Function at 0x140003d54
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Encode data using xor
Execute command

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov ebp, ecx
mov r12, rdx
mov ecx, 0x208
call fcn.1400bb920
mov r15, rax
mov word [rax], 0
mov word [rax + 2], 0
lea rax, [rax + 4]
lea rdx, [r15 + 0x208]
mov word [rax], 0
add rax, 2
cmp rdx, rax
jne 0x140003d8f
mov ecx, 0x618
call fcn.1400bb920
mov r14, rax
mov word [rax], 0
mov word [rax + 2], 0
lea rax, [rax + 4]
lea rdx, [r14 + 0x618]
mov word [rax], 0
add rax, 2
cmp rdx, rax
jne 0x140003dc0
cmp ebp, 1
jle 0x1400041e2
mov ebx, 1
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2e], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], r14
mov r14, rax
jmp 0x140003f35
mov word [rsp + 0x46], 0x15
mov word [rsp + 0x48], 0x5d
mov word [rsp + 0x4a], 0x55
mov word [rsp + 0x4c], 0x5d
mov word [rsp + 0x4e], 0x3c
lea rcx, [rsp + 0x46]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0xffffffffa0a0a0a1
shr rax, 0x20
add eax, edx
sar eax, 5
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x33
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x38]
xor word [rcx], ax
add edx, 1
add rcx, 2
cmp edx, 5
jne 0x140003e25
lea rdx, [rsp + 0x46]
mov rcx, qword [rdi]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140003e95
lea r13d, [rbx + 1]
cmp r13d, ebp
jge 0x140003e95
mov r8, qword [r12 + rsi + 8]
mov edx, 0x30b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.msvcrt.dll_wcscpy_s]
mov ebx, r13d
jmp 0x140003f2a
mov word [rsp + 0x50], 0x15
mov word [rsp + 0x52], 0x4b
mov word [rsp + 0x54], 0x5f
mov word [rsp + 0x56], 0x59
mov word [rsp + 0x58], 0x53
mov word [rsp + 0x5a], 0x52
mov word [rsp + 0x5c], 0x4a
mov word [rsp + 0x5e], 0x3f
lea rcx, [rsp + 0x50]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0xffffffffa0a0a0a1
shr rax, 0x20
add eax, edx
sar eax, 5
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x33
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x38]
xor word [rcx], ax
add edx, 1
add rcx, 2
cmp edx, 8
jne 0x140003ed7
lea rdx, [rsp + 0x50]
mov rcx, qword [rdi]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140003fe1
mov byte [rsp + 0x2e], 1
add ebx, 1
cmp ebp, ebx
jle 0x140004074
mov word [rsp + 0x3c], 0x15
mov word [rsp + 0x3e], 0x5d
mov word [rsp + 0x40], 0x55
mov word [rsp + 0x42], 0x4b
mov word [rsp + 0x44], 0x3c
lea rcx, [rsp + 0x3c]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0xffffffffa0a0a0a1
shr rax, 0x20
add eax, edx
sar eax, 5
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x33
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x38]
xor word [rcx], ax
add edx, 1
add rcx, 2
cmp edx, 5
jne 0x140003f62
movsxd rsi, ebx
shl rsi, 3
lea rdi, [r12 + rsi]
mov rdx, r14
mov rcx, qword [rdi]
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140003df8
lea r13d, [rbx + 1]
cmp r13d, ebp
jge 0x140003df8
mov r8, qword [r12 + rsi + 8]
mov edx, 0x103
mov rcx, r15
call qword [sym.imp.msvcrt.dll_wcscpy_s]
mov ebx, r13d
jmp 0x140003f2a
mov word [rsp + 0x64], 0x15
mov word [rsp + 0x66], 0x5c
mov word [rsp + 0x68], 0x42
mov word [rsp + 0x6a], 0x52
mov word [rsp + 0x6c], 0x48
mov word [rsp + 0x6e], 0x3d
lea rcx, [rsp + 0x64]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0xffffffffa0a0a0a1
shr rax, 0x20
add eax, edx
sar eax, 5
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x33
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x38]
xor word [rcx], ax
add edx, 1
add rcx, 2
cmp edx, 6
jne 0x140004015
lea rdx, [rsp + 0x64]
mov rcx, qword [rdi]
call sub.msvcrt.dll_wcscmp
test eax, eax
mov eax, 1
movzx edi, byte [rsp + 0x2f]
cmove edi, eax
mov byte [rsp + 0x2f], dil
jmp 0x140003f2a
mov r14, qword [rsp + 0x20]
mov rcx, r15
call sub.msvcrt.dll_wcslen
mov ebx, 0
cmp rax, 1
ja 0x1400041f1
mov rcx, r14
call sub.msvcrt.dll_wcslen
cmp rax, 2
jbe 0x1400040e5
mov ebx, 4
mov rdi, qword [0x14019df10]
mov rsi, rdi
mov rcx, r14
call qword [rdi + 0x198]
cmp eax, 0xffffffff
je 0x140004285
test al, 0x10
jne 0x14000428f
mov rcx, r14
call qword [rsi + 0x1a0]
mov ecx, 0x64
call qword [rsi + 0x218]
sub ebx, 1
jne 0x1400040ad
mov ebx, 1
mov rcx, r15
call fcn.1400bb8f0
mov rcx, r14
call fcn.1400bb8f0
cmp byte [rsp + 0x2e], 0
je 0x140004299
mov edx, 0
mov ecx, 6
mov rax, qword [0x14019df10]
call qword [rax + 0x2b8]
mov edx, eax
test eax, eax
jne 0x1400041d8
mov byte [rsp + 0x70], 0x4b
mov byte [rsp + 0x71], 0x51
mov byte [rsp + 0x72], 0x4f
mov byte [rsp + 0x73], 0x4f
mov byte [rsp + 0x74], 0x58
mov byte [rsp + 0x75], 0x52
mov byte [rsp + 0x76], 0x49
mov byte [rsp + 0x77], 0x51
mov byte [rsp + 0x78], 0x60
mov byte [rsp + 0x79], 0x6e
mov byte [rsp + 0x7a], 0x30
mov byte [rsp + 0x7b], 0x63
mov byte [rsp + 0x7c], 0x6b
mov byte [rsp + 0x7d], 0x23
mov byte [rsp + 0x7e], 0x66
mov byte [rsp + 0x7f], 0x68
mov byte [rsp + 0x80], 0x3c
mov byte [rsp + 0x81], 0x69
mov byte [rsp + 0x82], 0x7a
mov byte [rsp + 0x83], 0x4b
lea rcx, [rsp + 0x70]
movsxd rax, edx
imul rax, rax, 0xffffffffa0a0a0a1
shr rax, 0x20
add eax, edx
sar eax, 5
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x33
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x38]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 0x14
jne 0x140004196
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll_system
mov ecx, 0
call sub.msvcrt.dll_exit
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2e], 0
jmp 0x140004079
mov rcx, r15
call qword [sym.imp.msvcrt.dll__wtoi]
mov ebp, eax
mov esi, 3
mov r12, qword [0x14019df10]
mov r13, r12
mov rdi, r12
mov r8d, ebp
mov edx, 0
mov ecx, 1
call qword [r12 + 0xe0]
mov rbx, rax
test rax, rax
je 0x140004257
mov edx, 0
mov rcx, rax
call qword [r13 + 0xf0]
test eax, eax
jne 0x140004273
mov rcx, rbx
call qword [rdi + 0xc0]
mov ecx, 0x64
call qword [rdi + 0x218]
sub esi, 1
jne 0x14000420e
mov ecx, 0x64
mov rax, qword [0x14019df10]
call qword [rax + 0x218]
mov ebx, 1
jmp 0x140004090
mov rcx, rbx
mov rax, qword [0x14019df10]
call qword [rax + 0xc0]
jmp 0x140004257
mov ebx, 1
jmp 0x1400040e5
mov ebx, 1
jmp 0x1400040e5
cmp byte [rsp + 0x2f], 0
jne 0x1400041d8
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret