Function at 0x140001290
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x48], rcx
xor ebp, ebp
mov dword [rsp + 0x48], ebp
mov rcx, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x1400012d3
mov rcx, qword [rdx]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
mov r8d, 1
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
xorps xmm0, xmm0
mov r15d, dword [rsp + 0x48]
movdqu xmmword [rsp + 0x50], xmm0
mov r14, rbp
mov qword [rsp + 0x60], rbp
test r15, r15
je 0x140001375
cmp r15, 0x1000
jb 0x140001345
lea rcx, [r15 + 0x27]
cmp rcx, r15
jbe 0x140001500
call fcn.140003130
test rax, rax
je 0x1400014b9
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140001350
mov rcx, r15
call fcn.140003130
mov rbx, rax
mov qword [rsp + 0x50], rbx
lea r14, [rbx + r15]
mov qword [rsp + 0x60], r14
mov r8, r15
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov r12, r14
mov qword [rsp + 0x58], r14
jmp 0x14000137f
mov r12, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
cmp qword [rdi + 0x18], 0xf
jbe 0x140001389
mov rdi, qword [rdi]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, rbx
xor edx, edx
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rbp
mov edi, 0xf
mov qword [rsi + 0x18], rdi
cmp rbx, r12
jne 0x1400013d1
mov byte [rsi], 0
jmp 0x140001490
mov r15, r12
sub r15, rbx
movabs rax, 0x7fffffffffffffff
cmp r15, rax
ja 0x1400014f4
cmp r15, rdi
jbe 0x14000146a
mov rdi, r15
or rdi, 0xf
cmp rdi, rax
jbe 0x140001427
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140003130
test rax, rax
je 0x140001454
lea rbp, [rax + 0x27]
and rbp, 0xffffffffffffffe0
mov qword [rbp - 8], rax
jmp 0x140001463
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
je 0x140001463
cmp rcx, 0x1000
jb 0x14000145b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400014fa
jmp 0x14000140c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003130
mov rbp, rax
mov qword [rsi], rbp
mov qword [rsi + 0x18], rdi
mov rbp, rsi
cmp rdi, 0xf
jbe 0x140001476
mov rbp, qword [rsi]
sub r12, rbx
mov r8, r12
mov rdx, rbx
mov rcx, rbp
call sub.VCRUNTIME140.dll_memmove
mov qword [rsi + 0x10], r15
mov byte [r15 + rbp], 0
test rbx, rbx
je 0x1400014cb
sub r14, rbx
mov rax, rbx
cmp r14, 0x1000
jb 0x1400014c0
add r14, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400014c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r14
mov rcx, rbx
call fcn.14000316c
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140003110
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1400011b0
nop
call fcn.140001110
nop
call fcn.140001110
int3