Function at 0x404ab0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x18], esi
push edi
cmp dl, 0x30
jne 0x404b81
mov bh, 0x1d
mov byte [ebp - 0x14], 0
mov al, 0x5c
mov byte [ebp - 0x1c], bh
mov ah, al
mov byte [ebp - 0x14], 0
mov dh, ah
xor al, bh
xor ah, bh
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x17], ah
mov dl, 0x4d
push 0x104
lea eax, [ebp - 0x128]
mov bl, dl
push eax
mov cl, 0x59
lea eax, [ebp - 0x1b]
mov ch, 0x49
xor dl, bh
xor cl, bh
mov byte [ebp - 0x1a], dl
xor ch, bh
mov byte [ebp - 0x18], cl
xor dh, bh
mov byte [ebp - 0x16], ch
xor bl, bh
mov byte [ebp - 0x15], dh
push eax
mov byte [ebp - 0x19], bl
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x128], 0
jne 0x404b52
xor ecx, ecx
lea eax, [ebp - 0x128]
push ecx
push eax
mov ecx, esi
call fcn.004073c0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x128]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404b60
sub ecx, edx
lea eax, [ebp - 0x128]
push ecx
push eax
mov ecx, esi
call fcn.004073c0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dl, 0x31
jne 0x404bdc
mov ah, 0x46
mov byte [ebp - 0x14], 0
mov al, 0x12
mov byte [ebp - 0x19], ah
xor al, ah
mov byte [ebp - 0x14], 0
mov cl, 3
mov byte [ebp - 0x18], al
mov dl, 0xb
xor cl, ah
xor dl, ah
mov byte [ebp - 0x17], cl
mov bl, 0x16
mov byte [ebp - 0x16], dl
xor bl, ah
lea eax, [ebp - 0x128]
push 0x104
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 0x15], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x128]
mov ecx, esi
push eax
call fcn.00406eb0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dl, 0x32
jne 0x404c40
mov cl, 0x23
mov dword [ebp - 0xd], 0x66707623
mov dword [ebp - 9], 0x6c717371
xor eax, eax
mov dword [ebp - 5], 0x666f6a65
mov byte [ebp - 1], 0
nop
xor byte [ebp + eax - 0xc], cl
inc eax
cmp eax, 0xb
jae 0x404c0f
mov cl, byte [ebp - 0xd]
jmp 0x404c00
push 0x104
lea eax, [ebp - 0x128]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x128]
mov ecx, esi
push eax
call fcn.00406eb0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dl, 0x33
jne 0x404d1f
mov cl, 0x79
mov dword [ebp - 0xd], 0x3c2a2c79
mov dword [ebp - 9], 0x362b292b
xor eax, eax
mov dword [ebp - 5], 0x3c35303f
mov byte [ebp - 1], 0
xor byte [ebp + eax - 0xc], cl
inc eax
cmp eax, 0xb
jae 0x404c75
mov cl, byte [ebp - 0xd]
jmp 0x404c66
push 0x104
lea eax, [ebp - 0x128]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov byte [ebp - 0xa], 4
mov al, 0x58
xor al, byte [ebp - 0xa]
mov dl, 0x61
mov dh, 0x6b
mov byte [ebp - 9], al
mov al, byte [ebp - 0xa]
mov cl, 0x40
xor dl, al
mov byte [ebp - 1], 0
xor dh, al
mov byte [ebp - 7], dl
mov bl, 0x77
mov byte [ebp - 3], dh
mov ah, 0x6f
mov byte [ebp - 1], 0
mov ch, 0x70
lea edx, [ebp - 9]
mov bh, 0x74
xor cl, al
xor bl, al
mov byte [ebp - 8], cl
xor ah, al
mov byte [ebp - 6], bl
xor ch, al
mov byte [ebp - 5], ah
xor bh, al
mov byte [ebp - 4], ch
mov byte [ebp - 2], bh
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x404ce0
lea edi, [ebp - 0x128]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404cf0
mov ecx, edx
lea eax, [ebp - 0x128]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.00406eb0
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x43b8b0]
xor ecx, ecx
movups xmmword [ebp - 0x10], xmm0
nop dword [eax]
mov al, byte [ebp - 0x10]
xor byte [ebp + ecx - 0xf], al
inc ecx
cmp ecx, 0xe
jb 0x404d30
lea eax, [ebp - 0xf]
mov byte [ebp - 1], 0
push eax
mov ecx, esi
call fcn.00406eb0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret