Function at 0x140002220
Capabilities:
Encode data using base64
Encode data using xor
Generate random numbers using a mersenne twister
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1390]
mov eax, 0x1490
call fcn.1400b7800
sub rsp, rax
mov rax, qword [0x1400e20c0]
xor rax, rsp
mov qword [rbp + 0x1380], rax
mov rsi, rcx
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x40], rcx
xor ebx, ebx
mov dword [rsp + 0x70], ebx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], bl
mov r12d, 1
mov dword [rsp + 0x70], r12d
xor edx, edx
mov cl, 0x30
call fcn.140001cc0
mov byte [rsp + 0x20], al
mov edx, r12d
mov cl, Ordinal_50
call fcn.140001cc0
mov byte [rsp + 0x21], al
lea edx, [rbx + 2]
mov cl, reloc.WLDAP32.dll_Ordinal_50
call fcn.140001cc0
mov byte [rsp + 0x22], al
lea edx, [rbx + 3]
mov cl, 0x33
call fcn.140001cc0
mov byte [rsp + 0x23], al
lea edx, [rbx + 4]
mov cl, 0x34
call fcn.140001cc0
mov byte [rsp + 0x24], al
lea edx, [rbx + 5]
mov cl, 0x35
call fcn.140001cc0
mov byte [rsp + 0x25], al
lea edx, [rbx + 6]
mov cl, 0x36
call fcn.140001cc0
mov byte [rsp + 0x26], al
lea edx, [rbx + 7]
mov cl, 0x37
call fcn.140001cc0
mov byte [rsp + 0x27], al
lea edx, [rbx + 8]
mov cl, gethostname
call fcn.140001cc0
mov byte [rsp + 0x28], al
lea edx, [rbx + 9]
mov cl, reloc.WS2_32.dll_gethostname
call fcn.140001cc0
mov byte [rsp + 0x29], al
lea edx, [rbx + 0xa]
mov cl, 0x41
call fcn.140001cc0
mov byte [rsp + 0x2a], al
lea edx, [rbx + 0xb]
mov cl, 0x42
call fcn.140001cc0
mov byte [rsp + 0x2b], al
lea edx, [rbx + 0xc]
mov cl, 0x43
call fcn.140001cc0
mov byte [rsp + 0x2c], al
lea edx, [rbx + 0xd]
mov cl, 0x44
call fcn.140001cc0
mov byte [rsp + 0x2d], al
lea edx, [rbx + 0xe]
mov cl, 0x45
call fcn.140001cc0
mov byte [rsp + 0x2e], al
lea edx, [rbx + 0xf]
mov cl, 0x46
call fcn.140001cc0
mov byte [rsp + 0x2f], al
lea edx, [rbx + 0x10]
mov cl, 0x47
call fcn.140001cc0
mov byte [rsp + 0x30], al
lea edx, [rbx + 0x11]
mov cl, 0x48
call fcn.140001cc0
mov byte [rsp + 0x31], al
lea edx, [rbx + 0x12]
mov cl, 0x49
call fcn.140001cc0
mov byte [rsp + 0x32], al
lea edx, [rbx + 0x13]
mov cl, 0x4a
call fcn.140001cc0
mov byte [rsp + 0x33], al
lea edx, [rbx + 0x14]
mov cl, 0x4b
call fcn.140001cc0
mov byte [rsp + 0x34], al
lea edx, [rbx + 0x15]
mov cl, 0x4c
call fcn.140001cc0
mov byte [rsp + 0x35], al
lea edx, [rbx + 0x16]
mov cl, 0x4d
call fcn.140001cc0
mov byte [rsp + 0x36], al
lea edx, [rbx + 0x17]
mov cl, Ordinal_79
call fcn.140001cc0
mov byte [rsp + 0x37], al
lea edx, [rbx + 0x18]
mov cl, reloc.WLDAP32.dll_Ordinal_79
call fcn.140001cc0
mov byte [rsp + 0x38], al
lea edx, [rbx + 0x19]
mov cl, 0x50
call fcn.140001cc0
mov byte [rsp + 0x39], al
lea edx, [rbx + 0x1a]
mov cl, 0x51
call fcn.140001cc0
mov byte [rsp + 0x3a], al
lea edx, [rbx + 0x1b]
mov cl, 0x52
call fcn.140001cc0
mov byte [rsp + 0x3b], al
lea edx, [rbx + 0x1c]
mov cl, 0x53
call fcn.140001cc0
mov byte [rsp + 0x3c], al
lea edx, [rbx + 0x1d]
mov cl, 0x54
call fcn.140001cc0
mov byte [rsp + 0x3d], al
lea edx, [rbx + 0x1e]
mov cl, 0x55
call fcn.140001cc0
mov byte [rsp + 0x3e], al
lea edx, [rbx + 0x1f]
mov cl, 0x56
call fcn.140001cc0
mov byte [rsp + 0x3f], al
lea edx, [rbx + 0x20]
mov cl, 0x57
call fcn.140001cc0
mov byte [rsp + 0x40], al
lea edx, [rbx + 0x21]
mov cl, 0x58
call fcn.140001cc0
mov byte [rsp + 0x41], al
lea edx, [rbx + 0x22]
mov cl, 0x59
call fcn.140001cc0
mov byte [rsp + 0x42], al
lea edx, [rbx + 0x23]
mov cl, 0x5a
call fcn.140001cc0
mov byte [rsp + 0x43], al
lea edx, [rbx + 0x24]
mov cl, 0x61
call fcn.140001cc0
mov byte [rsp + 0x44], al
lea edx, [rbx + 0x25]
mov cl, 0x62
call fcn.140001cc0
mov byte [rsp + 0x45], al
lea edx, [rbx + 0x26]
mov cl, 0x63
call fcn.140001cc0
mov byte [rsp + 0x46], al
lea edx, [rbx + 0x27]
mov cl, 0x64
call fcn.140001cc0
mov byte [rsp + 0x47], al
lea edx, [rbx + 0x28]
mov cl, 0x65
call fcn.140001cc0
mov byte [rsp + 0x48], al
lea edx, [rbx + 0x29]
mov cl, 0x66
call fcn.140001cc0
mov byte [rsp + 0x49], al
lea edx, [rbx + 0x2a]
mov cl, 0x67
call fcn.140001cc0
mov byte [rsp + 0x4a], al
lea edx, [rbx + 0x2b]
mov cl, 0x68
call fcn.140001cc0
mov byte [rsp + 0x4b], al
lea edx, [rbx + 0x2c]
mov cl, 0x69
call fcn.140001cc0
mov byte [rsp + 0x4c], al
lea edx, [rbx + 0x2d]
mov cl, 0x6a
call fcn.140001cc0
mov byte [rsp + 0x4d], al
lea edx, [rbx + 0x2e]
mov cl, 0x6b
call fcn.140001cc0
mov byte [rsp + 0x4e], al
lea edx, [rbx + 0x2f]
mov cl, 0x6c
call fcn.140001cc0
mov byte [rsp + 0x4f], al
lea edx, [rbx + 0x30]
mov cl, 0x6d
call fcn.140001cc0
mov byte [rsp + 0x50], al
lea edx, [rbx + 0x31]
mov cl, WSAGetLastError
call fcn.140001cc0
mov byte [rsp + 0x51], al
lea edx, [rbx + 0x32]
mov cl, reloc.WS2_32.dll_WSAGetLastError
call fcn.140001cc0
mov byte [rsp + 0x52], al
lea edx, [rbx + 0x33]
mov cl, reloc.WS2_32.dll_WSASetLastError
call fcn.140001cc0
mov byte [rsp + 0x53], al
lea edx, [rbx + 0x34]
mov cl, 0x71
call fcn.140001cc0
mov byte [rsp + 0x54], al
lea edx, [rbx + 0x35]
mov cl, WSAStartup
call fcn.140001cc0
mov byte [rsp + 0x55], al
lea edx, [rbx + 0x36]
mov cl, reloc.WS2_32.dll_WSAStartup
call fcn.140001cc0
mov byte [rsp + 0x56], al
lea edx, [rbx + 0x37]
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140001cc0
mov byte [rsp + 0x57], al
lea edx, [rbx + 0x38]
mov cl, 0x75
call fcn.140001cc0
mov byte [rsp + 0x58], al
lea edx, [rbx + 0x39]
mov cl, 0x76
call fcn.140001cc0
mov byte [rsp + 0x59], al
lea edx, [rbx + 0x3a]
mov cl, 0x77
call fcn.140001cc0
mov byte [rsp + 0x5a], al
lea edx, [rbx + 0x3b]
mov cl, 0x78
call fcn.140001cc0
mov byte [rsp + 0x5b], al
lea edx, [rbx + 0x3c]
mov cl, 0x79
call fcn.140001cc0
mov byte [rsp + 0x5c], al
lea edx, [rbx + 0x3d]
mov cl, 0x7a
call fcn.140001cc0
mov byte [rsp + 0x5d], al
lea edx, [rbx + 0x3e]
mov cl, reloc.WLDAP32.dll_Ordinal_33
call fcn.140001cc0
mov byte [rsp + 0x5e], al
lea edx, [rbx + 0x3f]
mov cl, 0x40
call fcn.140001cc0
mov byte [rsp + 0x5f], al
mov edi, 0x40
mov edx, edi
mov cl, reloc.WLDAP32.dll_Ordinal_35
call fcn.140001cc0
mov byte [rsp + 0x60], al
lea edx, [rbx + 0x41]
mov cl, 0x24
call fcn.140001cc0
mov byte [rsp + 0x61], al
lea edx, [rbx + 0x42]
mov cl, 0x25
call fcn.140001cc0
mov byte [rsp + 0x62], al
lea edx, [rbx + 0x43]
mov cl, 0x5e
call fcn.140001cc0
mov byte [rsp + 0x63], al
lea edx, [rbx + 0x44]
mov cl, 0x26
call fcn.140001cc0
mov byte [rsp + 0x64], al
lea edx, [rbx + 0x45]
mov cl, 0x2a
call fcn.140001cc0
mov byte [rsp + 0x65], al
xor eax, eax
mov byte [rsp + 0x66], al
mov r8d, ebx
nop
movsxd rax, r8d
lea rdx, [rsp + 0x20]
add rdx, rax
movsx eax, r8b
imul ecx, eax, 0x45
mov eax, Ordinal_46
sub al, cl
xor byte [rdx], al
inc r8d
cmp r8d, 0x46
jb 0x140002670
mov byte [rsp + 0x66], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
lea rax, [rsp + 0x20]
mov r14, 0xffffffffffffffff
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400026c0
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x38]
call fcn.140013320
nop
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov r15d, 0xffffffff
mov dword [rbp + 0x1374], r15d
mov dword [rbp - 0xc], eax
mov rcx, r12
nop dword [rax]
nop dword [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rbp + rcx*4 - 0xc], edx
inc rcx
cmp rcx, 0x270
jb 0x140002700
mov ebx, 0x270
mov dword [rbp - 0x10], ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x15
sub ecx, eax
add ecx, 0xa
mov dword [rsp + 0x74], ecx
lea rdx, [rbp - 0x38]
mov r9, qword [rbp - 0x38]
mov r10, qword [rbp - 0x20]
cmp r10, 0xf
cmova rdx, r9
mov rcx, qword [rbp - 0x28]
add rdx, rcx
mov qword [rbp - 0x78], rdx
lea r8, [rbp - 0x38]
cmp r10, 0xf
cmova r8, r9
mov qword [rsp + 0x78], r8
nop dword [rax]
lea rdi, [rdi - 1]
shr r14, 1
cmp r14, r15
ja 0x140002780
cmp r8, rdx
je 0x1400029ee
lea rax, [r8 + 1]
cmp rax, rdx
je 0x1400029ee
lea r15, [rdi - 1]
mov rcx, r12
sub rcx, r8
mov qword [rbp - 0x70], rcx
lea rax, [r12 + r8]
mov qword [rbp - 0x80], rax
lea r13, [rax + rcx]
nop dword [rax]
xor esi, esi
xor edi, edi
test r12, r12
je 0x14000297a
nop dword [rax]
mov rcx, r15
shl rsi, cl
add rsi, rsi
nop dword [rax]
cmp ebx, 0x270
jne 0x140002834
lea rax, [rbp - 8]
mov r9d, ebx
nop
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
btr r8d, 0x1f
xor r8d, dword [rax - 4]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
and edx, 0x9908b0df
xor edx, dword [rax + 0x630]
shr r8d, 1
xor edx, r8d
mov dword [rax + 0x9bc], edx
lea rax, [rax + 4]
sub r9, 1
jne 0x1400027f0
mov ebx, dword [rbp - 0x10]
jmp 0x140002922
cmp ebx, 0x4e0
jb 0x140002922
lea r9, [rbp + 0x9b4]
mov r11d, 0xe3
mov r10d, dword [rbp + 0x9b4]
nop dword [rax]
nop dword [rax + rax]
mov eax, r10d
mov r10d, dword [r9 + 4]
mov edx, eax
xor edx, r10d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
shr edx, 1
xor ecx, edx
mov dword [r9 - 0x9c0], ecx
lea r9, [r9 + 4]
sub r11, 1
jne 0x140002860
lea r9, [rbp + 0xd40]
mov r11d, 0x18c
mov r10d, dword [rbp + 0xd40]
mov eax, r10d
mov r10d, dword [r9 + 4]
mov edx, eax
xor edx, r10d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and ecx, 0x9908b0df
xor ecx, dword [r9 - 0xd4c]
shr edx, 1
xor ecx, edx
mov dword [r9 - 0x9c0], ecx
lea r9, [r9 + 4]
sub r11, 1
jne 0x1400028b0
mov edx, dword [rbp + 0x1370]
xor edx, dword [rbp - 0xc]
btr edx, 0x1f
xor edx, dword [rbp + 0x1370]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and ecx, 0x9908b0df
shr edx, 1
xor ecx, edx
xor ecx, dword [rbp + 0x624]
mov dword [rbp + 0x9b0], ecx
xor ebx, ebx
mov dword [rbp - 0x10], ebx
mov eax, ebx
mov ecx, dword [rbp + rax*4 - 0xc]
inc ebx
mov dword [rbp - 0x10], ebx
mov eax, ecx
shr eax, 0xb
and eax, dword [rbp + 0x1374]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cmp rax, r14
ja 0x1400027e0
or rsi, rax
mov rcx, r15
shl rdi, cl
add rdi, rdi
or rdi, r14
cmp rdi, r12
jb 0x1400027d0
xor edx, edx
mov rax, rdi
div r13
mov rcx, rax
xor edx, edx
mov rax, rsi
div r13
cmp rax, rcx
jb 0x1400029a3
xor edx, edx
mov rax, rdi
div r13
cmp rdx, r12
jne 0x1400027c0
xor edx, edx
mov rax, rsi
div r13
mov r8, qword [rsp + 0x78]
cmp rdx, r12
je 0x1400029c9
mov r9, qword [rbp - 0x80]
movzx ecx, byte [r9]
movzx eax, byte [rdx + r8]
mov byte [r9], al
mov byte [rdx + r8], cl
inc r12
lea rax, [r12 + r8]
cmp rax, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x70]
jne 0x1400027b0
mov r10, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
mov r9, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x68]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
movsxd r8, dword [rsp + 0x74]
cmp rcx, r8
cmovb r8, rcx
lea rdx, [rbp - 0x38]
cmp r10, 0xf
cmova rdx, r9
lea rcx, [rbp - 0x60]
call fcn.140013320
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.140011ad0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140002a69
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6ac0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140002aa7
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002aa2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002aa2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6ac0
mov rax, rsi
mov rcx, qword [rbp + 0x1380]
xor rcx, rsp
call fcn.1400b6aa0
lea r11, [rsp + 0x1490]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret