Function at 0x409c81
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x91c
mov dword [ebp - 0x34], 0x3a
mov eax, dword [ebp - 0x34]
push ebx
push esi
push edi
push 0x21
pop ecx
xor al, cl
mov byte [ebp - 0x30], al
mov eax, dword [ebp - 0x34]
inc al
xor al, cl
mov byte [ebp - 0x2f], al
mov eax, dword [ebp - 0x34]
add al, 2
xor al, cl
mov byte [ebp - 0x2e], al
mov eax, dword [ebp - 0x34]
add al, 3
xor al, 0x50
mov byte [ebp - 0x2d], al
mov eax, dword [ebp - 0x34]
add al, 4
xor al, 0x41
mov byte [ebp - 0x2c], al
mov eax, dword [ebp - 0x34]
add al, 5
xor al, 0x53
mov byte [ebp - 0x2b], al
mov eax, dword [ebp - 0x34]
add al, 6
xor al, 0x53
mov byte [ebp - 0x2a], al
mov eax, dword [ebp - 0x34]
add al, 7
xor al, 0x57
mov byte [ebp - 0x29], al
mov eax, dword [ebp - 0x34]
add al, 8
xor al, 0x4f
mov byte [ebp - 0x28], al
mov eax, dword [ebp - 0x34]
add al, 9
xor al, 0x52
mov byte [ebp - 0x27], al
mov eax, dword [ebp - 0x34]
add al, 0xa
xor al, 0x44
mov byte [ebp - 0x26], al
mov eax, dword [ebp - 0x34]
add al, 0xb
xor al, cl
mov byte [ebp - 0x25], al
mov eax, dword [ebp - 0x34]
add al, 0xc
xor al, cl
mov byte [ebp - 0x24], al
mov eax, dword [ebp - 0x34]
add al, 0xd
xor al, cl
xor ebx, ebx
mov byte [ebp - 0x23], al
mov edx, ebx
mov al, byte [ebp - 0x30]
mov byte [ebp - 0x22], bl
mov al, byte [ebp + edx - 0x30]
mov ecx, dword [ebp - 0x34]
add cl, dl
xor cl, al
mov byte [ebp + edx - 0x30], cl
inc edx
cmp edx, 0xe
jb 0x409d2b
lea eax, [ebp - 0x30]
mov byte [ebp - 0x22], bl
push eax
mov esi, section..data
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
jne 0x40a2b0
push ecx
push ecx
push 0x414020
mov edx, esi
lea ecx, [ebp - 0x118]
call fcn.00401f28
add esp, 0xc
lea ecx, [ebp - 0x118]
mov edx, 0x414040
push 0x4e25
call fcn.00401f6e
pop ecx
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
and dword [ebp - 0x58], 0
mov ebx, eax
cmp dword [ebp - 0x54], 0
jle 0x409f88
push 3
pop edi
mov esi, dword [ebx]
mov ecx, esi
call fcn.0040af78
cmp eax, 1
jbe 0x409f75
cmp word [esi], 0x2d
jne 0x409f75
movzx eax, word [esi + 2]
cmp eax, 0x61
ja 0x409ed6
je 0x409ec5
cmp eax, 0x4e
ja 0x409e57
je 0x409fbc
cmp eax, 0x49
ja 0x409e2b
je 0x409f10
sub eax, 0x41
je 0x409ec5
dec eax
sub eax, 1
je 0x409f8d
dec eax
sub eax, 1
je 0x409f1e
sub eax, 1
jne 0x409f75
mov ecx, esi
call fcn.00409c1a
mov byte [0x418e5c], al
jmp 0x409f75
sub eax, 0x4b
je 0x409f9b
sub eax, 1
je 0x409fca
sub eax, 1
jne 0x409f75
mov ecx, esi
call fcn.00409c1a
mov byte [0x418e5d], al
jmp 0x409f75
cmp eax, 0x56
ja 0x409e98
je 0x40a1a0
sub eax, 0x4f
je 0x409fd8
sub eax, 1
je 0x40a1c2
dec eax
sub eax, 1
je 0x40a1b1
sub eax, 1
jne 0x409f75
mov ecx, esi
call fcn.00409c1a
mov byte [0x418e60], al
jmp 0x409f75
sub eax, 0x57
je 0x40a18f
sub eax, 1
je 0x40a012
dec eax
sub eax, 1
jne 0x409f75
mov ecx, esi
call fcn.00409c1a
mov byte [0x418e57], al
jmp 0x409f75
mov ecx, esi
call fcn.00409c1a
mov byte [0x418e63], al
jmp 0x409f75
cmp eax, 0x6f
ja 0x409fe6
je 0x409fd8
cmp eax, 0x6b
ja 0x409fa9
je 0x409f9b
sub eax, 0x63
je 0x409f8d
dec eax
sub eax, 1
je 0x409f1e
sub eax, 1
je 0x409e1a
sub eax, edi
jne 0x409f75
mov ecx, esi
call fcn.00409c1a
mov byte [0x418e62], al
jmp 0x409f75
mov ecx, esi
call fcn.0040af78
mov edi, eax
cmp edi, 3
jle 0x409f72
push 0x3d
pop eax
cmp word [esi + 4], ax
jne 0x409f72
lea esi, [eax + 0x43]
mov ecx, 0x418d51
push esi
call fcn.00406851
xor eax, eax
lea edx, [edi - 2]
add esp, 4
mov ecx, eax
cmp edx, esi
cmovg edx, esi
test edx, edx
jle 0x409f6c
push 6
pop esi
mov eax, dword [ebx]
mov al, byte [esi + eax]
lea esi, [esi + 2]
mov byte [ecx + 0x418d51], al
inc ecx
cmp ecx, edx
jl 0x409f59
mov dword [0x418d4d], ecx
push 3
pop edi
mov eax, dword [ebp - 0x58]
add ebx, 4
inc eax
mov dword [ebp - 0x58], eax
cmp eax, dword [ebp - 0x54]
jl 0x409daf
pop edi
pop esi
pop ebx
leave
ret
mov ecx, esi
call fcn.00409c1a
mov byte [0x418e58], al
jmp 0x409f75
mov ecx, esi
call fcn.00409c1a
mov byte [0x418e5e], al
jmp 0x409f75
sub eax, 0x6c
je 0x409fca
sub eax, 1
je 0x409e46
sub eax, 1
jne 0x409f75
mov ecx, esi
call fcn.00409c1a
mov byte [0x418e5b], al
jmp 0x409f75
mov ecx, esi
call fcn.00409c1a
mov byte [0x418e5a], al
jmp 0x409f75
mov ecx, esi
call fcn.00409c1a
mov byte [0x418e61], al
jmp 0x409f75
sub eax, 0x70
je 0x40a1c2
dec eax
sub eax, 1
je 0x40a1b1
sub eax, 1
je 0x409e87
sub eax, edi
je 0x40a1a0
sub eax, 1
jmp 0x409e9b
mov ecx, esi
call fcn.0040af78
mov edi, eax
cmp edi, 3
jle 0x409f72
push 0x3d
pop eax
cmp word [esi + 4], ax
jne 0x409f72
push 0x800
lea ecx, [ebp - 0x918]
call fcn.00406851
mov eax, 0x400
lea esi, [edi - 2]
add esp, 4
cmp esi, eax
cmovg esi, eax
xor eax, eax
mov edx, eax
test esi, esi
jle 0x40a072
mov ecx, dword [ebx]
add ecx, 6
movsx ax, byte [ecx]
lea ecx, [ecx + 2]
mov word [ebp + edx*2 - 0x918], ax
inc edx
cmp edx, esi
jl 0x40a05e
lea ecx, [ebp - 0x918]
call fcn.0040ae7c
test eax, eax
je 0x40a21b
lea ecx, [ebp - 0x918]
call fcn.0040ac6c
test eax, eax
jne 0x409f72
mov dword [ebp - 0x50], 0x12
mov eax, dword [ebp - 0x50]
xor al, 0x49
mov byte [ebp - 0x4c], al
mov eax, dword [ebp - 0x50]
inc al
xor al, 0x6e
mov byte [ebp - 0x4b], al
mov eax, dword [ebp - 0x50]
add al, 2
xor al, 0x63
mov byte [ebp - 0x4a], al
mov eax, dword [ebp - 0x50]
add al, 3
xor al, 0x6f
mov byte [ebp - 0x49], al
mov eax, dword [ebp - 0x50]
add al, 4
xor al, 0x72
mov byte [ebp - 0x48], al
mov eax, dword [ebp - 0x50]
add al, 5
xor al, 0x72
mov byte [ebp - 0x47], al
mov eax, dword [ebp - 0x50]
add al, 6
xor al, 0x65
mov byte [ebp - 0x46], al
mov eax, dword [ebp - 0x50]
add al, 7
xor al, 0x63
mov byte [ebp - 0x45], al
mov eax, dword [ebp - 0x50]
add al, 8
xor al, 0x74
mov byte [ebp - 0x44], al
mov eax, dword [ebp - 0x50]
add al, 9
xor al, 0x20
mov byte [ebp - 0x43], al
mov eax, dword [ebp - 0x50]
add al, 0xa
xor al, 0x6e
mov byte [ebp - 0x42], al
mov eax, dword [ebp - 0x50]
add al, 0xb
xor al, 0x6f
mov byte [ebp - 0x41], al
mov eax, dword [ebp - 0x50]
add al, 0xc
xor al, 0x74
mov byte [ebp - 0x40], al
mov eax, dword [ebp - 0x50]
add al, 0xd
xor al, 0x65
mov byte [ebp - 0x3f], al
mov eax, dword [ebp - 0x50]
add al, 0xe
xor al, 0x20
mov byte [ebp - 0x3e], al
mov eax, dword [ebp - 0x50]
add al, 0xf
xor al, 0x73
mov byte [ebp - 0x3d], al
mov eax, dword [ebp - 0x50]
add al, 0x10
xor al, 0x69
mov byte [ebp - 0x3c], al
mov eax, dword [ebp - 0x50]
add al, 0x11
xor al, 0x7a
mov byte [ebp - 0x3b], al
mov eax, dword [ebp - 0x50]
add al, 0x12
xor al, 0x65
mov byte [ebp - 0x3a], al
mov eax, dword [ebp - 0x50]
add al, 0x13
xor al, 0x21
xor ebx, ebx
mov byte [ebp - 0x39], al
mov al, byte [ebp - 0x4c]
lea ecx, [ebp - 0x50]
push 0x40010
push 0x4018e2
mov byte [ebp - 0x38], bl
call fcn.0040a352
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, esi
call fcn.00409c1a
mov byte [0x418e59], al
jmp 0x409f75
mov ecx, esi
call fcn.00409c1a
mov byte [0x418e64], al
jmp 0x409f75
mov ecx, esi
call fcn.00409c1a
mov byte [0x418e5f], al
jmp 0x409f75
mov ecx, esi
call fcn.0040af78
cmp eax, edi
jle 0x409f75
push 0x3d
pop ecx
cmp word [esi + 4], cx
jne 0x409f75
xor ecx, ecx
lea edx, [eax - 2]
cmp edx, edi
mov dword [ebp - 0x60], ecx
mov word [ebp - 0x5c], cx
cmovg edx, edi
test edx, edx
jle 0x40a206
add esi, 6
mov ax, word [esi]
lea esi, [esi + 2]
mov word [ebp + ecx*2 - 0x60], ax
inc ecx
cmp ecx, edx
jl 0x40a1f6
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov word [0x418e55], ax
jmp 0x409f75
mov byte [ebp - 0x1e], 0x48
lea ecx, [ebp - 0x1e]
mov byte [ebp - 0x1d], 0x7b
xor edx, edx
mov byte [ebp - 0x1c], 0x77
mov byte [ebp - 0x1b], 0x68
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0x19], 0x71
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x16], 0x23
mov byte [ebp - 0x15], 0x71
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x77
mov byte [ebp - 0x12], 0x68
mov byte [ebp - 0x11], 0x23
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 0xd], 0x68
mov byte [ebp - 0xc], 0x23
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x77
mov byte [ebp - 8], 0x23
mov byte [ebp - 7], 0x69
mov byte [ebp - 6], 0x72
mov byte [ebp - 5], 0x78
mov byte [ebp - 4], 0x71
mov byte [ebp - 3], 0x67
mov byte [ebp - 2], 0x24
push 0x40010
mov byte [ebp - 1], dl
mov al, byte [ebp - 0x1e]
push 0x4018e2
call fcn.0040a343
push eax
push edx
jmp 0x40a181
mov dword [ebp - 0x20], 0x54
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x1c], 7
mov byte [ebp - 0x1b], 0x31
mov byte [ebp - 0x1a], 0x20
mov byte [ebp - 0x19], 0x20
mov byte [ebp - 0x18], 0x3d
mov byte [ebp - 0x17], 0x3a
mov byte [ebp - 0x16], 0x33
mov byte [ebp - 0x15], 0x27
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], 0x3b
mov byte [ebp - 0x11], 0x20
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x32
mov byte [ebp - 0xe], 0x3b
mov byte [ebp - 0xd], 0x21
mov byte [ebp - 0xc], 0x3a
mov byte [ebp - 0xb], 0x30
mov byte [ebp - 0xa], 0x78
mov byte [ebp - 9], 0x74
mov byte [ebp - 8], 0x35
mov byte [ebp - 7], 0x36
mov byte [ebp - 6], 0x3b
mov byte [ebp - 5], 0x26
mov byte [ebp - 4], 0x20
mov byte [ebp - 3], 0x31
push 0x10
mov byte [ebp - 2], 0x30
mov al, byte [ebp - 0x1c]
push 0x4018e2
mov byte [ebp - 1], bl
call fcn.0040a376
jmp 0x40a17f