Function at 0x409138
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
push ebx
xor ebx, ebx
mov dword [ebp - 0xd], 0x16747474
push esi
push edi
mov dword [ebp - 9], 0x1c131b1a
mov eax, ebx
mov dword [ebp - 5], 0x74747412
mov byte [ebp - 1], bl
xor byte [ebp + eax - 0xd], 0x55
inc eax
cmp eax, 0xc
jb 0x409160
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrA]
lea eax, [ebp - 0xd]
push eax
push 0x40e040
mov byte [ebp - 1], bl
call esi
test eax, eax
jne 0x4091ee
mov dword [ebp - 0xf], 0x5747474
mov eax, ebx
mov dword [ebp - 0xb], 0x2060614
mov dword [ebp - 7], 0x7411071a
mov word [ebp - 3], 0x7474
mov byte [ebp - 1], bl
xor byte [ebp + eax - 0xf], 0x55
inc eax
cmp eax, 0xe
jb 0x4091a3
lea eax, [ebp - 0xf]
mov byte [ebp - 1], bl
push eax
mov edi, section..data
push edi
call esi
test eax, eax
jne 0x4091ee
push ecx
push ecx
push 0x40e020
mov edx, edi
lea ecx, [ebp - 0xe8]
call fcn.004026f8
add esp, 0xc
lea ecx, [ebp - 0xe8]
mov edx, 0x40e040
push 0x4e25
call fcn.0040273e
pop ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
and dword [ebp - 0x28], 0
mov ebx, eax
cmp dword [ebp - 0x24], 0
jle 0x4093f4
push 3
pop edi
mov esi, dword [ebx]
mov ecx, esi
call fcn.00409e0e
cmp eax, 1
jbe 0x4093e1
cmp word [esi], 0x2d
jne 0x4093e1
movzx eax, word [esi + 2]
cmp eax, 0x61
ja 0x40933c
je 0x40932b
cmp eax, 0x4e
ja 0x4092bd
je 0x409428
cmp eax, 0x49
ja 0x409291
je 0x409376
sub eax, 0x41
je 0x40932b
dec eax
sub eax, 1
je 0x4093f9
dec eax
sub eax, 1
je 0x409384
sub eax, 1
jne 0x4093e1
mov ecx, esi
call fcn.004090f3
mov byte [0x412e5c], al
jmp 0x4093e1
sub eax, 0x4b
je 0x409407
sub eax, 1
je 0x409436
sub eax, 1
jne 0x4093e1
mov ecx, esi
call fcn.004090f3
mov byte [0x412e5d], al
jmp 0x4093e1
cmp eax, 0x56
ja 0x4092fe
je 0x40954e
sub eax, 0x4f
je 0x409444
sub eax, 1
je 0x409570
dec eax
sub eax, 1
je 0x40955f
sub eax, 1
jne 0x4093e1
mov ecx, esi
call fcn.004090f3
mov byte [0x412e60], al
jmp 0x4093e1
sub eax, 0x57
je 0x40953d
sub eax, 1
je 0x40947e
dec eax
sub eax, 1
jne 0x4093e1
mov ecx, esi
call fcn.004090f3
mov byte [0x412e57], al
jmp 0x4093e1
mov ecx, esi
call fcn.004090f3
mov byte [0x412e63], al
jmp 0x4093e1
cmp eax, 0x6f
ja 0x409452
je 0x409444
cmp eax, 0x6b
ja 0x409415
je 0x409407
sub eax, 0x63
je 0x4093f9
dec eax
sub eax, 1
je 0x409384
sub eax, 1
je 0x409280
sub eax, edi
jne 0x4093e1
mov ecx, esi
call fcn.004090f3
mov byte [0x412e62], al
jmp 0x4093e1
mov ecx, esi
call fcn.00409e0e
mov edi, eax
cmp edi, 3
jle 0x4093de
push 0x3d
pop eax
cmp word [esi + 4], ax
jne 0x4093de
push 0x80
mov ecx, 0x412d51
call fcn.00406ce6
xor eax, eax
lea esi, [edi - 2]
mov ecx, eax
add esp, 4
mov eax, 0x80
cmp esi, eax
cmovg esi, eax
test esi, esi
jle 0x4093d8
push 6
pop edx
mov eax, dword [ebx]
mov al, byte [edx + eax]
lea edx, [edx + 2]
mov byte [ecx + 0x412d51], al
inc ecx
cmp ecx, esi
jl 0x4093c5
mov dword [0x412d4d], ecx
push 3
pop edi
mov eax, dword [ebp - 0x28]
add ebx, 4
inc eax
mov dword [ebp - 0x28], eax
cmp eax, dword [ebp - 0x24]
jl 0x409215
pop edi
pop esi
pop ebx
leave
ret
mov ecx, esi
call fcn.004090f3
mov byte [0x412e58], al
jmp 0x4093e1
mov ecx, esi
call fcn.004090f3
mov byte [0x412e5e], al
jmp 0x4093e1
sub eax, 0x6c
je 0x409436
sub eax, 1
je 0x4092ac
sub eax, 1
jne 0x4093e1
mov ecx, esi
call fcn.004090f3
mov byte [0x412e5b], al
jmp 0x4093e1
mov ecx, esi
call fcn.004090f3
mov byte [0x412e5a], al
jmp 0x4093e1
mov ecx, esi
call fcn.004090f3
mov byte [0x412e61], al
jmp 0x4093e1
sub eax, 0x70
je 0x409570
dec eax
sub eax, 1
je 0x40955f
sub eax, 1
je 0x4092ed
sub eax, edi
je 0x40954e
sub eax, 1
jmp 0x409301
mov ecx, esi
call fcn.00409e0e
mov edi, eax
cmp edi, 3
jle 0x4093de
push 0x3d
pop eax
cmp word [esi + 4], ax
jne 0x4093de
push 0x800
lea ecx, [ebp - 0x830]
call fcn.00406ce6
mov eax, 0x400
lea esi, [edi - 2]
add esp, 4
cmp esi, eax
cmovg esi, eax
xor eax, eax
mov edx, eax
test esi, esi
jle 0x4094de
mov ecx, dword [ebx]
add ecx, 6
movsx ax, byte [ecx]
lea ecx, [ecx + 2]
mov word [ebp + edx*2 - 0x830], ax
inc edx
cmp edx, esi
jl 0x4094ca
lea ecx, [ebp - 0x830]
call fcn.00409d12
test eax, eax
je 0x4095c9
lea ecx, [ebp - 0x830]
call fcn.00409b02
test eax, eax
jne 0x4093de
movaps xmm0, xmmword [0x4019f0]
lea ecx, [ebp - 0x15]
push 0x40010
xor edx, edx
mov dword [ebp - 5], 0x74302f3c
push 0x4018e2
movups xmmword [ebp - 0x15], xmm0
mov byte [ebp - 1], dl
call fcn.00409621
push eax
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, esi
call fcn.004090f3
mov byte [str.:p6], al
jmp 0x4093e1
mov ecx, esi
call fcn.004090f3
mov byte [0x412e64], al
jmp 0x4093e1
mov ecx, esi
call fcn.004090f3
mov byte [0x412e5f], al
jmp 0x4093e1
mov ecx, esi
call fcn.00409e0e
cmp eax, edi
jle 0x4093e1
push 0x3d
pop ecx
cmp word [esi + 4], cx
jne 0x4093e1
xor ecx, ecx
lea edx, [eax - 2]
cmp edx, edi
mov dword [ebp - 0x30], ecx
mov word [ebp - 0x2c], cx
cmovg edx, edi
test edx, edx
jle 0x4095b4
add esi, 6
mov ax, word [esi]
lea esi, [esi + 2]
mov word [ebp + ecx*2 - 0x30], ax
inc ecx
cmp ecx, edx
jl 0x4095a4
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov word [0x412e55], ax
jmp 0x4093e1
movaps xmm0, xmmword [0x401a60]
lea ecx, [ebp - 0x1e]
push 0x40010
push 0x4018e2
movups xmmword [ebp - 0x1e], xmm0
mov dword [ebp - 0xe], 0x3b753039
xor edx, edx
mov dword [ebp - 0xa], 0x3375213a
mov dword [ebp - 6], 0x313b203a
mov word [ebp - 2], 0x74
call fcn.0040960e
jmp 0x40952d