Function at 0x40296f
Capabilities:
Encode data using xor
Query environment variable
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
push edi
push 0x411918
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x20
mov edx, 0x40e04d
mov ecx, 0x411998
call fcn.00406c99
pop ecx
push 0x20
mov edx, 0x40e06d
mov ecx, 0x411958
call fcn.00406c99
movaps xmm0, xmmword [0x402160]
xor ebx, ebx
pop ecx
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x5530553e
mov eax, ebx
mov dword [ebp - 0xc], 0x55552c
xor byte [ebp + eax - 0x20], 0x55
inc eax
cmp eax, 0x17
jb 0x4029c7
mov ecx, 0x10000
mov byte [ebp - 9], bl
call fcn.00406c20
mov esi, eax
test esi, esi
jne 0x4029ed
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, 0x8000
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x402a11
cmp word [esi + eax*2], 0x5c
je 0x402a11
xor ecx, ecx
mov word [esi + eax*2], cx
sub eax, 1
jne 0x4029ff
lea eax, [ebp - 0x20]
mov edx, esi
push eax
mov ecx, esi
call fcn.00409a6f
pop ecx
mov ecx, esi
call fcn.004099a5
test eax, eax
jne 0x402a6a
movaps xmm0, xmmword [0x401c70]
mov eax, ebx
movups xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [0x401b00]
movups xmmword [ebp - 0x30], xmm0
xor byte [ebp + eax - 0x40], 0x55
inc eax
cmp eax, 0x1f
jb 0x402a42
push edi
push esi
lea eax, [ebp - 0x40]
mov byte [ebp - 0x21], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x20]
mov edx, esi
push eax
mov ecx, esi
call fcn.00409a6f
pop ecx
mov ecx, esi
call fcn.004099a5
mov edi, 0x411698
test eax, eax
je 0x402ac9
push ebx
push 0x8000000
push 3
push ebx
push ebx
push closesocket
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x402ab7
push ebx
lea eax, [ebp - 8]
push eax
push 0x80
push 0x411698
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0x80
je 0x402bb1
mov edi, 0x411698
mov edx, edi
call fcn.00408375
push 0x401208
mov edx, edi
mov ecx, 0x4116b8
call fcn.00405570
mov edx, edi
mov dword [esp], 0x411998
lea ecx, [ebp - 0x80]
call fcn.00405570
pop ecx
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x80]
call fcn.00406820
pop ecx
push 0x20
lea ecx, [ebp - 0x80]
call fcn.00406c78
add esp, 4
mov edx, edi
mov edi, 0x4116d8
mov ecx, edi
push 0x20
call fcn.00406c99
lea eax, [ebp - 0x60]
mov edx, edi
push eax
call fcn.004028f5
push 0x40
lea ecx, [ebp - 0x60]
call fcn.00406c78
add esp, 0xc
lea ecx, [ebp - 0x80]
mov edi, 0x411698
mov edx, edi
push 0x411958
call fcn.00405570
pop ecx
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x80]
call fcn.00406820
pop ecx
push 0x20
lea ecx, [ebp - 0x80]
call fcn.00406c78
add esp, 4
mov edx, edi
mov edi, 0x4116f8
mov ecx, edi
push 0x20
call fcn.00406c99
lea eax, [ebp - 0x60]
mov edx, edi
push eax
call fcn.004028f5
push 0x40
lea ecx, [ebp - 0x60]
call fcn.00406c78
add esp, 0xc
mov ecx, 0x411698
push 0x20
call fcn.00406c78
add esp, 4
mov edx, ecx
mov ecx, esi
push 0x80
call fcn.00409a0e
pop ecx
mov ecx, esi
call fcn.00406cc5
lea eax, [ebp - 0x60]
mov ecx, 0x4116b8
push eax
call fcn.00406820
pop ecx
mov esi, 0x4119b8
lea ecx, [ebp - 0x60]
push esi
call fcn.00402884
pop ecx
lea eax, [ebp - 0x60]
mov ecx, 0x411958
push eax
call fcn.00406820
lea ecx, [ebp - 0x60]
mov dword [esp], 0x4119dc
call fcn.00402884
pop ecx
push 0x2d
pop eax
mov word [0x4119c8], ax
mov word [0x4119d2], ax
mov word [0x4119dc], ax
mov word [0x4119e6], ax
mov eax, ebx
mov dword [ebp - 8], 0x552e557b
mov word [ebp - 4], 0x55
xor byte [ebp + eax - 8], 0x55
inc eax
cmp eax, 5
jb 0x402c17
lea eax, [ebp - 8]
mov byte [ebp - 3], bl
push eax
mov edi, 0x411718
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
call esi
mov dword [ebp - 6], 0x555528
mov eax, ebx
xor byte [ebp + eax - 6], 0x55
inc eax
cmp eax, 3
jb 0x402c48
lea eax, [ebp - 6]
mov byte [ebp - 3], bl
push eax
push edi
call esi
cmp dword [0x41154d], ebx
je 0x402cbe
mov eax, 0x411551
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x402cbe
mov dword [ebp - 6], 0x55557b
mov eax, ebx
xor byte [ebp + eax - 6], 0x55
inc eax
cmp eax, 3
jb 0x402c7e
lea eax, [ebp - 6]
mov byte [ebp - 3], bl
push eax
push edi
call esi
mov eax, dword [0x41154d]
mov edx, 0x411551
inc eax
mov ecx, 0x411552
cmp byte [0x411551], 0x2e
push eax
push 0x411768
push 0xffffffffffffffff
cmovne ecx, edx
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [0x40fd45]
mov ecx, 0x40fd49
call fcn.004055f4
pop edi
mov dword [0x411930], eax
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret