Function at 0x47bd30
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de516
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x520404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 0
push eax
push 0
push 1
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
mov dword [ebp - 0x14], 0
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call fcn.004782d0
mov ecx, eax
test ecx, ecx
je 0x47bfed
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ebx, dword [ebp + 8]
add eax, 0x10
mov dword [ebx], eax
mov esi, dword [ebp - 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 1
test esi, esi
je 0x47bfc8
mov dword [ebp - 4], 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
cmp esi, 0x7fffffff
ja 0x47bff7
cmp esi, 0x1000
jb 0x47be10
lea eax, [esi + 0x23]
cmp eax, esi
jbe 0x47bffc
push eax
call fcn.004a7d07
add esp, 4
test eax, eax
je 0x47c015
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x47be1b
push esi
call fcn.004a7d07
add esp, 4
mov edi, eax
push esi
lea eax, [edi + esi]
mov dword [ebp - 0x2c], edi
push 0
push edi
mov dword [ebp - 0x24], eax
call fcn.004ac800
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
push edi
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test edi, edi
je 0x47bf37
mov esi, edi
lea ecx, [esi + 1]
lea ebx, [ebx]
mov al, byte [esi]
inc esi
test al, al
jne 0x47be60
sub esi, ecx
je 0x47bf37
mov eax, dword [ebx]
mov edx, edi
sub edx, eax
mov dword [ebp - 0x1c], edx
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x20], ecx
test esi, esi
js 0x47c001
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or eax, ecx
jge 0x47bea2
push esi
mov ecx, ebx
call fcn.0047cfb0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx]
cmp edx, dword [ebp - 0x20]
ja 0x47bee0
lea ecx, [eax + edx]
test eax, eax
jne 0x47bebd
call fcn.004b4a32
mov dword [eax], 0x16
jmp 0x47bf1c
test ecx, ecx
jne 0x47bece
call fcn.004b4a32
mov dword [eax], 0x16
jmp 0x47bf1c
cmp dword [eax - 8], esi
jb 0x47bf11
push esi
push ecx
push eax
call fcn.004ac280
add esp, 0xc
jmp 0x47bf21
mov ecx, dword [eax - 8]
test eax, eax
jne 0x47bef4
call fcn.004b4a32
mov dword [eax], 0x16
jmp 0x47bf1c
cmp ecx, esi
jb 0x47bf05
push esi
push edi
push eax
call fcn.004ac280
add esp, 0xc
jmp 0x47bf21
push ecx
push 0
push eax
call fcn.004ac800
add esp, 0xc
call fcn.004b4a32
mov dword [eax], 0x22
call fcn.004af44f
mov eax, dword [ebx]
cmp esi, dword [eax - 8]
jg 0x47c001
mov dword [eax - 0xc], esi
mov eax, dword [ebx]
mov byte [esi + eax], 0
jmp 0x47bf85
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
lea edx, [eax - 0x10]
mov esi, dword [edx]
je 0x47bf85
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
jge 0x47bf65
cmp dword [eax - 8], 0
jl 0x47c00b
mov dword [eax - 0xc], 0
mov eax, dword [ebx]
mov byte [eax], 0
jmp 0x47bf85
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x47bf79
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
test edi, edi
je 0x47bfc1
mov ecx, dword [ebp - 0x24]
sub ecx, edi
cmp ecx, 0x1000
jb 0x47bfac
mov edx, dword [edi - 4]
add ecx, 0x23
sub edi, edx
lea eax, [edi - 4]
cmp eax, 0x1f
ja 0x47c015
mov edi, edx
push ecx
push edi
call fcn.004a7d37
add esp, 8
jmp 0x47bfc1
mov dword [ebp - 4], 0
push 0x4f889b
push 0x4e5ae4
mov ecx, ebx
call fcn.0047d050
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00477ec0
call fcn.0040b480
call fcn.004088e0
push 0x80070057
call fcn.00477ec0
push 0x80070057
call fcn.00477ec0
call fcn.004af45f
int3