Function at 0x140025755
Capabilities:
Decode data using base64 via winapi
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
movaps xmmword [rsp + 0x170], xmm6
mov rax, r9
mov rbx, rdx
mov rdi, rcx
xor ecx, ecx
lea r9, [rsp + 0x100]
mov dword [r9 + 0x20], ecx
mov word [r9 + 0x24], 0
mov dword [r9 + 0x14], ecx
xorps xmm6, xmm6
movaps xmmword [r9], xmm6
mov qword [r9 + 0x18], 7
mov byte [r9 + 0x20], 1
lea rsi, [rsp + 0xa0]
mov rcx, rsi
mov rdx, r8
mov r8, rax
call fcn.1400893b8
cmp dword [rsi], 1
mov r14, qword [rsi + 8]
jne 0x1400257e4
mov rax, qword [rsp + 0xb0]
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], rax
movaps xmm0, xmmword [0x1400988e0]
movups xmmword [rdi], xmm0
jmp 0x140025e74
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x70], rdi
xor eax, eax
mov qword [rsp + 0x60], rax
mov eax, 0x2000
mov qword [rsp + 0x80], rax
mov ecx, 0x2000
xor edx, edx
call fcn.14000d520
mov r13, rax
mov rax, qword [0x14043e3f8]
lea rcx, [rsp + 0x48]
mov qword [rcx], rax
movups xmmword [rcx + 8], xmm6
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r13
mov qword [rsp + 0xb0], 0x2000
movups xmmword [rsp + 0xb8], xmm6
mov qword [rsp + 0xc8], 0
xor eax, eax
mov qword [rsp + 0x68], rax
xor r15d, r15d
xor ebx, ebx
xor eax, eax
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0xd8]
movups xmmword [rax], xmm6
mov rax, qword [0x14043e3f8]
mov qword [rsp + 0xd0], rax
xor r12d, r12d
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x80]
cmp rcx, rax
mov esi, 0xffffffff
cmovb esi, ecx
cmp rbx, r15
jb 0x140025956
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, r13
mov r8d, esi
lea r9, [rsp + 0x44]
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x140025960
call qword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
mov rax, rdi
shl rax, 0x20
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], 0
mov dword [rsp + 0x100], 1
mov ecx, edi
call fcn.140084604
cmp al, 0xb
je 0x140025973
mov rbp, rdi
shl rbp, 0x20
mov qword [rsp + 0xf0], rbp
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0xe8], 1
mov ecx, edi
call fcn.140084604
cmp al, 0x23
jne 0x140025a59
lea rcx, [rsp + 0xf0]
call fcn.140001eb0
jmp 0x14002589f
cmp r15, rbx
jae 0x1400259a2
jmp 0x140025e90
mov r15d, dword [rsp + 0x44]
mov rax, qword [rsp + 0x68]
cmp rax, r15
cmovbe rax, r15
jmp 0x140025988
lea rcx, [rsp + 0x108]
call fcn.140001eb0
xor r15d, r15d
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xc0], r15
mov rcx, rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0xc8], rax
xor ebx, ebx
cmp r15, qword [rsp + 0x80]
ja 0x140025e90
lea rdi, [rbx + r13]
mov rsi, r15
sub rsi, rbx
cmp rsi, 0x10
jae 0x1400259dc
xor edx, edx
test rsi, rsi
je 0x1400259d8
cmp byte [rdi + rdx], 0xa
je 0x1400259ee
inc rdx
cmp rsi, rdx
jne 0x1400259c7
mov rdx, rsi
xor ebp, ebp
jmp 0x1400259f3
mov cl, 0xa
mov rdx, rdi
mov r8, rsi
call fcn.14001b051
mov rbp, rax
jmp 0x1400259f3
mov ebp, 1
test rbp, rbp
je 0x140025a11
cmp rdx, 0xffffffffffffffff
je 0x140025e90
cmp rdx, rsi
jae 0x140025e90
inc rdx
mov rsi, rdx
lea r8, [rdi + rsi]
lea rcx, [rsp + 0xd0]
mov rdx, rdi
call fcn.140016677
add rbx, rsi
cmp rbx, r15
cmova rbx, r15
mov qword [rsp + 0xb8], rbx
add r12, rsi
test rbp, rbp
jne 0x140025a48
test rsi, rsi
jne 0x140025887
mov ebp, 0x1502
xor r14d, r14d
lea rdi, [0x14009b998]
jmp 0x140025a61
mov r14b, 1
xor edi, edi
mov r12, rbp
mov r15, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xe0]
lea r13, [rsp + 0x100]
mov rcx, r13
mov rdx, r15
mov r8, rsi
call fcn.14001c0d5
cmp qword [rsp + 0x100], 0
setne bl
mov rax, qword [rsp + 0x60]
cmovne rsi, rax
cmove rdi, rax
cmove rbp, r12
mov qword [rsp + 0xe0], rsi
or bl, r14b
jne 0x140025d5c
test rbp, rbp
je 0x140025d6c
test rsi, rsi
je 0x140025af3
cmp byte [r15 + rsi - 1], 0xa
lea r12, [rsp + 0xe8]
mov rbp, qword [rsp + 0x78]
jne 0x140025b0c
mov rax, rsi
dec rax
je 0x140025b07
lea rcx, [rsi - 2]
cmp byte [r15 + rsi - 2], 0xd
cmove rax, rcx
mov rsi, rax
jmp 0x140025b0c
mov rsi, qword [rsp + 0x60]
lea r12, [rsp + 0xe8]
mov rbp, qword [rsp + 0x78]
jmp 0x140025b0c
mov rsi, qword [rsp + 0x60]
mov r15, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xd8]
mov qword [rsp + 0x20], 8
mov rcx, r13
mov rdx, r15
mov r8, rsi
lea r9, [0x14009b8dc]
call fcn.14001c305
mov rcx, r12
mov rdx, r13
call fcn.140025eca
mov rdi, qword [rsp + 0xe8]
mov rax, qword [rsp + 0x50]
sub rax, rbp
cmp rax, rsi
jb 0x140025d42
mov rcx, qword [rsp + 0x48]
add rcx, rbp
mov rdx, r15
mov r8, rsi
call fcn.1400931b0
add rbp, rsi
mov qword [rsp + 0x58], rbp
test rbx, rbx
je 0x140025b8f
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r15
call sub.kernel32.dll_HeapFree
cmp rbp, qword [rsp + 0x50]
jne 0x140025bad
lea rcx, [rsp + 0x48]
mov rdx, rbp
call fcn.140016628
mov r8, qword [rsp + 0x58]
mov rbp, r8
jmp 0x140025bb2
mov r8, qword [rsp + 0x58]
inc r8
mov rdx, qword [rsp + 0x48]
mov byte [rdx + rbp], 0xa
mov qword [rsp + 0x58], r8
test rdi, rdi
mov qword [rsp + 0x98], r15
mov qword [rsp + 0x90], rbx
je 0x140025cfb
mov rcx, r13
call fcn.14001c0d5
cmp dword [rsp + 0x100], 1
je 0x140025ddd
mov rsi, qword [rsp + 0x110]
mov rax, rsi
shr rax, 0x20
jne 0x140025e90
mov rbp, qword [rsp + 0x108]
mov dword [rsp + 0xe8], 0
movups xmmword [rsp + 0x28], xmm6
mov qword [rsp + 0x20], r12
mov rcx, rbp
mov edx, esi
xor r8d, r8d
xor r9d, r9d
call sub.crypt32.dll_CryptStringToBinaryA
cmp eax, 1
jne 0x140025df6
mov ebx, dword [rsp + 0xe8]
mov rcx, rbx
mov dl, 1
call fcn.14000d520
mov rdi, rax
mov r14, rdx
movups xmmword [rsp + 0x28], xmm6
mov qword [rsp + 0x20], r12
mov rcx, rbp
mov edx, esi
xor r8d, r8d
mov r9, rax
call sub.crypt32.dll_CryptStringToBinaryA
cmp eax, 1
jne 0x140025e00
mov ecx, 0x10001
mov rdx, rdi
mov r8d, ebx
call sub.crypt32.dll_CertCreateCertificateContext
test rax, rax
je 0x140025c96
mov rsi, rax
mov rbx, qword [rsp + 0x60]
jmp 0x140025ca7
call qword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
shl rsi, 0x20
mov ebx, 1
test r14, r14
je 0x140025cbd
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
test rbx, rbx
jne 0x140025e22
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rdi + 0x10]
cmp rdx, qword [rdi + 8]
jne 0x140025ce4
mov rcx, rdi
call fcn.14004af5a
mov rdx, qword [rdi + 0x10]
mov rax, qword [rdi]
mov qword [rax + rdx*8], rsi
inc qword [rdi + 0x10]
mov qword [rsp + 0x58], 0
xor r8d, r8d
mov rbx, qword [rsp + 0xb8]
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xa0]
mov r13, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], r8
jmp 0x14002586a
lea rcx, [rsp + 0x48]
mov rdx, rbp
mov r8, rsi
call fcn.1400949ca
mov rbp, qword [rsp + 0x58]
jmp 0x140025b5e
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x90], rdi
cmp qword [rsp + 0xd8], 0
je 0x140025d88
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r15
call sub.kernel32.dll_HeapFree
test bl, bl
je 0x140025db6
mov rax, qword [rsp + 0x70]
mov qword [rax + 8], 0
mov rcx, qword [rsp + 0x98]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rax + 0x18], rcx
jmp 0x140025e45
lea rcx, [rsp + 0xa0]
call fcn.140025e94
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x88]
mov qword [rax + 8], rcx
mov qword [rax], 0
jmp 0x140025e59
lea rdx, str.PEM_representation_contains_non_UTF_8_bytes
mov r8d, 0x2b
mov cl, 0x14
call fcn.1400831ac
mov rsi, rax
jmp 0x140025e24
call qword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
jmp 0x140025e1e
call qword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test r14, r14
je 0x140025e1e
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
shl rsi, 0x20
xor edx, edx
lea rcx, [rsp + 0x100]
mov qword [rcx], rsi
mov qword [rcx + 8], rdx
call fcn.140001eb0
mov rax, qword [rsp + 0x70]
mov qword [rax + 8], 2
mov qword [rax], 1
lea rcx, [rsp + 0xa0]
call fcn.140025e94
cmp qword [rsp + 0x50], 0
je 0x140025e74
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
movaps xmm6, xmmword [rsp + 0x170]
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2