Function at 0x140001cc0
Capabilities:
Decode data using base64 via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rdi, qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
xor r9d, r9d
mov r8d, 1
lea rbp, [rsp + 0x60]
lea r13, [rsp + 0x4c]
mov rbx, rcx
mov rsi, rdx
mov rcx, qword [rdx]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r13
mov edx, dword [rdx + 8]
mov qword [rsp + 0x58], 0
mov byte [rsp + 0x60], 0
mov dword [rsp + 0x4c], 0
call rdi
test eax, eax
jne 0x140001d70
lea rax, [rbx + 0x10]
mov qword [rbx + 8], 0
mov qword [rbx], rax
mov byte [rbx + 0x10], 0
mov rcx, qword [rsp + 0x50]
cmp rcx, rbp
je 0x140001d59
mov rax, qword [rsp + 0x60]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov rax, rbx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r14d, dword [rsp + 0x4c]
test r14, r14
je 0x140001da0
mov rcx, r14
call sym.operator_new_unsigned_long_long_
mov r8, r14
mov byte [rax], 0
mov r12, rax
sub r8, 1
je 0x140001da3
lea rcx, [rax + 1]
xor edx, edx
call sub.msvcrt.dll_memset
jmp 0x140001da3
xor r12d, r12d
mov rcx, qword [rsi]
mov r9, r12
mov qword [rsp + 0x20], r13
mov r8d, 1
mov qword [rsp + 0x30], 0
lea r13, [rsp + 0x50]
mov qword [rsp + 0x28], 0
mov edx, dword [rsi + 8]
call rdi
test eax, eax
jne 0x140001e00
lea rax, [rbx + 0x10]
mov qword [rbx + 8], 0
mov qword [rbx], rax
mov byte [rbx + 0x10], 0
test r12, r12
je 0x140001d41
mov rdx, r14
mov rcx, r12
call sym.operator_delete_void__unsigned_long_long_
jmp 0x140001d41
mov rsi, qword [rsp + 0x50]
mov edi, dword [rsp + 0x4c]
mov r8, qword [rsp + 0x58]
cmp rsi, rbp
je 0x140001f10
mov rax, qword [rsp + 0x60]
cmp rax, rdi
jb 0x140001ec0
cmp r12, rsi
jb 0x140001e37
lea rax, [rsi + r8]
cmp rax, r12
jae 0x140002035
test rdi, rdi
je 0x140001e59
cmp rdi, 1
je 0x140001fa0
mov rcx, rsi
mov r8, rdi
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov rsi, qword [rsp + 0x50]
mov qword [rsp + 0x58], rdi
lea rdx, [rbx + 0x10]
mov byte [rsi + rdi], 0
mov rax, qword [rsp + 0x50]
mov qword [rbx], rdx
cmp rax, rbp
je 0x140001f58
mov qword [rbx], rax
mov rax, qword [rsp + 0x60]
mov qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x58]
mov qword [rbx + 8], rax
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], 0
mov byte [rsp + 0x60], 0
test r12, r12
je 0x140001d59
mov rdx, r14
mov rcx, r12
call sym.operator_delete_void__unsigned_long_long_
jmp 0x140001d41
lea r15, [rax + rax]
lea rcx, [r15 + 1]
cmp rdi, r15
jae 0x140001f48
lea r13, [rsp + 0x50]
call sym.operator_new_unsigned_long_long_
mov rsi, rax
test r12, r12
jne 0x140001f28
mov rcx, qword [rsp + 0x50]
cmp rcx, rbp
je 0x140001ef7
mov rax, qword [rsp + 0x60]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], r15
jmp 0x140001e59
mov r15d, 0x1e
cmp rdi, 0xf
jbe 0x140001e25
jmp 0x140001ec4
cmp rdi, 1
je 0x140002010
mov r8, rdi
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_memcpy
jmp 0x140001edf
lea rcx, [rdi + 1]
mov r15, rdi
jmp 0x140001ecd
mov rax, qword [rsp + 0x58]
lea rcx, [rax + 1]
cmp ecx, 8
jae 0x140001fb8
test cl, 4
jne 0x14000201c
test ecx, ecx
je 0x140001e88
movzx r8d, byte [rbp]
mov byte [rbx + 0x10], r8b
test cl, 2
je 0x140001e88
mov ecx, ecx
movzx r8d, word [rbp + rcx - 2]
mov word [rdx + rcx - 2], r8w
jmp 0x140001e88
movzx eax, byte [r12]
mov byte [rsi], al
mov rsi, qword [rsp + 0x50]
jmp 0x140001e59
mov r8, qword [rbp]
mov r11, rbp
mov qword [rbx + 0x10], r8
mov r8d, ecx
mov r9, qword [rbp + r8 - 8]
mov qword [rdx + r8 - 8], r9
lea r9, [rbx + 0x18]
and r9, 0xfffffffffffffff8
sub rdx, r9
add ecx, edx
sub r11, rdx
and ecx, 0xfffffff8
cmp ecx, 8
jb 0x140001e88
and ecx, 0xfffffff8
xor edx, edx
mov r8d, edx
add edx, 8
mov r10, qword [r11 + r8]
mov qword [r9 + r8], r10
cmp edx, ecx
jb 0x140001ff1
jmp 0x140001e88
movzx eax, byte [r12]
mov byte [rsi], al
jmp 0x140001edf
mov r8d, dword [rbp]
mov ecx, ecx
mov dword [rbx + 0x10], r8d
mov r8d, dword [rbp + rcx - 4]
mov dword [rdx + rcx - 4], r8d
jmp 0x140001e88
xor eax, eax
mov qword [rsp + 0x20], rdi
lea r13, [rsp + 0x50]
mov r9, r12
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rcx, r13
call sym.unk_2743
mov rsi, qword [rsp + 0x50]
jmp 0x140001e59