Function at 0x40283b
Capabilities:
Encode data using xor
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
push edi
push 0x4130f8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x20
pop edi
push edi
mov edx, 0x40e04d
mov ecx, 0x413170
call fcn.00406d88
pop ecx
push edi
mov edx, 0x40e06d
mov ecx, 0x413130
call fcn.00406d88
movaps xmm0, xmmword [0x402090]
xor eax, eax
pop ecx
push 0x55
pop ebx
movups xmmword [ebp - 0x22], xmm0
mov byte [ebp - 0x12], 0x3e
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x10], 0x30
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], 0x2c
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], 0
xor byte [ebp + eax - 0x22], bl
inc eax
cmp eax, 0x17
jb 0x4028a3
mov ecx, 0x10000
mov byte [ebp - 0xb], 0
call fcn.00406d0f
mov esi, eax
test esi, esi
jne 0x4028c9
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x8000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4028ed
cmp word [esi + eax*2], 0x5c
je 0x4028ed
xor ecx, ecx
mov word [esi + eax*2], cx
sub eax, 1
jne 0x4028db
lea eax, [ebp - 0x22]
mov edx, esi
push eax
mov ecx, esi
call fcn.00409e9f
pop ecx
mov ecx, esi
call fcn.00409d93
test eax, eax
jne 0x402954
mov byte [ebp - 0xa], 1
mov byte [ebp - 9], bl
mov byte [ebp - 8], 0x10
mov byte [ebp - 7], bl
mov byte [ebp - 6], 0x18
mov byte [ebp - 5], bl
mov byte [ebp - 4], 5
mov byte [ebp - 3], bl
mov byte [ebp - 2], bl
mov byte [ebp - 1], al
xor byte [ebp + eax - 0xa], bl
inc eax
cmp eax, 9
jb 0x402928
push 0x8000
push esi
lea eax, [ebp - 0xa]
mov byte [ebp - 1], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x22]
mov edx, esi
push eax
mov ecx, esi
call fcn.00409e9f
pop ecx
push 0x80
mov edx, 0x412e78
mov ecx, esi
call fcn.00409e32
pop ecx
test eax, eax
jne 0x402a71
mov edx, 0x412e78
call fcn.004084d1
push 0x4011f8
mov edx, 0x412e78
mov ecx, 0x412e98
call fcn.004055d8
mov edx, 0x412e78
mov dword [esp], 0x413170
lea ecx, [ebp - 0x44]
call fcn.004055d8
pop ecx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x44]
call fcn.0040688b
pop ecx
push edi
lea ecx, [ebp - 0x44]
call fcn.00406d67
add esp, 4
mov edx, 0x412e78
push edi
mov edi, 0x412eb8
mov ecx, edi
call fcn.00406d88
lea edx, [ebp - 0x88]
mov ecx, edi
call fcn.004027ec
pop ecx
push 0x40
lea ecx, [ebp - 0x88]
call fcn.00406d67
mov edi, 0x412e78
mov dword [esp], 0x413130
mov edx, edi
lea ecx, [ebp - 0x44]
call fcn.004055d8
pop ecx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x44]
call fcn.0040688b
pop ecx
push 0x20
lea ecx, [ebp - 0x44]
call fcn.00406d67
add esp, 4
mov edx, edi
mov edi, 0x412ed8
mov ecx, edi
push 0x20
call fcn.00406d88
lea edx, [ebp - 0x88]
mov ecx, edi
call fcn.004027ec
pop ecx
push 0x40
lea ecx, [ebp - 0x88]
call fcn.00406d67
add esp, 4
mov ecx, 0x412e78
push 0x20
call fcn.00406d67
add esp, 4
mov edx, ecx
mov ecx, esi
push 0x80
call fcn.00409de1
pop ecx
mov ecx, esi
call fcn.00406db4
lea eax, [ebp - 0x88]
mov ecx, 0x412e98
push eax
call fcn.0040688b
pop ecx
mov esi, 0x413190
lea ecx, [ebp - 0x88]
push esi
call fcn.0040277b
pop ecx
lea eax, [ebp - 0x88]
mov ecx, 0x413130
push eax
call fcn.0040688b
lea ecx, [ebp - 0x88]
mov dword [esp], 0x4131b4
call fcn.0040277b
pop ecx
push 0x2d
pop eax
mov word [0x4131a0], ax
mov word [0x4131aa], ax
mov word [0x4131b4], ax
mov word [0x4131be], ax
xor eax, eax
mov byte [ebp - 6], 0x7b
mov byte [ebp - 5], bl
mov byte [ebp - 4], 0x2e
mov byte [ebp - 3], bl
mov byte [ebp - 2], bl
mov byte [ebp - 1], 0
xor byte [ebp + eax - 6], bl
inc eax
cmp eax, 5
jb 0x402aeb
lea eax, [ebp - 6]
mov byte [ebp - 1], 0
push eax
mov edi, 0x412ef8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
call esi
mov byte [ebp - 4], 0x28
xor eax, eax
mov byte [ebp - 3], bl
mov byte [ebp - 2], bl
mov byte [ebp - 1], 0
xor byte [ebp + eax - 4], bl
inc eax
cmp eax, 3
jb 0x402b23
lea eax, [ebp - 4]
mov byte [ebp - 1], 0
push eax
push edi
call esi
cmp dword [0x412d4d], 0
je 0x402ba3
mov eax, 0x412d51
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x402ba3
mov byte [ebp - 4], 0x7b
xor eax, eax
mov byte [ebp - 3], bl
mov byte [ebp - 2], bl
mov byte [ebp - 1], 0
xor byte [ebp + eax - 4], bl
inc eax
cmp eax, 3
jb 0x402b61
lea eax, [ebp - 4]
mov byte [ebp - 1], 0
push eax
push edi
call esi
mov eax, dword [0x412d4d]
mov edx, 0x412d51
inc eax
mov ecx, 0x412d52
cmp byte [0x412d51], 0x2e
push eax
push 0x412f48
push 0xffffffffffffffff
cmovne ecx, edx
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret