Function at 0x4027eb
Capabilities:
Encode data using xor
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
push edi
push 0x4130f8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x20
pop edi
push edi
mov edx, 0x40e04d
mov ecx, 0x413170
call fcn.00406ba1
pop ecx
push edi
mov edx, str.MrM
mov ecx, 0x413130
call fcn.00406ba1
movaps xmm0, xmmword [0x402040]
xor eax, eax
pop ecx
push 0x55
pop ebx
movups xmmword [ebp - 0x22], xmm0
mov byte [ebp - 0x12], 0x3e
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x10], 0x30
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], 0x2c
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], 0
xor byte [ebp + eax - 0x22], bl
inc eax
cmp eax, 0x17
jb 0x402853
mov ecx, 0x10000
mov byte [ebp - 0xb], 0
call fcn.00406b28
mov esi, eax
test esi, esi
jne 0x402879
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x8000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40289d
cmp word [esi + eax*2], 0x5c
je 0x40289d
xor ecx, ecx
mov word [esi + eax*2], cx
sub eax, 1
jne 0x40288b
lea eax, [ebp - 0x22]
mov edx, esi
push eax
mov ecx, esi
call fcn.00409cd1
pop ecx
mov ecx, esi
call fcn.00409baa
test eax, eax
jne 0x402904
mov byte [ebp - 0xa], 1
mov byte [ebp - 9], bl
mov byte [ebp - 8], 0x10
mov byte [ebp - 7], bl
mov byte [ebp - 6], 0x18
mov byte [ebp - 5], bl
mov byte [ebp - 4], 5
mov byte [ebp - 3], bl
mov byte [ebp - 2], bl
mov byte [ebp - 1], al
xor byte [ebp + eax - 0xa], bl
inc eax
cmp eax, 9
jb 0x4028d8
push 0x8000
push esi
lea eax, [ebp - 0xa]
mov byte [ebp - 1], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x22]
mov edx, esi
push eax
mov ecx, esi
call fcn.00409cd1
pop ecx
push 0x80
mov edx, 0x412e78
mov ecx, esi
call fcn.00409c64
pop ecx
test eax, eax
jne 0x402a21
mov edx, 0x412e78
call fcn.004082e8
push 0x4011f8
mov edx, 0x412e78
mov ecx, 0x412e98
call fcn.004053f4
mov edx, 0x412e78
mov dword [esp], 0x413170
lea ecx, [ebp - 0x44]
call fcn.004053f4
pop ecx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x44]
call fcn.004066a4
pop ecx
push edi
lea ecx, [ebp - 0x44]
call fcn.00406b80
add esp, 4
mov edx, 0x412e78
push edi
mov edi, 0x412eb8
mov ecx, edi
call fcn.00406ba1
lea edx, [ebp - 0x88]
mov ecx, edi
call fcn.0040279c
pop ecx
push 0x40
lea ecx, [ebp - 0x88]
call fcn.00406b80
mov edi, 0x412e78
mov dword [esp], 0x413130
mov edx, edi
lea ecx, [ebp - 0x44]
call fcn.004053f4
pop ecx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x44]
call fcn.004066a4
pop ecx
push 0x20
lea ecx, [ebp - 0x44]
call fcn.00406b80
add esp, 4
mov edx, edi
mov edi, 0x412ed8
mov ecx, edi
push 0x20
call fcn.00406ba1
lea edx, [ebp - 0x88]
mov ecx, edi
call fcn.0040279c
pop ecx
push 0x40
lea ecx, [ebp - 0x88]
call fcn.00406b80
add esp, 4
mov ecx, 0x412e78
push 0x20
call fcn.00406b80
add esp, 4
mov edx, ecx
mov ecx, esi
push 0x80
call fcn.00409c13
pop ecx
mov ecx, esi
call fcn.00406bcd
lea eax, [ebp - 0x88]
mov ecx, 0x412e98
push eax
call fcn.004066a4
pop ecx
mov esi, 0x413190
lea ecx, [ebp - 0x88]
push esi
call fcn.0040272b
pop ecx
lea eax, [ebp - 0x88]
mov ecx, 0x413130
push eax
call fcn.004066a4
lea ecx, [ebp - 0x88]
mov dword [esp], 0x4131b4
call fcn.0040272b
pop ecx
push 0x2d
pop eax
mov word [0x4131a0], ax
mov word [0x4131aa], ax
mov word [0x4131b4], ax
mov word [0x4131be], ax
xor eax, eax
mov byte [ebp - 6], 0x7b
mov byte [ebp - 5], bl
mov byte [ebp - 4], 0x2e
mov byte [ebp - 3], bl
mov byte [ebp - 2], bl
mov byte [ebp - 1], 0
xor byte [ebp + eax - 6], bl
inc eax
cmp eax, 5
jb 0x402a9b
lea eax, [ebp - 6]
mov byte [ebp - 1], 0
push eax
mov edi, 0x412ef8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
call esi
mov byte [ebp - 4], 0x28
xor eax, eax
mov byte [ebp - 3], bl
mov byte [ebp - 2], bl
mov byte [ebp - 1], 0
xor byte [ebp + eax - 4], bl
inc eax
cmp eax, 3
jb 0x402ad3
lea eax, [ebp - 4]
mov byte [ebp - 1], 0
push eax
push edi
call esi
cmp dword [0x412d4d], 0
je 0x402b53
mov eax, 0x412d51
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x402b53
mov byte [ebp - 4], 0x7b
xor eax, eax
mov byte [ebp - 3], bl
mov byte [ebp - 2], bl
mov byte [ebp - 1], 0
xor byte [ebp + eax - 4], bl
inc eax
cmp eax, 3
jb 0x402b11
lea eax, [ebp - 4]
mov byte [ebp - 1], 0
push eax
push edi
call esi
mov eax, dword [0x412d4d]
mov edx, 0x412d51
inc eax
mov ecx, 0x412d52
cmp byte [0x412d51], 0x2e
push eax
push 0x412f48
push 0xffffffffffffffff
cmovne ecx, edx
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret