Function at 0x1800196e0
Capabilities:
Encode data using base64
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov dword [rsp + 8], ecx
push rbx
push r12
sub rsp, 0x98
imul eax, ecx, 0x510
mov r9, r8
mov r12d, ecx
mov dword [rsp + 0xc8], ecx
mov dword [rsp + 0x38], eax
cmp ecx, eax
ja 0x1800198ae
mov rbx, qword [rsp + 0xc8]
movabs r8, 0xaaaaaaaaaaaaaaab
mov qword [r11 - 0x18], rbp
mov rbp, qword [rsp + 0xc8]
mov qword [r11 - 0x20], rsi
mov rsi, qword [rsp + 0xc8]
mov qword [r11 - 0x28], rdi
mov rdi, qword [rsp + 0xc8]
mov qword [r11 - 0x30], r13
mov r13d, dword [rsp + 0xb0]
mov qword [r11 - 0x38], r14
mov r14, qword [rsp + 0xc8]
mov qword [r11 - 0x40], r15
mov r15, qword [rsp + 0x48]
nop
cmp r12d, 0x470
ja 0x180019ac3
je 0x180019a89
cmp r12d, 0x1e8
ja 0x180019901
je 0x1800198b9
mov eax, r12d
sub eax, 2
je 0x18001982c
sub eax, 0x2b
je 0x1800197f5
sub eax, 0x77
je 0x1800197ea
cmp eax, 0xa2
jne 0x180019869
mov qword [rsp + 0xc8], 2
mov r8d, 2
lea rax, [rsp + 0x40]
mov edx, 0xf0
mov r9, r15
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xc8]
call fcn.18002ccc0
jmp 0x18001984f
mov qword [rsp + 0x40], 0
jmp 0x180019869
mov rcx, qword [rdx + 0x10]
mov rax, r8
add rcx, 2
xor r8d, r8d
mul rcx
mov rcx, r9
shr rdx, 1
shl rdx, 2
call fcn.18003e420
mov rdx, qword [rsp + 0xb8]
mov rbp, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x180019857
mov rbp, qword [rdx]
jmp 0x180019857
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf6
call fcn.18000e210
mov r15, rax
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0xb8]
movabs r8, 0xaaaaaaaaaaaaaaab
mov r9, qword [rsp + 0xc0]
imul eax, dword [rsp + 0xb0], 0x51
add r12d, eax
mov dword [rsp + 0xc8], r12d
cmp r12d, dword [rsp + 0x38]
jbe 0x180019770
mov r14, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x90]
mov r15, qword [rsp + 0x68]
add rsp, 0x98
pop r12
pop rbx
ret
lea rax, [rsp + 0x40]
mov qword [rsp + 0xc8], 1
mov r9, r15
mov qword [rsp + 0x20], rax
mov edx, 0xf0
lea rcx, [rsp + 0xc8]
mov r8d, 1
call fcn.18002ccc0
mov r8d, 4
mov qword [rsp + 0xc8], 4
jmp 0x1800197c9
cmp r12d, 0x28a
je 0x180019991
cmp r12d, 0x32c
je 0x180019960
cmp r12d, 0x3ce
jne 0x180019869
cmp qword [rdi + 0x10], 0
jne 0x180019e69
cmp qword [rdi + 0x18], 0
je 0x180019869
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.DELETE_FROM_config_WHERE_id___1
call fcn.180042f40
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp qword [rdi + 8], 2
je 0x180019869
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.VmodlVimProfileComplianceProfile
call fcn.180042f40
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rax, [rsp + 0x40]
mov qword [rsp + 0xc8], 3
mov r9, r15
mov qword [rsp + 0x20], rax
mov edx, 0xf0
lea rcx, [rsp + 0xc8]
mov r8d, 3
call fcn.18002ccc0
mov r9d, 0x112
mov qword [rsp + 0xc8], 1
lea r8, [rsp + 0xc8]
mov rcx, r15
lea rdx, [rsp + 0x40]
call fcn.18003d920
mov rdi, qword [rsp + 0x40]
mov edx, 0xb9
mov eax, edx
sub eax, 0xb9
je 0x180019a4a
sub eax, 0x23
je 0x180019a42
sub eax, 0x5d
je 0x180019a12
sub eax, 0x23
je 0x180019a1a
cmp eax, 0x80
jne 0x180019a6a
mov rdi, rbx
jmp 0x18001984f
mov rcx, qword [rdi]
test rcx, rcx
je 0x180019a3d
mov rax, qword [r15]
test cl, 1
je 0x180019a2e
imul r14, rax
imul rax, rax
mov qword [r15], rax
shr qword [rdi], 1
mov rcx, qword [rdi]
jne 0x180019a22
mov rbx, r14
jmp 0x180019a6a
mov r14d, 1
jmp 0x180019a6a
test rdi, rdi
je 0x180019a68
nop
cmp qword [rdi + 8], 2
je 0x180019a81
jbe 0x180019a5f
mov rdi, qword [rdi + 0x10]
jmp 0x180019a63
mov rdi, qword [rdi + 0x18]
test rdi, rdi
jne 0x180019a50
xor ebx, ebx
sub edx, 0xffffff80
cmp edx, 0x339
jb 0x1800199f3
mov rdi, rbx
jmp 0x18001984f
mov rbx, rdi
jmp 0x18001984f
mov rdi, qword [rdi + 0x20]
test rdi, rdi
je 0x180019a9d
cmp qword [rdi + 8], 3
je 0x180019869
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str._1_unique_delta_disk_hierarchies
call fcn.180042f40
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp r12d, 0x6f8
ja 0x180019c01
je 0x180019bbc
cmp r12d, 0x512
je 0x180019b6a
cmp r12d, 0x5b4
je 0x180019b2a
cmp r12d, 0x656
jne 0x180019869
cmp qword [rdi + 0x10], 0
je 0x180019869
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.:MaxGeometryShaderStorageBlocks:
call fcn.180042f40
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp qword [rdi + 0x20], 0
jne 0x180019e8f
mov rdi, qword [rdi + 0x18]
cmp qword [rdi + 8], 4
je 0x180019869
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.VirtualMachineWindowsQuiesceSpec
call fcn.180042f40
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x180019eb5
cmp qword [rax + 8], 2
jne 0x180019eb5
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x180019b96
cmp qword [rax + 8], 4
je 0x180019869
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA
call fcn.180042f40
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp qword [rdi + 0x18], 0
jne 0x180019f01
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x180019edb
cmp qword [rax + 8], 3
jne 0x180019edb
lea r8, [rsp + 0xc8]
mov byte [rsp + 0xc8], 1
mov rdx, r15
mov ecx, 0xec
call fcn.180030880
jmp 0x180019847
cmp r12d, 0xe6a
je 0x180019e46
cmp r12d, 0x1ca7
je 0x180019d44
cmp r12d, 0x2ae4
jne 0x180019869
mov r9, qword [rsp + 0x50]
cmp r9, qword [rdx + 0x10]
jae 0x180019861
mov r12d, dword [rsp + 0x34]
mov r8d, 0xe1
mov r15d, dword [rsp + 0x30]
nop word [rax + rax]
mov eax, r8d
sub eax, 0xe1
je 0x180019cfe
sub eax, 0x54
je 0x180019ce2
sub eax, 0x54
je 0x180019c7c
cmp eax, 0x54
jne 0x180019d17
mov byte [rsi], 0x3d
inc rsi
jmp 0x180019d17
mov ecx, r12d
mov eax, r13d
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, eax
mov rax, qword [0x18005a200]
movzx ecx, byte [rcx + rax]
lea rax, [r9 + 1]
mov byte [rsi], cl
cmp rax, qword [rdx + 0x10]
jae 0x180019ccf
mov ecx, r13d
mov eax, r15d
and ecx, 0xf
shr eax, 6
lea ecx, [rax + rcx*4]
mov rax, qword [0x18005a200]
movzx edx, byte [rcx + rax]
mov byte [rsi + 1], dl
add rsi, 2
mov rdx, qword [rsp + 0xb8]
jmp 0x180019d17
mov dl, 0x3d
mov byte [rsi + 1], dl
add rsi, 2
mov rdx, qword [rsp + 0xb8]
jmp 0x180019d17
mov rax, qword [0x18005a200]
xor r15d, r15d
mov ecx, r12d
shr rcx, 2
movzx ecx, byte [rcx + rax]
mov byte [rsi], cl
inc rsi
jmp 0x180019d17
movzx r12d, byte [rbp]
lea rax, [r9 + 1]
cmp rax, qword [rdx + 0x10]
jae 0x180019d14
movzx r13d, byte [rbp + 1]
jmp 0x180019d17
xor r13d, r13d
add r8d, 0x54
cmp r8d, 0x231
jb 0x180019c50
mov dword [rsp + 0x30], r15d
mov r15, qword [rsp + 0x48]
mov dword [rsp + 0x34], r12d
mov r12d, dword [rsp + 0xc8]
jmp 0x180019857
mov rax, r8
mul qword [rdx + 0x10]
xor eax, eax
shr rdx, 1
mov qword [rsp + 0x50], rax
lea rcx, [rdx + rdx*2]
test rcx, rcx
je 0x180019e5c
dec rcx
mov rax, r8
mul rcx
shr rdx, 1
inc rdx
lea rax, [rdx + rdx*2]
mov qword [rsp + 0x50], rax
nop word [rax + rax]
mov r8d, pe_nt_image_headers64
mov eax, r8d
sub eax, 0x108
je 0x180019dda
sub eax, 0x39
je 0x180019db7
cmp eax, 0x39
jne 0x180019e14
movzx ecx, byte [rbp + 2]
mov rax, qword [0x18005a200]
and ecx, 0x3f
movzx ecx, byte [rcx + rax]
mov byte [rsi], cl
inc rsi
add rbp, 3
jmp 0x180019e14
movzx ecx, byte [rbp + 1]
movzx eax, byte [rbp + 2]
and ecx, 0xf
shr eax, 6
lea ecx, [rax + rcx*4]
mov rax, qword [0x18005a200]
movzx ecx, byte [rcx + rax]
mov byte [rsi], cl
inc rsi
jmp 0x180019e14
mov rax, qword [0x18005a200]
movzx ecx, byte [rbp]
shr rcx, 2
movzx ecx, byte [rcx + rax]
mov byte [rsi], cl
movzx ecx, byte [rbp]
movzx eax, byte [rbp + 1]
and ecx, 3
shl ecx, 4
shr eax, 4
add ecx, eax
mov rax, qword [0x18005a200]
movzx ecx, byte [rcx + rax]
mov byte [rsi + 1], cl
add rsi, 2
add r8d, 0x39
cmp r8d, 0x1b3
jb 0x180019d86
sub rdx, 1
jne 0x180019d80
mov rdx, qword [rsp + 0xb8]
movabs r8, 0xaaaaaaaaaaaaaaab
jmp 0x180019869
cmp qword [r9 + 0x18], 0x10
mov rsi, r9
jb 0x180019869
mov rsi, qword [r9]
jmp 0x180019869
mov rdx, qword [rsp + 0xb8]
jmp 0x180019869
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.VC_CL_Switch_Zc_referenceBinding
call fcn.180042f40
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.WGXERR_D3DI_INVALIDSURFACEDEVICE
call fcn.180042f40
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.define___WCHAR_MAX___2147483647
call fcn.180042f40
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.192_28_ALEF_WITH_WAVY_193_66
call fcn.180042f40
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.NALYZEPRAGMABORTVALUESVIRTUALIMI
call fcn.180042f40
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3