15d
mov r9, rax
mov r11b, r15b
mov r8d, r15d
mov edi, r15d
test esi, esi
je 0x140001459
mov rbx, qword [rbp - 0x10]
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov ecx, r10d
test r10d, r10d
je 0x1400013e6
sub ecx, r14d
je 0x1400013c5
cmp ecx, r14d
jne 0x1400013fe
movzx eax, byte [rbx]
mov r10d, r15d
shr rax, 6
movzx edx, r11b
and edx, 0xf
mov ecx, r8d
shl rdx, 2
add r8d, r14d
or rdx, rax
mov al, byte [rdx + r12]
mov byte [rcx + r9], al
movzx eax, byte [rbx]
and eax, 0x3f
mov al, byte [rax + r12]
mov byte [r8 + r9], al
jmp 0x1400013fb
movzx eax, byte [rbx]
mov r10d, 2
movzx edx, r11b
and edx, 3
shr rax, 4
shl rdx, 4
or rdx, rax
mov al, byte [rdx + r12]
jmp 0x1400013f4
movzx eax, byte [rbx]
mov r10d, r14d
shr rax, 2
mov al, byte [rax + r12]
mov ecx, r8d
mov byte [rcx + r9], al
add r8d, r14d
movzx r11d, byte [rbx]
add edi, r14d
add rbx, r14
mov edx, r8d
cmp edi, esi
jb 0x14000137d
mov r8d, edx
sub r10d, r14d
je 0x140001434
cmp r10d, r14d
jne 0x140001459
mov eax, r11d
lea r8d, [rdx + 1]
and eax, 0xf
mov al, byte [r12 + rax*4]
mov byte [rdx + r9], al
jmp 0x140001451
mov rax, r11
lea r8d, [rdx + 1]
and eax, 3
add rax, rax
mov al, byte [r12 + rax*8]
mov byte [rdx + r9], al
mov byte [r8 + r9], 0x3d
add r8d, r14d
mov byte [r8 + r9], 0x3d
add r8d, r14d
mov eax, r8d
lea rcx, str._n___Base64_Ticket_:_n_s_n
mov rdx, r9
mov byte [rax + r9], r15b
call fcn.140001008
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140001900
add rsp, 0x128
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret