Function at 0x404aa0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x18], esi
push edi
cmp dl, 0x30
jne 0x404b71
mov bh, 0x13
mov byte [ebp - 0x14], 0
mov al, 0x52
mov byte [ebp - 0x1c], bh
mov ah, al
mov byte [ebp - 0x14], 0
mov dh, ah
xor al, bh
xor ah, bh
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x17], ah
mov dl, 0x43
push 0x104
lea eax, [ebp - 0x128]
mov bl, dl
push eax
mov cl, 0x57
lea eax, [ebp - 0x1b]
mov ch, 0x47
xor dl, bh
xor cl, bh
mov byte [ebp - 0x1a], dl
xor ch, bh
mov byte [ebp - 0x18], cl
xor dh, bh
mov byte [ebp - 0x16], ch
xor bl, bh
mov byte [ebp - 0x15], dh
push eax
mov byte [ebp - 0x19], bl
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x128], 0
jne 0x404b42
xor ecx, ecx
lea eax, [ebp - 0x128]
push ecx
push eax
mov ecx, esi
call fcn.00407390
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x128]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404b50
sub ecx, edx
lea eax, [ebp - 0x128]
push ecx
push eax
mov ecx, esi
call fcn.00407390
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dl, 0x31
jne 0x404bcc
mov ah, 0x7a
mov byte [ebp - 0x14], 0
mov al, 0x2e
mov byte [ebp - 0x19], ah
xor al, ah
mov byte [ebp - 0x14], 0
mov cl, 0x3f
mov byte [ebp - 0x18], al
mov dl, 0x37
xor cl, ah
xor dl, ah
mov byte [ebp - 0x17], cl
mov bl, 0x2a
mov byte [ebp - 0x16], dl
xor bl, ah
lea eax, [ebp - 0x128]
push 0x104
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 0x15], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x128]
mov ecx, esi
push eax
call fcn.00406e80
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dl, 0x32
jne 0x404c30
mov cl, 0x68
mov dword [ebp - 0xd], 0x2d3b3d68
mov dword [ebp - 9], 0x273a383a
xor eax, eax
mov dword [ebp - 5], 0x2d24212e
mov byte [ebp - 1], 0
nop
xor byte [ebp + eax - 0xc], cl
inc eax
cmp eax, 0xb
jae 0x404bff
mov cl, byte [ebp - 0xd]
jmp 0x404bf0
push 0x104
lea eax, [ebp - 0x128]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x128]
mov ecx, esi
push eax
call fcn.00406e80
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dl, 0x33
jne 0x404d0f
mov cl, 0x30
mov dword [ebp - 0xd], 0x75636530
mov dword [ebp - 9], 0x7f626062
xor eax, eax
mov dword [ebp - 5], 0x757c7976
mov byte [ebp - 1], 0
xor byte [ebp + eax - 0xc], cl
inc eax
cmp eax, 0xb
jae 0x404c65
mov cl, byte [ebp - 0xd]
jmp 0x404c56
push 0x104
lea eax, [ebp - 0x128]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov byte [ebp - 0xa], 0x13
mov al, 0x4f
xor al, byte [ebp - 0xa]
mov dl, 0x76
mov dh, 0x7c
mov byte [ebp - 9], al
mov al, byte [ebp - 0xa]
mov cl, 0x57
xor dl, al
mov byte [ebp - 1], 0
xor dh, al
mov byte [ebp - 7], dl
mov bl, 0x60
mov byte [ebp - 3], dh
mov ah, 0x78
mov byte [ebp - 1], 0
mov ch, 0x67
lea edx, [ebp - 9]
mov bh, 0x63
xor cl, al
xor bl, al
mov byte [ebp - 8], cl
xor ah, al
mov byte [ebp - 6], bl
xor ch, al
mov byte [ebp - 5], ah
xor bh, al
mov byte [ebp - 4], ch
mov byte [ebp - 2], bh
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x404cd0
lea edi, [ebp - 0x128]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404ce0
mov ecx, edx
lea eax, [ebp - 0x128]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.00406e80
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x43b8c0]
xor ecx, ecx
movups xmmword [ebp - 0x10], xmm0
nop dword [eax]
mov al, byte [ebp - 0x10]
xor byte [ebp + ecx - 0xf], al
inc ecx
cmp ecx, 0xe
jb 0x404d20
lea eax, [ebp - 0xf]
mov byte [ebp - 1], 0
push eax
mov ecx, esi
call fcn.00406e80
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret