Function at 0x408e2e
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x924
mov dword [ebp - 0x38], 0x66
mov eax, dword [ebp - 0x38]
push ebx
push esi
push edi
push 0x21
pop ecx
xor al, cl
mov byte [ebp - 0x34], al
mov eax, dword [ebp - 0x38]
inc al
xor al, cl
mov byte [ebp - 0x33], al
mov eax, dword [ebp - 0x38]
add al, 2
xor al, cl
mov byte [ebp - 0x32], al
mov eax, dword [ebp - 0x38]
add al, 3
xor al, 0x50
mov byte [ebp - 0x31], al
mov eax, dword [ebp - 0x38]
add al, 4
xor al, 0x41
mov byte [ebp - 0x30], al
mov eax, dword [ebp - 0x38]
add al, 5
xor al, 0x53
mov byte [ebp - 0x2f], al
mov eax, dword [ebp - 0x38]
add al, 6
xor al, 0x53
mov byte [ebp - 0x2e], al
mov eax, dword [ebp - 0x38]
add al, 7
xor al, 0x57
mov byte [ebp - 0x2d], al
mov eax, dword [ebp - 0x38]
add al, 8
xor al, 0x4f
mov byte [ebp - 0x2c], al
mov eax, dword [ebp - 0x38]
add al, 9
xor al, 0x52
mov byte [ebp - 0x2b], al
mov eax, dword [ebp - 0x38]
add al, 0xa
xor al, 0x44
mov byte [ebp - 0x2a], al
mov eax, dword [ebp - 0x38]
add al, 0xb
xor al, cl
mov byte [ebp - 0x29], al
mov eax, dword [ebp - 0x38]
add al, 0xc
xor al, cl
mov byte [ebp - 0x28], al
mov eax, dword [ebp - 0x38]
add al, 0xd
xor al, cl
xor ebx, ebx
mov byte [ebp - 0x27], al
mov edx, ebx
mov al, byte [ebp - 0x34]
mov byte [ebp - 0x26], bl
mov al, byte [ebp + edx - 0x34]
mov ecx, dword [ebp - 0x38]
add cl, dl
xor cl, al
mov byte [ebp + edx - 0x34], cl
inc edx
cmp edx, 0xe
jb 0x408ed8
lea eax, [ebp - 0x34]
mov byte [ebp - 0x26], bl
push eax
mov esi, 0x512040
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
jne 0x4093ec
push ecx
push ecx
push 0x512060
mov edx, esi
lea ecx, [ebp - 0x120]
call fcn.00401518
add esp, 0xc
lea ecx, [ebp - 0x120]
mov edx, 0x512080
push 0x41e3
call fcn.0040155e
pop ecx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
and dword [ebp - 0x5c], 0
mov ebx, eax
cmp dword [ebp - 0x3c], 0
jle 0x409135
push 3
pop edi
mov esi, dword [ebx]
mov ecx, esi
call fcn.0040a04f
cmp eax, 1
jbe 0x409122
cmp word [esi], 0x2d
jne 0x409122
movzx eax, word [esi + 2]
cmp eax, 0x61
ja 0x409083
je 0x409072
cmp eax, 0x4e
ja 0x409004
je 0x409169
cmp eax, 0x49
ja 0x408fd8
je 0x4090bd
sub eax, 0x41
je 0x409072
dec eax
sub eax, 1
je 0x40913a
dec eax
sub eax, 1
je 0x4090cb
sub eax, 1
jne 0x409122
mov ecx, esi
call fcn.00408dc7
mov byte [0x51625a], al
jmp 0x409122
sub eax, 0x4b
je 0x409148
sub eax, 1
je 0x409177
sub eax, 1
jne 0x409122
mov ecx, esi
call fcn.00408dc7
mov byte [0x51625b], al
jmp 0x409122
cmp eax, 0x56
ja 0x409045
je 0x4092d7
sub eax, 0x4f
je 0x409185
sub eax, 1
je 0x4092f9
dec eax
sub eax, 1
je 0x4092e8
sub eax, 1
jne 0x409122
mov ecx, esi
call fcn.00408dc7
mov byte [0x51625e], al
jmp 0x409122
sub eax, 0x57
je 0x4092c6
sub eax, 1
je 0x4091bf
dec eax
sub eax, 1
jne 0x409122
mov ecx, esi
call fcn.00408dc7
mov byte [0x516255], al
jmp 0x409122
mov ecx, esi
call fcn.00408dc7
mov byte [0x516261], al
jmp 0x409122
cmp eax, 0x6f
ja 0x409193
je 0x409185
cmp eax, 0x6b
ja 0x409156
je 0x409148
sub eax, 0x63
je 0x40913a
dec eax
sub eax, 1
je 0x4090cb
sub eax, 1
je 0x408fc7
sub eax, edi
jne 0x409122
mov ecx, esi
call fcn.00408dc7
mov byte [0x516260], al
jmp 0x409122
mov ecx, esi
call fcn.0040a04f
mov edi, eax
cmp edi, 3
jle 0x40911f
push 0x3d
pop eax
cmp word [esi + 4], ax
jne 0x40911f
lea esi, [eax + 0x43]
mov ecx, 0x51614f
push esi
call fcn.00405c85
xor eax, eax
lea edx, [edi - 2]
add esp, 4
mov ecx, eax
cmp edx, esi
cmovg edx, esi
test edx, edx
jle 0x409119
push 6
pop esi
mov eax, dword [ebx]
mov al, byte [esi + eax]
lea esi, [esi + 2]
mov byte [ecx + 0x51614f], al
inc ecx
cmp ecx, edx
jl 0x409106
mov dword [0x51614b], ecx
push 3
pop edi
mov eax, dword [ebp - 0x5c]
add ebx, 4
inc eax
mov dword [ebp - 0x5c], eax
cmp eax, dword [ebp - 0x3c]
jl 0x408f5c
pop edi
pop esi
pop ebx
leave
ret
mov ecx, esi
call fcn.00408dc7
mov byte [0x516256], al
jmp 0x409122
mov ecx, esi
call fcn.00408dc7
mov byte [0x51625c], al
jmp 0x409122
sub eax, 0x6c
je 0x409177
sub eax, 1
je 0x408ff3
sub eax, 1
jne 0x409122
mov ecx, esi
call fcn.00408dc7
mov byte [str.Yt_W], al
jmp 0x409122
mov ecx, esi
call fcn.00408dc7
mov byte [0x516258], al
jmp 0x409122
mov ecx, esi
call fcn.00408dc7
mov byte [0x51625f], al
jmp 0x409122
sub eax, 0x70
je 0x4092f9
dec eax
sub eax, 1
je 0x4092e8
sub eax, 1
je 0x409034
sub eax, edi
je 0x4092d7
sub eax, 1
jmp 0x409048
mov ecx, esi
call fcn.0040a04f
mov edi, eax
cmp edi, 3
jle 0x40911f
push 0x3d
pop eax
cmp word [esi + 4], ax
jne 0x40911f
push 0x800
lea ecx, [ebp - 0x920]
call fcn.00405c85
mov eax, 0x400
lea esi, [edi - 2]
add esp, 4
cmp esi, eax
cmovg esi, eax
xor eax, eax
mov edx, eax
test esi, esi
jle 0x40921f
mov ecx, dword [ebx]
add ecx, 6
movsx ax, byte [ecx]
lea ecx, [ecx + 2]
mov word [ebp + edx*2 - 0x920], ax
inc edx
cmp edx, esi
jl 0x40920b
lea ecx, [ebp - 0x920]
call fcn.00409f53
test eax, eax
je 0x409352
lea ecx, [ebp - 0x920]
call fcn.00409d60
test eax, eax
jne 0x40911f
mov dword [ebp - 0x58], 0x14
lea ecx, [ebp - 0x58]
mov byte [ebp - 0x54], 0x5d
xor ebx, ebx
mov byte [ebp - 0x53], 0x7a
mov byte [ebp - 0x52], 0x77
mov byte [ebp - 0x51], 0x7b
mov byte [ebp - 0x50], 0x66
mov byte [ebp - 0x4f], 0x66
mov byte [ebp - 0x4e], 0x71
mov byte [ebp - 0x4d], 0x77
mov byte [ebp - 0x4c], 0x60
mov byte [ebp - 0x4b], 0x34
mov byte [ebp - 0x4a], 0x7a
mov byte [ebp - 0x49], 0x7b
mov byte [ebp - 0x48], 0x60
mov byte [ebp - 0x47], 0x71
mov byte [ebp - 0x46], 0x34
mov byte [ebp - 0x45], 0x67
mov byte [ebp - 0x44], 0x7d
mov byte [ebp - 0x43], 0x6e
mov byte [ebp - 0x42], 0x71
push 0x40010
mov byte [ebp - 0x41], 0x35
mov al, byte [ebp - 0x54]
push 0x50ab4a
mov byte [ebp - 0x40], bl
call fcn.00409540
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, esi
call fcn.00408dc7
mov byte [0x516257], al
jmp 0x409122
mov ecx, esi
call fcn.00408dc7
mov byte [0x516262], al
jmp 0x409122
mov ecx, esi
call fcn.00408dc7
mov byte [0x51625d], al
jmp 0x409122
mov ecx, esi
call fcn.0040a04f
cmp eax, edi
jle 0x409122
push 0x3d
pop ecx
cmp word [esi + 4], cx
jne 0x409122
xor ecx, ecx
lea edx, [eax - 2]
cmp edx, edi
mov dword [ebp - 0x64], ecx
mov word [ebp - 0x60], cx
cmovg edx, edi
test edx, edx
jle 0x40933d
add esi, 6
mov ax, word [esi]
lea esi, [esi + 2]
mov word [ebp + ecx*2 - 0x64], ax
inc ecx
cmp ecx, edx
jl 0x40932d
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov word [0x516253], ax
jmp 0x409122
mov dword [ebp - 0x24], 0x27
lea ecx, [ebp - 0x24]
mov byte [ebp - 0x20], 0x62
xor ebx, ebx
mov byte [ebp - 0x1f], 0x5f
mov byte [ebp - 0x1e], 0x53
mov byte [ebp - 0x1d], 0x42
mov byte [ebp - 0x1c], 0x55
mov byte [ebp - 0x1b], 0x49
mov byte [ebp - 0x1a], 0x46
mov byte [ebp - 0x19], 0x4b
mov byte [ebp - 0x18], 7
mov byte [ebp - 0x17], 0x49
mov byte [ebp - 0x16], 0x48
mov byte [ebp - 0x15], 0x53
mov byte [ebp - 0x14], 0x42
mov byte [ebp - 0x13], 7
mov byte [ebp - 0x12], 0x41
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x10], 0x4b
mov byte [ebp - 0xf], 0x42
mov byte [ebp - 0xe], 7
mov byte [ebp - 0xd], 0x49
mov byte [ebp - 0xc], 0x48
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 7
mov byte [ebp - 9], 0x41
mov byte [ebp - 8], 0x48
mov byte [ebp - 7], 0x52
mov byte [ebp - 6], 0x49
mov byte [ebp - 5], 0x43
push 0x40010
mov byte [ebp - 4], 6
mov al, byte [ebp - 0x20]
push 0x50ab4a
mov byte [ebp - 3], bl
call fcn.0040951f
jmp 0x4092b6
mov dword [ebp - 0x20], 0x31
mov eax, dword [ebp - 0x20]
xor al, 0x53
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x20]
inc al
xor al, 0x65
mov byte [ebp - 0x1b], al
mov eax, dword [ebp - 0x20]
add al, 2
xor al, 0x74
mov byte [ebp - 0x1a], al
mov eax, dword [ebp - 0x20]
add al, 3
xor al, 0x74
mov byte [ebp - 0x19], al
mov eax, dword [ebp - 0x20]
add al, 4
xor al, 0x69
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 0x20]
add al, 5
xor al, 0x6e
mov byte [ebp - 0x17], al
mov eax, dword [ebp - 0x20]
add al, 6
xor al, 0x67
mov byte [ebp - 0x16], al
mov eax, dword [ebp - 0x20]
add al, 7
xor al, 0x73
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 0x20]
add al, 8
xor al, 0x20
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 0x20]
add al, 9
xor al, 0x6e
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 0x20]
add al, 0xa
xor al, 0x6f
mov byte [ebp - 0x12], al
mov eax, dword [ebp - 0x20]
add al, 0xb
xor al, 0x74
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0x20]
add al, 0xc
xor al, 0x20
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x20]
add al, 0xd
xor al, 0x66
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x20]
add al, 0xe
xor al, 0x6f
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x20]
add al, 0xf
xor al, 0x75
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x20]
add al, 0x10
xor al, 0x6e
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x20]
add al, 0x11
xor al, 0x64
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 0x20]
add al, 0x12
xor al, 0x2c
mov byte [ebp - 0xa], al
mov eax, dword [ebp - 0x20]
add al, 0x13
xor al, 0x20
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x20]
add al, 0x14
lea ecx, [ebp - 0x20]
xor al, 0x61
mov byte [ebp - 8], al
mov eax, dword [ebp - 0x20]
add al, 0x15
xor al, 0x62
mov byte [ebp - 7], al
mov eax, dword [ebp - 0x20]
add al, 0x16
xor al, 0x6f
mov byte [ebp - 6], al
mov eax, dword [ebp - 0x20]
add al, 0x17
xor al, 0x72
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x20]
add al, 0x18
xor al, 0x74
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x20]
add al, 0x19
xor al, 0x65
mov byte [ebp - 3], al
mov eax, dword [ebp - 0x20]
add al, 0x1a
mov byte [ebp - 1], bl
xor al, 0x64
push 0x10
mov byte [ebp - 2], al
mov al, byte [ebp - 0x1c]
push 0x50ab4a
call fcn.00409561
jmp 0x4092b6