Function at 0x401689
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
push 0x519488
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 0x38], 0x6d
xor ebx, ebx
mov byte [ebp - 0x37], 9
mov byte [ebp - 0x36], 0x6e
mov byte [ebp - 0x35], 9
mov byte [ebp - 0x34], 0x6f
mov byte [ebp - 0x33], 9
mov byte [ebp - 0x32], 0x6a
mov byte [ebp - 0x31], 9
mov byte [ebp - 0x30], 0x7e
mov byte [ebp - 0x2f], 9
mov byte [ebp - 0x2e], 0x75
mov byte [ebp - 0x2d], 9
mov byte [ebp - 0x2c], 0x7d
mov byte [ebp - 0x2b], 9
mov byte [ebp - 0x2a], 0x37
mov byte [ebp - 0x29], 9
mov byte [ebp - 0x28], 0x7d
mov byte [ebp - 0x27], 9
mov byte [ebp - 0x26], 0x76
mov byte [ebp - 0x25], 9
mov byte [ebp - 0x24], 0x79
mov byte [ebp - 0x23], 9
mov byte [ebp - 0x22], 9
mov byte [ebp - 0x21], bl
mov al, byte [ebp - 0x38]
mov eax, ebx
sub byte [ebp + eax - 0x38], 9
inc eax
cmp eax, 0x17
jb 0x401706
mov ecx, 0x10000
call fcn.00405c2d
mov esi, eax
test esi, esi
jne 0x401729
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, 0x8000
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40174d
cmp word [esi + eax*2], 0x5c
je 0x40174d
xor ecx, ecx
mov word [esi + eax*2], cx
sub eax, 1
jne 0x40173b
lea eax, [ebp - 0x38]
mov edx, esi
push eax
mov ecx, esi
call fcn.0040a05f
pop ecx
mov ecx, esi
call fcn.00409f53
test eax, eax
jne 0x4017c9
mov dword [ebp - 0x48], 0x72
mov edx, ebx
mov byte [ebp - 0x44], 0x26
mov byte [ebp - 0x43], 0x72
mov byte [ebp - 0x42], 0x37
mov byte [ebp - 0x41], 0x72
mov byte [ebp - 0x40], 0x3f
mov byte [ebp - 0x3f], 0x72
mov byte [ebp - 0x3e], 0x22
mov byte [ebp - 0x3d], 0x72
mov byte [ebp - 0x3c], 0x72
mov al, byte [ebp - 0x44]
mov byte [ebp - 0x3b], bl
mov al, byte [ebp + edx - 0x44]
mov ecx, dword [ebp - 0x48]
xor cl, al
mov byte [ebp + edx - 0x44], cl
inc edx
cmp edx, 9
jb 0x401799
push edi
push esi
lea eax, [ebp - 0x44]
mov byte [ebp - 0x3b], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x38]
mov edx, esi
push eax
mov ecx, esi
call fcn.0040a05f
pop ecx
mov edi, 0x519048
mov ecx, esi
push 0x240
mov edx, edi
call fcn.00409ff2
pop ecx
test eax, eax
jne 0x401860
mov edx, edi
call fcn.00407c96
push 0x50a460
mov edx, edi
mov ecx, 0x519068
call fcn.004042e5
movzx eax, word [0x51208d]
pop ecx
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0x51208f
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
push eax
call fcn.00412cc0
add esp, 0xc
mov dword [ebp - 0x20], eax
test eax, eax
je 0x40183f
push 4
push eax
push 0x519088
push edi
push 0x20
call fcn.00412d50
add esp, 0x14
push dword [ebp - 0x20]
call fcn.00413000
pop ecx
push 0x20
mov ecx, edi
call fcn.00405c85
mov edx, edi
mov dword [esp], 0x240
mov ecx, esi
call fcn.00409fa1
pop ecx
mov ecx, esi
call fcn.00405cd2
lea eax, [ebp - 0x90]
mov ecx, 0x519068
push eax
call fcn.00405595
pop ecx
mov esi, 0x5194a0
lea ecx, [ebp - 0x90]
push esi
call fcn.0040159b
pop ecx
lea eax, [ebp - 0x90]
mov ecx, 0x51218f
push eax
call fcn.00405595
lea ecx, [ebp - 0x90]
mov dword [esp], 0x5194c4
call fcn.0040159b
pop ecx
push 0x2d
pop eax
mov word [0x5194b0], ax
mov edx, ebx
mov word [0x5194ba], ax
mov word [0x5194c4], ax
mov word [0x5194ce], ax
mov dword [ebp - 0x14], 0x5f
mov eax, dword [ebp - 0x14]
xor al, 0x2e
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x14]
inc al
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x14]
add al, 2
xor al, 0x7b
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x14]
add al, 3
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x14]
add al, 4
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0x10]
mov al, byte [ebp + edx - 0x10]
mov ecx, dword [ebp - 0x14]
add cl, dl
xor cl, al
mov byte [ebp + edx - 0x10], cl
inc edx
cmp edx, 5
jb 0x4018fc
lea eax, [ebp - 0x10]
mov byte [ebp - 0xb], bl
push eax
mov edi, 0x519288
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
call esi
mov dword [ebp - 0x1c], 0x69
mov edx, ebx
mov byte [ebp - 0x18], 0x14
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x69
mov al, byte [ebp - 0x18]
mov byte [ebp - 0x15], bl
mov al, byte [ebp + edx - 0x18]
mov ecx, dword [ebp - 0x1c]
xor cl, al
mov byte [ebp + edx - 0x18], cl
inc edx
cmp edx, 3
jb 0x401949
lea eax, [ebp - 0x18]
mov byte [ebp - 0x15], bl
push eax
push edi
call esi
cmp dword [0x51614b], ebx
je 0x4019f3
mov eax, 0x51614f
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4019f3
mov dword [ebp - 8], 0x35
mov edx, ebx
mov eax, dword [ebp - 8]
xor al, 0x2e
mov byte [ebp - 4], al
mov eax, dword [ebp - 8]
inc al
mov byte [ebp - 3], al
mov eax, dword [ebp - 8]
add al, 2
mov byte [ebp - 1], bl
mov byte [ebp - 2], al
mov al, byte [ebp - 4]
mov al, byte [ebp + edx - 4]
mov ecx, dword [ebp - 8]
add cl, dl
xor cl, al
mov byte [ebp + edx - 4], cl
inc edx
cmp edx, 3
jb 0x4019a9
lea eax, [ebp - 4]
mov byte [ebp - 1], bl
push eax
push edi
call esi
mov eax, dword [0x51614b]
mov edx, 0x51614f
inc eax
mov ecx, 0x516150
cmp byte [0x51614f], 0x2e
push eax
push 0x5192d8
push 0xffffffffffffffff
cmovne ecx, edx
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret