Function at 0x4091b9
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
push ebx
xor ebx, ebx
mov dword [ebp - 0xd], 0x16747474
push esi
push edi
mov dword [ebp - 9], 0x1c131b1a
mov eax, ebx
mov dword [ebp - 5], 0x74747412
mov byte [ebp - 1], bl
xor byte [ebp + eax - 0xd], 0x55
inc eax
cmp eax, 0xc
jb 0x4091e1
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrA]
lea eax, [ebp - 0xd]
push eax
push 0x40e040
mov byte [ebp - 1], bl
call esi
test eax, eax
jne 0x40926f
mov dword [ebp - 0xf], 0x5747474
mov eax, ebx
mov dword [ebp - 0xb], 0x2060614
mov dword [ebp - 7], 0x7411071a
mov word [ebp - 3], 0x7474
mov byte [ebp - 1], bl
xor byte [ebp + eax - 0xf], 0x55
inc eax
cmp eax, 0xe
jb 0x409224
lea eax, [ebp - 0xf]
mov byte [ebp - 1], bl
push eax
mov edi, section..data
push edi
call esi
test eax, eax
jne 0x40926f
push ecx
push ecx
push 0x40e020
mov edx, edi
lea ecx, [ebp - 0xe8]
call fcn.004026f8
add esp, 0xc
lea ecx, [ebp - 0xe8]
mov edx, 0x40e040
push 0x4e25
call fcn.0040273e
pop ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
and dword [ebp - 0x28], 0
mov ebx, eax
cmp dword [ebp - 0x24], 0
jle 0x409475
push 3
pop edi
mov esi, dword [ebx]
mov ecx, esi
call fcn.00409e8f
cmp eax, 1
jbe 0x409462
cmp word [esi], 0x2d
jne 0x409462
movzx eax, word [esi + 2]
cmp eax, 0x61
ja 0x4093bd
je 0x4093ac
cmp eax, 0x4e
ja 0x40933e
je 0x4094a9
cmp eax, 0x49
ja 0x409312
je 0x4093f7
sub eax, 0x41
je 0x4093ac
dec eax
sub eax, 1
je 0x40947a
dec eax
sub eax, 1
je 0x409405
sub eax, 1
jne 0x409462
mov ecx, esi
call fcn.00409174
mov byte [0x412e5c], al
jmp 0x409462
sub eax, 0x4b
je 0x409488
sub eax, 1
je 0x4094b7
sub eax, 1
jne 0x409462
mov ecx, esi
call fcn.00409174
mov byte [0x412e5d], al
jmp 0x409462
cmp eax, 0x56
ja 0x40937f
je 0x4095cf
sub eax, 0x4f
je 0x4094c5
sub eax, 1
je 0x4095f1
dec eax
sub eax, 1
je 0x4095e0
sub eax, 1
jne 0x409462
mov ecx, esi
call fcn.00409174
mov byte [0x412e60], al
jmp 0x409462
sub eax, 0x57
je 0x4095be
sub eax, 1
je 0x4094ff
dec eax
sub eax, 1
jne 0x409462
mov ecx, esi
call fcn.00409174
mov byte [0x412e57], al
jmp 0x409462
mov ecx, esi
call fcn.00409174
mov byte [0x412e63], al
jmp 0x409462
cmp eax, 0x6f
ja 0x4094d3
je 0x4094c5
cmp eax, 0x6b
ja 0x409496
je 0x409488
sub eax, 0x63
je 0x40947a
dec eax
sub eax, 1
je 0x409405
sub eax, 1
je 0x409301
sub eax, edi
jne 0x409462
mov ecx, esi
call fcn.00409174
mov byte [0x412e62], al
jmp 0x409462
mov ecx, esi
call fcn.00409e8f
mov edi, eax
cmp edi, 3
jle 0x40945f
push 0x3d
pop eax
cmp word [esi + 4], ax
jne 0x40945f
push 0x80
mov ecx, 0x412d51
call fcn.00406d67
xor eax, eax
lea esi, [edi - 2]
mov ecx, eax
add esp, 4
mov eax, 0x80
cmp esi, eax
cmovg esi, eax
test esi, esi
jle 0x409459
push 6
pop edx
mov eax, dword [ebx]
mov al, byte [edx + eax]
lea edx, [edx + 2]
mov byte [ecx + 0x412d51], al
inc ecx
cmp ecx, esi
jl 0x409446
mov dword [0x412d4d], ecx
push 3
pop edi
mov eax, dword [ebp - 0x28]
add ebx, 4
inc eax
mov dword [ebp - 0x28], eax
cmp eax, dword [ebp - 0x24]
jl 0x409296
pop edi
pop esi
pop ebx
leave
ret
mov ecx, esi
call fcn.00409174
mov byte [0x412e58], al
jmp 0x409462
mov ecx, esi
call fcn.00409174
mov byte [0x412e5e], al
jmp 0x409462
sub eax, 0x6c
je 0x4094b7
sub eax, 1
je 0x40932d
sub eax, 1
jne 0x409462
mov ecx, esi
call fcn.00409174
mov byte [0x412e5b], al
jmp 0x409462
mov ecx, esi
call fcn.00409174
mov byte [0x412e5a], al
jmp 0x409462
mov ecx, esi
call fcn.00409174
mov byte [0x412e61], al
jmp 0x409462
sub eax, 0x70
je 0x4095f1
dec eax
sub eax, 1
je 0x4095e0
sub eax, 1
je 0x40936e
sub eax, edi
je 0x4095cf
sub eax, 1
jmp 0x409382
mov ecx, esi
call fcn.00409e8f
mov edi, eax
cmp edi, 3
jle 0x40945f
push 0x3d
pop eax
cmp word [esi + 4], ax
jne 0x40945f
push 0x800
lea ecx, [ebp - 0x830]
call fcn.00406d67
mov eax, 0x400
lea esi, [edi - 2]
add esp, 4
cmp esi, eax
cmovg esi, eax
xor eax, eax
mov edx, eax
test esi, esi
jle 0x40955f
mov ecx, dword [ebx]
add ecx, 6
movsx ax, byte [ecx]
lea ecx, [ecx + 2]
mov word [ebp + edx*2 - 0x830], ax
inc edx
cmp edx, esi
jl 0x40954b
lea ecx, [ebp - 0x830]
call fcn.00409d93
test eax, eax
je 0x40964a
lea ecx, [ebp - 0x830]
call fcn.00409b83
test eax, eax
jne 0x40945f
movaps xmm0, xmmword [0x4019f0]
lea ecx, [ebp - 0x15]
push 0x40010
xor edx, edx
mov dword [ebp - 5], 0x74302f3c
push 0x4018e2
movups xmmword [ebp - 0x15], xmm0
mov byte [ebp - 1], dl
call fcn.004096a2
push eax
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, esi
call fcn.00409174
mov byte [0x412e59], al
jmp 0x409462
mov ecx, esi
call fcn.00409174
mov byte [0x412e64], al
jmp 0x409462
mov ecx, esi
call fcn.00409174
mov byte [0x412e5f], al
jmp 0x409462
mov ecx, esi
call fcn.00409e8f
cmp eax, edi
jle 0x409462
push 0x3d
pop ecx
cmp word [esi + 4], cx
jne 0x409462
xor ecx, ecx
lea edx, [eax - 2]
cmp edx, edi
mov dword [ebp - 0x30], ecx
mov word [ebp - 0x2c], cx
cmovg edx, edi
test edx, edx
jle 0x409635
add esi, 6
mov ax, word [esi]
lea esi, [esi + 2]
mov word [ebp + ecx*2 - 0x30], ax
inc ecx
cmp ecx, edx
jl 0x409625
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov word [0x412e55], ax
jmp 0x409462
movaps xmm0, xmmword [0x401a60]
lea ecx, [ebp - 0x1e]
push 0x40010
push 0x4018e2
movups xmmword [ebp - 0x1e], xmm0
mov dword [ebp - 0xe], 0x3b753039
xor edx, edx
mov dword [ebp - 0xa], 0x3375213a
mov dword [ebp - 6], 0x313b203a
mov word [ebp - 2], 0x74
call fcn.0040968f
jmp 0x4095ae