Function at 0x408fd0
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
push ebx
xor ebx, ebx
mov dword [ebp - 0xd], 0x16747474
push esi
push edi
mov dword [ebp - 9], 0x1c131b1a
mov eax, ebx
mov dword [ebp - 5], 0x74747412
mov byte [ebp - 1], bl
xor byte [ebp + eax - 0xd], 0x55
inc eax
cmp eax, 0xc
jb 0x408ff8
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrA]
lea eax, [ebp - 0xd]
push eax
push str._EuE
mov byte [ebp - 1], bl
call esi
test eax, eax
jne 0x409086
mov dword [ebp - 0xf], 0x5747474
mov eax, ebx
mov dword [ebp - 0xb], 0x2060614
mov dword [ebp - 7], 0x7411071a
mov word [ebp - 3], 0x7474
mov byte [ebp - 1], bl
xor byte [ebp + eax - 0xf], 0x55
inc eax
cmp eax, 0xe
jb 0x40903b
lea eax, [ebp - 0xf]
mov byte [ebp - 1], bl
push eax
mov edi, section..data
push edi
call esi
test eax, eax
jne 0x409086
push ecx
push ecx
push 0x40e020
mov edx, edi
lea ecx, [ebp - 0xe8]
call fcn.004026a8
add esp, 0xc
lea ecx, [ebp - 0xe8]
mov edx, str._EuE
push 0x4e25
call fcn.004026ee
pop ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
and dword [ebp - 0x28], 0
mov ebx, eax
cmp dword [ebp - 0x24], 0
jle 0x40928e
push 3
pop edi
mov esi, dword [ebx]
mov ecx, esi
call fcn.00409cc1
cmp eax, 1
jbe 0x40927b
cmp word [esi], 0x2d
jne 0x40927b
movzx eax, word [esi + 2]
cmp eax, 0x61
ja 0x4091d4
je 0x4091c3
cmp eax, 0x4f
ja 0x409155
je 0x4092c2
cmp eax, 0x49
ja 0x409129
je 0x40920e
sub eax, 0x41
je 0x4091c3
dec eax
sub eax, 1
je 0x409293
dec eax
sub eax, 1
je 0x40921c
sub eax, 1
jne 0x40927b
mov ecx, esi
call fcn.00408f8b
mov byte [0x412e5c], al
jmp 0x40927b
sub eax, 0x4c
je 0x4092a1
sub eax, 1
je 0x4092d0
sub eax, 1
jne 0x40927b
mov ecx, esi
call fcn.00408f8b
mov byte [0x412e5b], al
jmp 0x40927b
cmp eax, 0x56
ja 0x409196
je 0x40942e
sub eax, 0x50
je 0x4092de
dec eax
sub eax, 1
je 0x409450
sub eax, 1
je 0x40943f
sub eax, 1
jne 0x40927b
mov ecx, esi
call fcn.00408f8b
mov byte [0x412e5e], al
jmp 0x40927b
sub eax, 0x57
je 0x40941d
sub eax, 1
je 0x40935c
dec eax
sub eax, 1
jne 0x40927b
mov ecx, esi
call fcn.00408f8b
mov byte [0x412e57], al
jmp 0x40927b
mov ecx, esi
call fcn.00408f8b
mov byte [0x412e63], al
jmp 0x40927b
cmp eax, 0x70
ja 0x40932f
je 0x4092de
cmp eax, 0x6c
ja 0x4092af
je 0x4092a1
sub eax, 0x63
je 0x409293
dec eax
sub eax, 1
je 0x40921c
sub eax, 1
je 0x409118
sub eax, edi
jne 0x40927b
mov ecx, esi
call fcn.00408f8b
mov byte [0x412e62], al
jmp 0x40927b
mov ecx, esi
call fcn.00409cc1
mov edi, eax
push 3
pop eax
cmp edi, eax
jle 0x409278
push 0x3d
pop eax
cmp word [esi + 4], ax
jne 0x409278
push 0x80
mov ecx, 0x412d51
call fcn.00406b80
xor eax, eax
lea esi, [edi - 2]
mov ecx, eax
add esp, 4
mov eax, 0x80
cmp esi, eax
cmovg esi, eax
test esi, esi
jle 0x409272
push 6
pop edx
mov eax, dword [ebx]
mov al, byte [edx + eax]
lea edx, [edx + 2]
mov byte [ecx + 0x412d51], al
inc ecx
cmp ecx, esi
jl 0x40925f
mov dword [0x412d4d], ecx
push 3
pop edi
mov eax, dword [ebp - 0x28]
add ebx, 4
inc eax
mov dword [ebp - 0x28], eax
cmp eax, dword [ebp - 0x24]
jl 0x4090ad
pop edi
pop esi
pop ebx
leave
ret
mov ecx, esi
call fcn.00408f8b
mov byte [0x412e58], al
jmp 0x40927b
mov ecx, esi
call fcn.00408f8b
mov byte [0x412e5a], al
jmp 0x40927b
sub eax, 0x6d
je 0x4092d0
sub eax, 1
je 0x409144
sub eax, 1
jne 0x40927b
mov ecx, esi
call fcn.00408f8b
mov byte [0x412e61], al
jmp 0x40927b
mov ecx, esi
call fcn.00408f8b
mov byte [0x412e5d], al
jmp 0x40927b
mov ecx, esi
call fcn.00409cc1
cmp eax, edi
jle 0x40927b
push 0x3d
pop ecx
cmp word [esi + 4], cx
jne 0x40927b
xor ecx, ecx
lea edx, [eax - 2]
cmp edx, edi
mov dword [ebp - 0x30], ecx
mov word [ebp - 0x2c], cx
cmovg edx, edi
test edx, edx
jle 0x40931a
add esi, 6
mov ax, word [esi]
lea esi, [esi + 2]
mov word [ebp + ecx*2 - 0x30], ax
inc ecx
cmp ecx, edx
jl 0x40930a
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov word [0x412e55], ax
jmp 0x40927b
sub eax, 0x72
je 0x409450
sub eax, 1
je 0x40943f
sub eax, 1
je 0x409185
dec eax
sub eax, 1
je 0x40942e
sub eax, 1
jmp 0x409199
mov ecx, esi
call fcn.00409cc1
mov edi, eax
push 3
pop eax
cmp edi, eax
jle 0x409278
push 0x3d
pop eax
cmp word [esi + 4], ax
jne 0x409278
push 0x800
lea ecx, [ebp - 0x830]
call fcn.00406b80
mov eax, 0x400
lea esi, [edi - 2]
add esp, 4
cmp esi, eax
cmovg esi, eax
xor eax, eax
mov edx, eax
test esi, esi
jle 0x4093be
mov ecx, dword [ebx]
add ecx, 6
movsx ax, byte [ecx]
lea ecx, [ecx + 2]
mov word [ebp + edx*2 - 0x830], ax
inc edx
cmp edx, esi
jl 0x4093aa
lea ecx, [ebp - 0x830]
call fcn.00409baa
test eax, eax
je 0x409461
lea ecx, [ebp - 0x830]
call fcn.0040999a
test eax, eax
jne 0x409278
movaps xmm0, xmmword [0x4019f0]
lea ecx, [ebp - 0x15]
push 0x40010
xor edx, edx
mov dword [ebp - 5], 0x74302f3c
push 0x4018e2
movups xmmword [ebp - 0x15], xmm0
mov byte [ebp - 1], dl
call fcn.004094b9
push eax
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, esi
call fcn.00408f8b
mov byte [0x412e59], al
jmp 0x40927b
mov ecx, esi
call fcn.00408f8b
mov byte [0x412e64], al
jmp 0x40927b
mov ecx, esi
call fcn.00408f8b
mov byte [0x412e60], al
jmp 0x40927b
mov ecx, esi
call fcn.00408f8b
mov byte [0x412e5f], al
jmp 0x40927b
movaps xmm0, xmmword [0x401a60]
lea ecx, [ebp - 0x1e]
push 0x40010
push 0x4018e2
movups xmmword [ebp - 0x1e], xmm0
mov dword [ebp - 0xe], 0x3b753039
xor edx, edx
mov dword [ebp - 0xa], 0x3375213a
mov dword [ebp - 6], 0x313b203a
mov word [ebp - 2], 0x74
call fcn.004094a6
jmp 0x40940d